ISO/IWA 37-2:2022

This document specifies minimum requirements for the security of sites and facilities that handle cannabis and cannabis products for the purposes of cultivation (indoor and outdoor), processing, storage/distribution, transportation, retail sales, and research and testing, in order to prevent harm and/or unauthorized access to assets including (but not limited to):

—    physical assets;

—    personnel;

—    cannabis and cannabis products;

—    records and information.

NOTE      Premises covered in this document include indoor and outdoor cultivation, processing/production facilities and retail stores.

The overall security programme and individual security measures addressed in this document incorporate three types:

1. a) physical controls;
2. b) technical controls;
3. c) administrative controls.

This document specifies minimum requirements for general security of cannabis and cannabis products, up to and including:

—    physical security design/measures intended to deny, deter, delay, respond to, and recover from unauthorized access;

—    design, installation and maintenance of electronic security systems intended to restrict access, detect intrusion and visually monitor/record activity in security-sensitive areas;

—    procedural security measures intended to instruct day-to-day security activities, both routine and emergency, across an organization;

—    personnel security measures intended to ensure all personnel attending the facility are properly screened, instructed and trained in security awareness;

—    the monitoring of the security status of cannabis and cannabis products throughout the product lifecycle, from cultivation to retail sale, including transportation.

This document provides guidelines for:

—    the installation, maintenance and inspection of physical and electronic premises security and cybersecurity systems;

—    the implementation of information security governance at organizational level to include policies, procedures, and standards to protect the confidentiality, integrity and availability of records and information.

All requirements in this document are generic and intended to be applicable to all organizations in the cannabis supply chain, regardless of size and/or complexity.