N.Y. Comp. Codes R. & Regs. tit. 10, § 1004.13 – Security requirements for manufacturing and dispensing facilities.

(a) All facilities operated by a registered organization, including any manufacturing facility and dispensing facility, shall have a security system to prevent and detect diversion, theft or loss of marihuana and/or medical marihuana products, utilizing commercial grade equipment, which shall, at a minimum, include:
1. (1) a perimeter alarm;
2. (2) motion detectors;
3. (3) video cameras in all areas that may contain marihuana and at all points of entry and exit, which shall be appropriate for the normal lighting conditions of the area under surveillance. The manufacturing facility or dispensing facility shall direct cameras at all approved safes, approved vaults, dispensing areas, marihuana sales areas and any other area where marihuana is being manufactured, stored, handled, dispensed, or disposed of. At entry and exit points, the manufacturing facility or dispensing facility shall angle cameras so as to allow for the capture of clear and certain identification of any person entering or exiting the facility;
4. (4) twenty-four hour recordings from all video cameras, which the manufacturing facility or dispensing facility shall make available for immediate viewing by the department or the department’s authorized representative upon request and shall be retained for at least 90 days. The registered organization shall provide the department with an unaltered copy of such recording upon request. If a registered organization is aware of a pending criminal, civil or administrative investigation or legal proceeding for which a recording may contain relevant information, the registered organization shall retain an unaltered copy of the recording until the investigation or proceeding is closed or the entity conducting the investigation or proceeding notifies the registered organization that it is not necessary to retain the recording;
5. (5) a duress alarm, which for purposes of this section means a silent security alarm system signal generated by the entry of a designated code into an arming station in order to signal that the alarm user is being forced to turn off the system;
6. (6) a panic alarm, which for purposes of this section, means an audible security alarm system signal generated by the manual activation of a device intended to signal a life threatening or emergency situation requiring a law enforcement response;
7. (7) a holdup alarm, which for purposes of this section, means a silent alarm signal generated by the manual activation of a device intended to signal a robbery in progress;
8. (8) an automatic voice dialer or digital dialer, which for purposes of this section, means any electrical, electronic, mechanical, or other device capable of being programmed to send a prerecorded voice message, when activated, over a telephone line, radio or other communication system, to a law enforcement, public safety or emergency services agency requesting dispatch, or other department approved industry standard equivalent;
9. (9) a failure notification system that provides an audible, text or visual notification of any failure in the surveillance system. The failure notification system shall provide an alert to the manufacturing facility or dispensing facility within five minutes of the failure, either by telephone, email, or text message;
10. (10) the ability to immediately produce a clear color still photo that is a minimum of 9600 dpi from any camera image (live or recorded);
11. (11) a date and time stamp embedded on all recordings. The date and time shall be synchronized and set correctly and shall not significantly obscure the picture; and
12. (12) the ability to remain operational during a power outage.
(b) A registered organization shall ensure that any manufacturing facility and dispensing facility maintains all security system equipment and recordings in a secure location so as to prevent theft, loss, destruction or alterations.
(c) In addition to the requirements listed in subdivision (a) of this section, each manufacturing facility and dispensing facility shall have a back-up alarm system approved by the department that shall detect unauthorized entry during times when no employees are present at the facility and that shall be provided by a company supplying commercial grade equipment.
(d) A registered organization shall limit access to any surveillance areas solely to persons that are essential to surveillance operations, law enforcement agencies, security system service employees, the department or the department’s authorized representative, and others when approved by the department. A registered organization shall make available to the department or the department’s authorized representative, upon request, a current list of authorized employees and service employees who have access to any surveillance room. A manufacturing facility and dispensing facility shall keep all on-site surveillance rooms locked and shall not use such rooms for any other function.
(e) A registered organization shall keep illuminated the outside perimeter of any manufacturing facility and dispensing facility that is operated under the registered organization’s license.
(f) All video recordings shall allow for the exporting of still images in an industry standard image format (including .jpeg, .bmp, and .gif). Exported video shall have the ability to be archived in a proprietary format that ensures authentication of the video and guarantees that no alteration of the recorded image has taken place. Exported video shall also have the ability to be saved in an industry standard file format that can be played on a standard computer operating system. A registered organization shall erase all recordings prior to disposal or sale of the facility.
(g) A registered organization shall keep all security equipment in full operating order and shall test such equipment no less than semi-annually at each manufacturing facility and dispensing facility that is operated under the registered organization’s registration. Records of security tests must be maintained for five years and made available to the department upon request.
(h) The manufacturing facility of the registered organization must be securely locked and protected from unauthorized entry at all times.
1. (1) The registered organization shall be responsible for ensuring the integrity of the security of the manufacturing facility and the maintenance of sanitary operations when permitting access to the facility.
2. (2) The manufacturing facility shall maintain a visitor log of all persons other than registered organization employees or emergency personnel responding to an emergency that access any secured areas, which shall include the name of the visitor, date, time and purpose of the visit. The visitor log shall be available to the department at all times during operating hours and upon request.
(i) All marihuana must be stored in a secure area or location within the registered organization accessible to the minimum number of employees essential for efficient operation and in such a manner as approved by the department in advance, to prevent diversion, theft or loss.
1. (1) Registered organizations shall return marihuana to its secure location immediately after completion of manufacture, distribution, transfer or analysis.
(j) All medical marihuana must be stored in such a manner as to protect against physical, chemical and microbial contamination and deterioration of the product.
(k) All approved safes, vaults or any other approved equipment or areas used for the manufacturing or storage of marihuana and approved medical marihuana products must be securely locked or protected from entry, except for the actual time required to remove or replace marihuana or approved medical marihuana products.
(l) Keys shall not be left in the locks or stored or placed in a location accessible to individuals who are not authorized access to marihuana or manufactured medical marihuana products.
(m) Security measures, such as combination numbers, passwords or biometric security systems, shall not be accessible to individuals other than those specifically authorized to access marihuana or manufactured medical marihuana products.
(n) Prior to transporting any medical marihuana, a registered organization shall complete a shipping manifest using a form determined by the department.
1. (1) A copy of the shipping manifest must be transmitted to the destination that will receive the products and to the department at least two business days prior to transport unless otherwise expressly approved by the department.
2. (2) The registered organization shall maintain all shipping manifests and make them available to the department for inspection upon request, for a period of five years.
(o) Approved medical marihuana products must be transported in a locked storage compartment that is part of the vehicle transporting the marihuana and in a storage compartment that is not visible from outside the vehicle.
(p) An employee of a registered organization, when transporting approved medical marihuana products, shall travel directly to his or her destination(s) and shall not make any unnecessary stops in between.
(q) A registered organization shall ensure that all approved medical marihuana product delivery times are randomized.
(r) A registered organization shall staff all transport vehicles with a minimum of two employees. At least one transport team member shall remain with the vehicle at all times that the vehicle contains approved medical marihuana products.
(s) A transport team member shall have access to a secure form of communication with employees at the registered organization’s manufacturing facility at all times that the vehicle contains approved medical marihuana products.
(t) A transport team member shall possess a copy of the shipping manifest at all times when transporting or delivering approved medical marihuana products and shall produce it to the commissioner, the commissioner’s authorized representative or law enforcement official upon request.