Physical Security for Oregon Cannabis Facilities
A layered operating discipline for protecting people, controlled areas, evidence, and continuity.
Document
KB-006
Version
1.0
Reviewed
Reading time
4 min read
Author
Garrit Hunt
Executive summary
Physical security is strongest when approved plans, barriers, access, alarms, surveillance, evidence, and human response operate as one managed system.
Opening thesis
Physical security is not the equipment installed around a building. It is the governed relationship between the approved premises, physical barriers, access decisions, alarms, surveillance, evidence, and people authorized to respond. Any one layer can fail while the others appear normal. A useful program therefore asks whether those layers still work together under current operating conditions. VSG recommends beginning review for an Oregon cannabis licensee with the applicable OLCC rules and the approved security plan. VSG recommendations can strengthen daily readiness, but they do not replace the law, Commission approval, or qualified legal advice.
Build from the legal baseline
Current Oregon rules assign the licensee responsibility for safeguarding marijuana items and required records. OAR 845-025-1410 includes requirements for commercial-grade, non-residential locks on applicable external doors and gates, secured conditions when the business is not operating, electronic backup of electronic records, and protected storage of required records. OAR 845-025-1420 addresses a fully operational alarm system. Its stated exception excuses subsection (1) and subsections (2)(a) and (2)(b) only when at least one authorized representative is physically present on the licensed premises at all times when it is closed for business; subsection (2)(c)’s mechanism to immediately notify law enforcement or a security company still applies.
Surveillance is another regulated layer. OAR 845-025-1430 addresses the equipment, failure notification, battery backup, and secure storage needed for a fully operational recording system. OAR 845-025-1440 identifies required coverage areas and placement outcomes. OAR 845-025-1450 establishes recording, image, retention, access, outage-notice, and backup requirements. OAR 845-025-1460 governs the surveillance room or area, authorized access, off-site storage, maintenance records, and permitted off-site monitoring.
These are selected legal requirements, not a complete facility checklist. Applicability depends on the license and premises. Operators should review the current rule text, approved plan, and any Commission conditions before making a compliance decision.
Keep the recording choice precise
OAR 845-025-1450, as amended effective January 1, 2026, allows two methods for satisfying its continuous-recording requirement: cameras that continuously record and store all recordings, or a qualifying motion-detection camera system. The second method is conditional. It requires specified analytics, stored video, searchable and auditable logs, coverage of required detection zones, and settings that record without interruption whenever a person remains in view. The rule’s retention and applicable off-site backup requirements still apply.
Motion detection is therefore not a universal permission to store only occasional clips. A licensee using that path must be able to show that the complete system and configuration meet the rule. OLCC Compliance Education Bulletin CE2025-07 provides implementation context but does not supersede the rule.
Manage the connections between layers
VSG recommends mapping each protected operation from asset to response. Identify who may enter, how authorization is issued and removed, which alarm condition reaches which person, what camera view supports verification, where evidence is retained, and who may approve an operational decision. Then test the complete path. A working camera is not enough if the view is blocked. A valid credential is not enough if the role no longer needs access. An alarm notification is not enough if no one owns the next decision.
This integrated review is a VSG recommendation, not an additional OLCC requirement. Its purpose is to expose gaps between individually functioning controls before an incident or inspection does.
Control changes before they create drift
Physical security changes as the business changes. OAR 845-025-1175 requires prior written Commission approval for material or substantial physical changes described by the rule, including covered changes that require additional cameras or a security-system change. OAR 845-025-1400 requires approval before implementing a proposed change to an approved security plan.
VSG recommends a change record that identifies the proposed condition, applicable rule and approval path, accountable owner, implementation evidence, and post-change test. This keeps contractors, operations, compliance, and leadership aligned. It also prevents a seemingly minor relocation, configuration adjustment, or temporary workaround from silently weakening a different layer.
Related reading
From this brief
“Layered security is a sequence of controls, owners, and decisions.”
Field observation
Physical-security failures can appear at the seams. A door is added without revising coverage. A camera is repositioned without checking the approved plan. An alarm contact leaves the company. A storage setting changes during maintenance. Each action may look reasonable in isolation. Together they can create a facility that no longer matches its documentation or intended response. A disciplined review follows the protective path across systems and owners instead of inspecting devices one at a time.
Nexus insight
For layered physical security, a client-authorized Nexus deployment is intended to help organize approved controls, responsible owners, review dates, exceptions, changes, incidents, and closure evidence. Nexus does not approve premises changes, interpret law for the client, operate security equipment independently, or dispatch a response without authorized human action. Its role is to make relationships and unresolved decisions visible so the client’s accountable people can act with better context.
Full-reading infographic
Primary sources
Source ID | Official primary source | Use in this brief |
|---|---|---|
OR-OAR-845-025-1175 | OAR 845-025-1175 — Changing, Altering, or Modifying Licensed Premises | Prior approval for covered material or substantial premises changes. |
OR-OAR-845-025-1400 | Approved-plan and plan-change requirements. | |
OR-OAR-845-025-1410 | Safeguards, locks, secured conditions, and record protection. | |
OR-OAR-845-025-1420 | Alarm operation, detection, notification, and contact mechanism. | |
OR-OAR-845-025-1430 | Equipment, failure notification, battery backup, and secure storage. | |
OR-OAR-845-025-1440 | OAR 845-025-1440 — Required Camera Coverage and Camera Placement | Required areas and camera-placement outcomes. |
OR-OAR-845-025-1450 | Recording methods, motion-detection conditions, retention, backup, and outage notice. | |
OR-OAR-845-025-1460 | OAR 845-025-1460 — Location and Maintenance of Surveillance Equipment | Secure equipment location, access list, maintenance log, and off-site monitoring. |
OLCC-CE2025-07 | Commission context for the surveillance amendments effective January 1, 2026. |
Document KB-006
Version 1.0
Tags · Physical Security, Oregon Cannabis, Access Control, Surveillance
Written by
Garrit Hunt
Founder & COO, Veterans Security Group
Garrit Hunt founded Veterans Security Group, a veteran-led security, intelligence, and technology company based in Oregon. He has worked in private security since 2011 across armed and executive protection, cannabis security, surveillance, and high-risk environments, and served in the U.S. Air Force as a RED HORSE fire department rescue technician. The VSG Field Manual is the doctrine behind VSG’s managed security leadership and the Nexus platform.
Related briefs
Continue in the Field Manual
KB-005
Compliance
OLCC Security Rules for Oregon Cannabis Operators
Oregon cannabis operators need to meet current OLCC security rules and manage the people, evidence, decisions, and review practices that keep those controls ready.
5 min read
KB-007
Operations
Security Readiness for Oregon Cannabis Operators
Security readiness turns approved controls into a recurring, evidence-based management practice with clear owners, tests, exceptions, and verified closure.
5 min read
Apply this doctrine
Need this applied to your facility?
VSG delivers managed security leadership, assessments, procedures, and the Nexus platform to Oregon cannabis operators and other regulated businesses.