Cannabis Industry Compliance and Security
The legal cannabis industry in the United States generated $30.1 billion in revenue in 2024 and supports more than 425,000 full-time equivalent jobs, operating under a complex regulatory framework that governs product tracking, financial services, physical security, and data protection[^c9][^c16]. Cumulative state tax revenue from adult-use cannabis sales has exceeded $24.7 billion since 2014[^c23]. As of 2026, 41 states have comprehensive medical cannabis programs, with 24 states regulating adult use[^c21][^c30]. State regulators mandate seed-to-sale tracking systems to monitor inventory and prevent diversion[^c1], but cannabis businesses lose an estimated $2.6 billion annually to theft, diversion, and inventory shrinkage[^c2], with roughly 90 percent of losses attributed to employees rather than external criminals[^c11].
Banking access remains one of the industry's most persistent operational challenges. Recreational cannabis remains a Schedule I substance under federal law[^c6], causing most financial institutions to decline service and resulting in predominantly cash-based operations[^c7]. While more than 800 banks and credit unions report some level of involvement with cannabis businesses, they represent a small fraction of the more than 8,600 total U.S. depository institutions[^c17]. In June 2026, the SAFE Banking Act was reintroduced in both chambers of Congress as S.4942 and H.R.9471, with bipartisan sponsorship led by Senators Merkley and Warren and Representative Joyce. The National Cannabis Industry Association and American Bankers Association both endorsed the legislation. Meanwhile, the CLIMB Act (H.R. 7987), introduced in March 2026, proposes a narrower safe harbor for business assistance including advertising and marketing services to cannabis businesses. Neither the April 2026 Schedule III rescheduling of medical cannabis nor potential full rescheduling would resolve banking access issues[^c24]. The federal-state legal mismatch drives unique compliance demands, and the lack of traditional financing creates cascading cash-flow problems throughout the supply chain[^c3].
In April 2026, the Department of Justice and DEA issued a [[regulation/schedule-iii-cannabis-rescheduling|Final Order]] placing FDA-approved products and state-licensed medical marijuana into Schedule III[^c10], but recreational cannabis remains Schedule I, and the order has not opened mainstream banking access. The order faces immediate legal challenges in the D.C. Circuit, with three consolidated petitions arguing that the acting attorney general exceeded his statutory authority[^c14]. A broader DEA rescheduling hearing commenced on June 29, 2026, with a participant roster composed entirely of rescheduling opponents after pro-reform groups including NORML and the Drug Policy Alliance were excluded on standing grounds. The hearing is scheduled to conclude by July 15, 2026. More than 390 state-licensed medical marijuana businesses signed up for DEA registration within the first 72 hours of the portal opening.
Compliance Frameworks and Best Practices
Effective compliance requires a structured approach across cultivation, manufacturing, and retail operations. In cultivation, operators must maintain licenses, implement good production practices with detailed standard operating procedures, establish sanitation programs, track all plants and batches from genetics through harvest yields, and comply with pest control requirements. Manufacturers need preventative control plans for extracts and edibles that identify hazards and mitigation procedures, accurate labeling, and reliance on cultivator information for regulatory reporting. Retailers require employee training, accurate labeling verification, and systems to track and report sales and inventory to regulatory bodies.
Seven core strategies underpin sustained compliance: establishing a strong internal control environment with written policies; implementing a robust risk assessment process with regular internal reviews; designing documented control activities for inventory management, quality control, security, and record-keeping; maintaining open communication channels with documented information flows; conducting ongoing training and assessments for all employees; performing regular internal audits; and deploying systems and software to automate inventory tracking, record-keeping, and reporting[^c31]. Technology solutions such as video monitoring and data tracking are critical for audit readiness, with surveillance systems requiring 30 to 180 days of video retention depending on jurisdiction[^c34].
Voluntary Consensus Standards
The Foundation of Cannabis Unified Standards (FOCUS) publishes the FS-3001 Cannabis Retail Standard Index, a voluntary consensus framework developed through a process involving industry professionals, regulatory agencies, quality assurance, law enforcement, and public health experts. The standard provides a 28-section framework covering quality management, general operations, employment, training, recordkeeping, facility management, security, surveillance systems, alarm systems, health and safety, sanitation, hazard control, pest control, production, quality control, testing, traceability and recall, packaging and labeling, product storage, inventory management, waste management, transfers and transport, retail operations, and customer and patient management[^c32].
At the international level, ISO/TC 353 was established in 2025 to develop standards for safety, security, and quality systems of cannabis facilities and operations in jurisdictions where such activities are legal. The committee's scope covers the supply chain from cultivation through processing, production, packaging, distribution, transportation, and retail stores, including terminology, test methods, equipment and operation, waste disposal, air quality, good production practices, good manufacturing practices, security of facilities and operations, and related quality management systems[^c33]. The secretariat is held by the Standards Council of Canada, and the committee is chaired by Dr. Ralph Paroli.
Cybersecurity and Data Protection
The industry is particularly vulnerable to cyberattacks, with 59 percent of cannabis companies not having taken steps to prevent them[^c5]. A single data breach in November 2024 exposed 380,000 cannabis consumers[^c26]. Ransomware groups such as Qilin — responsible for at least 557 incidents globally between January and May 2026 — and NightSpire — claiming 259 victims since February 2025 — have demonstrated that cannabis businesses are priority targets[^c8]. The Ohio Marijuana Card breach exposed nearly one million patient records[^c12], and an international breach of Cannabis Club Systems (PuffPal) exposed identity documents of nearly one million cannabis club members across 40 countries[^c18]. Schedule III rescheduling introduces new cybersecurity compliance obligations under HIPAA and other federal data privacy laws for medical cannabis operators[^c13]. Voice phishing attacks rose 442 percent between the first and second halves of 2024, and average attacker breakout times fell to 48 minutes.
Physical Security
Physical security requirements vary by state but generally mandate video surveillance, access control systems, perimeter barriers, and alarm systems for licensed facilities. A wave of violent incidents in California in 2026 highlighted ongoing security risks: a fatal shooting at a Sacramento cannabis grow warehouse on May 8 left one burglary suspect dead and the security guard charged with voluntary manslaughter; an armed burglary at a Monterey County cannabis greenhouse on June 14 led to multi-county vehicle pursuits and six arrests; and a Michigan dispensary arson on May 11 saw burglars accidentally set themselves on fire while trying to torch the building[^c19][^c25]. In Maine, a dispensary was burglarized for the third time in six weeks in June 2026. The launch of kidnap and ransom insurance for cannabis executives in April 2026 underscored the physical security risks arising from cash-heavy operations and limited banking access.
Advertising and Marketing Regulation
Cannabis advertising and marketing face an increasingly detailed patchwork of state restrictions. Washington's SSB 5206, effective January 2026, banned transit advertisements and commercial mascots while imposing 1,000-foot proximity buffers[^c27]. Minnesota's advertising statutes established a 30 percent under-21 audience cap and prohibited unsolicited pop-up ads. The CLIMB Act explicitly includes advertising and marketing services as protected business assistance under its proposed federal safe harbor. The FTC and FDA have conducted joint enforcement against copycat packaging and unsubstantiated health claims.
International Developments
In Canada, the March 2025 streamlining amendments to the Cannabis Regulations took full effect on March 12, 2026, with all labels now required to display simplified potency information. Nova Scotia introduced Cannabis Control Act reforms in February 2026 expanding enforcement and creating landlord liability for unauthorized distribution. British Columbia's Community Safety Unit conducted enforcement actions against unlicensed producers, seizing cannabis products worth nearly $8 million CAD. The Controlled Substances Regulations take effect October 1, 2026, consolidating Canada's cannabis and controlled substances frameworks into a single regime[^c28]. Internationally, New Zealand deregulated industrial hemp cultivation in July 2026, China placed all synthetic cannabinoids under national control, Thailand tightened cannabis smuggling penalties and advanced medical-only cannabis legislation, and India's Odisha state formed a dedicated anti-narcotics task force.
Product Safety
Product safety testing has emerged as a significant concern, with documented laboratory fraud and contamination issues in multiple states raising questions about supply chain integrity as federal rescheduling proceeds. AI-powered security technologies — including false-alarm filtering for remote monitoring, video analytics platforms that connect surveillance footage with point-of-sale and inventory data, and compliance-aware monitoring systems — have emerged as critical tools for improving operational security at cannabis facilities.