Security, Surveillance and Access Control for Oklahoma Cannabis Licensees

OMMA’s entire security requirement for commercial licensees reads: “Commercial licensees shall implement appropriate security measures to deter and prevent the unauthorized entrance into areas containing marijuana and the theft and diversion of medical marijuana and medical marijuana products.”

That is the whole rule. It names no technology, no camera count, no retention period, and no zone list. It is a performance standard: you choose the measures, and you answer for whether they were appropriate if something goes wrong.

This is good news and bad news. The good news is that nobody can fail you for lacking a camera the rule never asked for. The bad news is that “appropriate” gets judged after an incident, with hindsight, by someone who is not you. That ambiguity is exactly what a competent integrator is for: we document the reasoning behind every decision, so “appropriate” is a record you produce rather than an argument you have to win.

Every Oklahoma cannabis business must hold an active OBNDD registration alongside its OMMA license (OAC 442:10-1-5(c)), and that registration pulls growers, processors, packagers and manufacturers under OBNDD’s physical security rules at OAC 475:20-1-4.

Those rules require an alarm system that, on unauthorized entry, transmits a signal to a central station protection company, a local or state police agency with a duty to respond, or a 24-hour control station. This is a genuine, technical, enforceable requirement, and it is the one most often skipped by vendors busy selling cameras nobody asked for.

Alarm work is licensed work, and we are not an alarm company. Installing and monitoring alarm systems requires a license from the Oklahoma Department of Labor, and we will refer you to a licensed contractor rather than pretend otherwise. What we do is the layer underneath: the network and the connectivity that alarm path depends on, engineered so the signal actually leaves the building.

Two things the bids never mention: these OBNDD rules do not reach dispensaries, transporters, or testing laboratories, and subsection (6) allows a written security waiver from OBN. If you are a dispensary being sold an OBNDD-mandated alarm, ask which subsection.

OBNDD requires that doors to areas holding regulated product be self-closing and self-locking. That is door hardware before it is electronics, and it is one of the few places these rules get genuinely prescriptive. We specify hardware that satisfies it, then add credentialed access on top, so every entry to a restricted area carries a timestamp, a credential, and a camera-linked record. The rule asks for the lock. The record is what saves you when someone asks who was in the vault on the 14th.

You will see perimeter camera packages sold as an OBNDD outdoor requirement. Read the rule. For outdoor and greenhouse growing areas it requires an 8-foot chain link fence of 9-gauge wire, locked gates, and the growing area obscured from view. Fence, gates, sight-blocking. Not cameras.

Fencing is a separate trade and we do not quote it as security electronics. What we will tell you honestly: a fence satisfies the rule and stops very little you would want stopped. If you want to know who cut it and when, that is a camera decision, made on the merits, priced as what it is.

OBNDD requires that restricted areas be accessible to the minimum number of authorized employees, and that the area receive “adequate observation … by an employee specifically authorized in writing.” Note what that says: observation by a person, with written authorization. It is not satisfied by a recording, and no access control system discharges it for you.

What UniFi Access does is make the “minimum number” provable and enforceable: role-based permissions per zone, time-based windows, instant credential revocation with no re-keying, and an authorization roster that matches the credential list because it generates it. The rule wants a short list of authorized people and eyes on the area. We make the list auditable. You still staff the eyes.

Discover a theft, loss, or diversion and you have 24 hours from discovery to notify OMMA and law enforcement, by signed statement, with an inventory of what is gone. OBNDD carries its own immediate-notification duty at OAC 475:20-1-8.

Twenty-four hours is not much time to reconstruct what happened from an unindexed pile of footage, and the clock starts at discovery, not at the incident. Systems we build are searchable by date, time, camera, door and event, so the reconstruction takes an afternoon instead of a week. This deadline, not a fictional retention rule, is the strongest operational argument for video in an Oklahoma cannabis facility.

Here is the requirement the 90-day myth crowds out. OMMA requires business records to be kept on-site, readily accessible, and retained at least seven years from the date of creation. Monthly reports are due by the 15th (OAC 442:10-5-6(a)), inventory runs through the state’s Metrc seed-to-sale system (63 O.S. § 427.13(B), OAC 442:10-5-6(d)), and OMMA may inspect twice per calendar year (OAC 442:10-5-4).

Seven years is longer than any video retention rule any state has ever written, and it is the number that actually applies to you. It is a records and network problem rather than a camera problem: the systems holding those records need to be backed up, segmented, and still readable in 2033.

We will not tell you a regulation demands cameras, because none does. We will tell you what video is actually for in a licensed facility, and let you price it honestly:

• The 24-hour clock. You cannot report what you cannot reconstruct, and you have one day.
• “Appropriate security measures.” OAC 442:10-6-1 is judged after an incident. Video is how you show the measures were appropriate.
• Diversion is an inside problem. Product does not usually leave through a broken window. It leaves with someone authorized to be there.
• Your insurance carrier and your investors frequently do impose retention terms in writing. Those obligations are real. They are contractual rather than regulatory, and we will read the actual policy language with you instead of guessing.

On retention: since no rule sets a period, the question becomes what a serious operator should choose. We generally size for 90 days with headroom, because that covers the lag between an incident and the complaint that references it. That is an engineering judgment we will defend on the merits, and it is priced as a choice you are making, not a fine you are avoiding.

Footage records to UniFi Protect hardware you own, inside your facility, continuously, whether or not the internet is up. No third-party cloud, no subscription standing between you and your own recordings.

Surveillance, access control, point-of-sale, and Metrc submissions do not belong on the same flat network. Ubiquiti UniFi enterprise networking gives us managed switches, enterprise routing, and professionally deployed wireless with segmentation that isolates cameras and door controllers from business traffic and from your seed-to-sale platform.

No rule names segmentation. The seven-year records rule and Metrc’s role as the state’s system of record are what make it matter: a compromised laptop on the office network has no business reaching the systems holding your compliance history.

Video keeps recording to local hardware during an outage. What an outage does break is everything needing a live connection: Metrc submissions, alarm signal transmission to the central station (an actual OBNDD requirement, per above), card payment authorization, and real-time alerting to ownership. UniFi 5G Max provides automatic dual-SIM failover, so the alarm path and the state reporting path stay up. For remote cultivation sites where wired service is unreliable, it can serve as the primary connection.

Cultivation operations sprawl: grow buildings, processing, drying and curing, storage, transport staging. Ubiquiti airMAX point-to-point bridges tie every structure into one network, one camera platform, one access control system, one audit log, without trenching conduit across the property. One dashboard. Every building. Every door.