Incident Response

Opening thesis

Incident response is a governed decision process under pressure. Its first purpose is to protect people and stabilize the immediate condition. It must then preserve evidence, identify applicable reporting obligations, support recovery, and turn what happened into verified improvement. Speed matters, but unstructured speed can destroy context or send the wrong message to the wrong authority. A useful plan defines who may act, what they may authorize, and how facts move from the scene to leadership. The following framework is operational guidance, not legal advice; organizations should confirm current regulatory, employment, insurance, and contractual duties with qualified advisers.

Establish command without overstating the event

The first record should distinguish observation from conclusion. “The west door was found open and inventory is being reconciled” is more useful than declaring a burglary before the evidence supports it. Record the time, location, reporter, people at risk, affected operation, immediate protective action, and known uncertainty. If emergency services are needed, contact them through the organization’s established procedures.

VSG recommends assigning an incident lead and an executive decision owner. The incident lead coordinates facts and tasks. The decision owner authorizes consequential actions such as closing an area, suspending access, engaging outside counsel, making a regulatory notice, or restoring operations. Those roles may be held by different people. A backup should be named before an incident, and responders should know when the event exceeds their authority.

This command structure is VSG doctrine. It should be adapted to the organization’s actual legal responsibilities and staffing.

Stabilize conditions and preserve evidence

Responders should address immediate life safety and prevent further harm before focusing on documentation. Once conditions allow, preserve the sources most likely to explain what occurred: surveillance video, access records, alarm history, system logs, photographs, witness accounts, inventory records, communications, and a timeline of actions. Preserve original material where possible and document who collected or handled it.

For Oregon cannabis surveillance, OAR 845-025-1450 requires at least 90 calendar days of recordings, immediate availability to the Commission upon request in the specified format, and longer retention when the Commission requests it. The rule also requires Commission notice within 48 hours of an equipment failure or system outage lasting 30 minutes or more. Those requirements should inform evidence and escalation procedures, but they do not replace a case-specific preservation direction from law enforcement, the Commission, counsel, or an insurer.

VSG recommends an incident-specific preservation hold when relevant evidence could age out, be overwritten, or be changed by ordinary operations. An authorized person should define its scope and release.

Apply the right notification to the right incident

OAR 845-025-1160(3) requires an OLCC licensee or laboratory licensee to notify the Commission in the prescribed manner as soon as reasonably practical and no later than 24 hours after theft of marijuana items or money from the licensed premises. The trigger is specific. It is not a universal 24-hour OLCC deadline for every security, safety, or operational incident.

OLCC Compliance Education Bulletin CE2025-04 reinforces that scope, explains the Commission’s theft-notification process, and advises reporting theft to local law enforcement. The bulletin states that theft not involving marijuana items or money from the premises should not be reported to OLCC through that theft process. The rule controls if the bulletin and rule ever differ.

Work-related injuries may activate a separate Oregon OSHA path. Current Oregon OSHA guidance requires employers to report work-related fatalities and catastrophes within eight hours, and qualifying in-patient hospitalizations, loss of an eye, and specified amputations or avulsions within 24 hours. These are not OLCC deadlines. VSG recommends a notification matrix that identifies each trigger, recipient, deadline, authorized reporter, required information, and confirmation of submission. Counsel should review the matrix for the organization’s circumstances.

Recover deliberately and learn visibly

Operational recovery should state what can resume, under what temporary safeguards, who authorized the decision, and what remains unresolved. Do not let pressure to reopen erase evidence, bypass an approval, or turn an interim control into a permanent condition. Track corrective actions to an owner and a verification method.

FEMA’s National Continuous Improvement Guidance describes an after-action report as a record of key incident information, strengths, areas for improvement, and potential recommended actions. VSG recommends using that discipline proportionally. A short incident may need a concise review; a serious or repeated event may need a formal report and action plan. The product is not complete until approved actions have owners, dates, and evidence of effectiveness.