Security Requirements for Oklahoma Medical Marijuana Dispensaries, Growers & Processors
Oklahoma medical marijuana growers, processors, and dispensaries are subject to detailed security requirements designed to prevent unauthorized access, theft, and diversion of marijuana and marijuana products.
For Oklahoma medical marijuana businesses, understanding the interaction between OMMA and OBN requirements is essential. A facility may satisfy one agency’s requirements while remaining noncompliant with those imposed by the other. This distinction is particularly important because federal DEA regulations also require Oklahoma medical marijuana businesses to comply with applicable OMMA and OBN security requirements. See 21 CFR 1301.13 (k)(10).
OMMA's General Security Requirement
OMMA's security rule begins with a broad requirement applicable to commercial licensees. Under OAC 442:10-6-1(a), commercial licensees must implement appropriate security measures to deter and prevent unauthorized entrance into areas containing marijuana and to prevent the theft and diversion of medical marijuana and medical marijuana products. Licensees are also responsible for the security of marijuana on the licensed premises and while it is in their possession during transportation.
OMMA's rule establishes the general obligation, but many of the more specific physical-security standards applicable to growers, processors, and dispensaries are found in OBN's regulations.
OBN Requires Effective Controls Against Theft and Diversion
OAC Title 475 contains an entire chapter addressing security requirements for OBN registrants. The starting point is OAC 475:20-1-2, which requires applicants and registrants to maintain effective controls and procedures to guard against theft and diversion of controlled dangerous substances.
OBN does not necessarily evaluate every facility in isolation based upon a single piece of security equipment. Its rules permit the agency to consider the facility's overall security system, including the amount and type of controlled substances handled, building construction, safes and secure enclosures, key and combination controls, alarm systems, public access, employee supervision, visitor procedures, local police protection, and inventory controls. OAC 475:20-1-2(b).
That means security compliance should be approached as a system—not simply as a checklist of locks and alarms.
Alarm Systems
One of the clearest requirements applies to alarm systems.
Under OAC 475:20-1-3(b)(1), each registered premises must have a security alarm system that, upon unauthorized entry, transmits a signal to a central-station protection agency, a local or state police agency with a legal duty to respond, a 24-hour control station operated by the registrant, or another source of protection approved by the OBN Director.
Growers and processors face an additional manufacturing-area requirement under OAC 475:20-1-4(b)(2): each building must have the required security alarm system.
OBN's current self-inspection materials likewise ask whether the registered premises and each building have an alarm system and whether unauthorized entry generates a signal to an appropriate monitoring or response service.
As a practical matter, a local audible alarm by itself should not be assumed to satisfy these provisions because the rules contemplate transmission of the alarm to an appropriate monitoring or response source.
Doors, Locks, and Access Control
Medical marijuana storage areas generally must have self-closing, self-locking doors constructed of substantial material appropriate to the construction of the building. OAC 475:20-1-3(b)(2).
There is an alternative: a door may instead remain closed and locked whenever it is not being used, provided that it remains under the direct observation of a responsible employee or agent while in use.
The details matter. Exterior hinges must be sealed, welded, or otherwise constructed to inhibit removal. Locking devices must generally be combination, keyless-entry, or key-lock systems. If physical keys are used, access must be restricted to a limited number of employees. If a combination or keyless-entry system is used, access or knowledge of the combination must be restricted to a minimum number of employees, and the system must permit the combination or access credentials to be changed when an employee with access leaves employment.
For businesses with employee turnover, that last requirement is particularly important. Terminating an employee without promptly terminating the employee's physical access to controlled areas can create a security-compliance problem in addition to the obvious business risk.
Restricting Employee and Visitor Access
Not every employee should have access to marijuana storage areas.
Under OAC 475:20-1-3(b)(3), storage areas must be accessible only to an "absolute minimum number of authorized employees." Maintenance personnel, contractors, guests, and other visitors who must enter or pass through controlled areas must be adequately observed by an employee specifically authorized in writing.
OBN applies a similar standard to grow, processing, packaging, and manufacturing areas.
Businesses should therefore consider not only whether a door is locked, but who has the key, code, or credential necessary to open it and whether that access remains necessary for the employee's job duties.
Employee Screening
Every employee who has access to medical marijuana must obtain the required OMMA employee credential and satisfy applicable criminal-history eligibility requirements.
Under OMMA’s rules, disqualifying circumstances include a nonviolent felony conviction within the preceding two years, a violent felony conviction for an offense identified in 57 O.S. § 571(2) within the preceding five years, and incarceration at the time of application for an employee credential. See OAC 442:10-1-4; 63 O.S. § 420A et seq.
OBN imposes separate criminal-history requirements for employees with access to controlled substances. However, OBN's rules provide discretion to evaluate the circumstances of a disqualifying conviction and grant a waiver on a case-by-case basis. See OAC 475:20-1-5(g).
Federal DEA regulations impose additional employee-screening obligations. Under 21 C.F.R. § 1301.90, registrants must exercise appropriate care in screening employees who will have access to controlled substances. A prior felony conviction involving controlled substances may also implicate federal restrictions on employing individuals in positions involving access to controlled substances, potentially requiring a DEA waiver. See 21 U.S.C. § 886a.
Additional Requirements for Growers and Processors
Growers and processors have additional requirements because marijuana may remain in various stages of cultivation or processing.
Under OAC 475:20-1-4(b)(1), in-process marijuana generally must be returned to the storage area when processing ends. If a process legitimately continues beyond the end of the workday, the processing area—or the tanks, vessels, bins, or bulk containers containing marijuana—must be securely locked with adequate security for the area or building.
This makes end-of-day security procedures particularly important for processors. Employees should know what must be secured, where unfinished material is stored, and who is responsible for verifying that the facility has been secured before leaving.
Outdoor Grows and Greenhouses Have Additional Perimeter Requirements
Outdoor and greenhouse cultivation facilities face some of Oklahoma's most specific physical-security requirements.
Under OAC 475:20-1-4(b)(4), an outdoor or greenhouse facility must be completely surrounded by fencing and entry gates. The rule generally requires fencing at least eight feet high, although a six-foot fence may be supplemented with an appropriate top guard to reach the required eight-foot height. Chain-link fencing must generally use wire at least nine gauge, although similarly secure material or wood may also be used. Steel support posts must be securely anchored.
Entry gates are subject to comparable height and construction requirements. Gates must remain closed and securely locked when not in use and must remain under direct observation by a responsible employee or agent while being used. The fencing and gates must also be maintained in good repair and obscure the cultivation facility so that it is not easily visible from outside the perimeter.
OBN's self-inspection form specifically tests these requirements, including fence construction, height, gate security, condition, visibility from outside the perimeter, and limitations on employee access.
Growers and Processors Also Have Signage Requirements
In addition to the general security requirements, growers and processors are subject to signage requirements under both OMMA and OBN regulations.
Under OAC 442:10-6-1(c), a commercial grower must maintain a sign visible from the road at the primary entrance to the licensed premises. The sign must be located at the property perimeter, measure at least 18 inches by 24 inches, use lettering at least two inches in size, and display the business name, physical address, telephone number, and medical marijuana business license number. Failure to erect and maintain the required signage within the period specified by the rule following renewal may result in immediate revocation of the grower license.
OBN imposes a separate signage requirement on medical marijuana manufacturers, which includes both growers and processors. Under OAC 475:10-1-18(b), a medical marijuana manufacturer must post a sign at the entrance of the manufacturing location that includes, at a minimum, the business name, business address, contact phone number, and OBN registration number. The required information may be incorporated into another existing sign of a similar nature if otherwise permitted by law.
Accordingly, growers should ensure their signage satisfies both OMMA and OBN requirements, while processors should ensure compliance with the applicable OBN manufacturer signage requirement.
What About Security Cameras?
This is an area where businesses should be precise about the source of the requirement.
The grower, processor, and dispensary security checklists supplied for this review each identify security cameras as part of facility security. For example, the processor checklist identifies a monitored security panel, security cameras, protected windows, secure doors, restricted access, and secure storage as security measures.
However, in reviewing the current text of OAC 442:10-6-1 and OAC 475:20-1-2 through 475:20-1-4, those provisions do not themselves prescribe detailed camera specifications, such as a required number of cameras, resolution, placement, or video-retention period. OBN's Title 475 rules instead expressly focus on effective anti-diversion controls, monitored alarms, physical barriers, restricted access, locks, and secure storage. The OBN self-inspection form also requires supporting documentation for the facility's security system and proof that it is monitored 24/7/365.
Accordingly, businesses should not assume that installing cameras, by itself, satisfies the regulatory security requirements—or that every camera specification appearing in a third-party checklist is necessarily mandated by a particular Oklahoma rule.
OBN Can Evaluate the Security System as a Whole
OBN's regulations recognize that facilities differ.
OBN may evaluate substantial compliance based upon the registrant's overall security system and may consider the type and quantity of controlled substances, facility location and construction, storage systems, locks, alarms, public access, employee supervision, visitor procedures, law-enforcement availability, and inventory controls. OAC 475:20-1-2(b).
A registrant that wants advance guidance about a proposed security arrangement may also submit plans, blueprints, sketches, or other materials to OBN to determine whether the proposed system substantially complies with—or is structurally equivalent to—the applicable requirements. OAC 475:20-1-2(d).
For certain outdoor or greenhouse requirements, OBN's rules additionally provide a process for requesting approval of an alternative security safeguard.
OBN Registration Makes These Requirements More Than an OMMA Issue
The statutory framework is also important. Oklahoma medical marijuana businesses operate under 63 O.S. §§ 420 et seq. and the Oklahoma Medical Marijuana and Patient Protection Act, 63 O.S. §§ 427.1 et seq. OMMA's own rules expressly identify both statutory schemes as sources of its regulatory authority.
In addition, marijuana remains a controlled dangerous substance under Oklahoma law, and the OBN registration requirement operates alongside OMMA licensure. The Oklahoma Court of Criminal Appeals recently explained that 63 O.S. § 427.14 requires a licensed commercial grower to maintain a current OBN registration, while 63 O.S. § 2-302 provides the underlying OBN registration requirement for persons manufacturing or distributing controlled dangerous substances. See Zou v. State, 2026 OK CR 1, ¶¶ 13–16.
That connection is significant because OBN's security chapter is promulgated under 63 O.S. §§ 2-301, 2-302, and 2-310, and expressly applies its security standards to OBN registrants possessing controlled dangerous substances.
In other words, 63 O.S. §§ 420 et seq. and 427.1 et seq. establish the medical-marijuana licensing framework, but businesses should not stop their compliance review there. OBN's controlled-substance statutes and Title 475 regulations provide a separate layer of physical-security obligations.
Security Compliance Should Be an Ongoing Process
Security compliance is not something that should be addressed only when a business first opens or renews its license.
OBN requires registrants to notify the agency within one business day of changes to registration information, including changes to the registered premises that affect physical-security controls, such as the addition, expansion, or destruction of structures. OAC 475:10-1-21.
The agency's self-inspection form similarly requires a registrant to affirm that its compliance requirements will be maintained throughout the existence of the business.
For Oklahoma growers, processors, and dispensaries, a good security review should therefore address more than whether the front door locks. Businesses should periodically review their alarm monitoring, doors and hinges, employee access permissions, employee disqualifying criminal conviction requirements, keys and access codes, visitor procedures, marijuana storage, outdoor perimeter security where applicable, and any changes to the physical premises.
With OMMA, OBN, and DEA regulating overlapping aspects of medical marijuana operations, security compliance should be treated as an ongoing obligation essential to maintaining OMMA licensure, OBN registration, and compliance with applicable federal DEA requirements.
