Guideline: Security of medicinal cannabis
Guideline to assist licence applicants and holders in designing and meeting security standards that are required for the cultivation, production and manufacture of medicinal cannabis.
Introduction
The Guideline: Security of Medicinal Cannabis (the Guideline) is intended to assist licence applicants and holders in designing and meeting security standards that are required for the cultivation, production and manufacture of medicinal cannabis.
Cannabis, with greater than 1% tetrahydrocannabinol (THC), is a narcotic drug with a high illicit value. Amendments to the Narcotic Drugs Act 1967 (Cth) (the Act) in 2016 provide a legal basis for cultivation of cannabis plants and production of cannabis and cannabis resins for medical and scientific purposes, through the introduction of medicinal cannabis licences, cannabis research licences and manufacture licences (cannabis licences).
Hemp (cannabis with less than or equal to 1% THC) may also be cultivated for medical and scientific purposes with the appropriate licence and permit under the Act. References to cannabis in this document include hemp unless otherwise described.
The illicit value of cannabis makes the risk of diversion a significant one requiring sound and holistic security arrangements. The Security Risk Management Handbook[1] (2006, p.11) defines security as 'the preparedness, protection and preservation of people, [and] property both tangible and intangible'. The security arrangements necessary for a cannabis licence will therefore involve a range of considerations, including, but not limited to, the people involved, the physical site and infrastructure where the cannabis is contained, operational procedures and information related to operations.
While physical security systems and procedures play a critical role in preventing diversion of cannabis, a rigorous personnel security model is also necessary. Please refer to the Guideline: Fit and Proper Persons and Suitable Staff for information related to personnel security.
The Office of Drug Control (ODC) is part of the Commonwealth Department of Health and is designated with the responsible for regulating the cultivation and production of cannabis for medicinal purposes and the manufacture of medicinal cannabis products under the Act. The ODC assesses all applications for cannabis licences and applications for relevant permits deciding whether to grant a licence or a permit. The ODC also performs inspections of cannabis cultivation, production and manufacturing sites to monitor compliance with the Act, the Narcotic Drugs Regulation 2016 (the Regulation) and with the specific conditions of each licence.
Footnote
- Australian/New Zealand Standard: Security Risk Management Handbook HB 167:2006
Scope of this Guideline
This Guideline organises the information set out in the Act, the Regulation and licence conditions to assist a licence applicant or holder in understanding, developing and maintaining arrangements to secure cannabis and prevent theft or loss of cannabis.
The document describes mandatory requirements that the licence holder must comply with and, separately particularly in Annex A for crops with >1% THC, provides suggestions and examples of how this can be achieved. The ODC will assess all security arrangements as part of the assessment of your licence application.
The Commonwealth Government has sole responsibility for regulating the cultivation and production of cannabis for medicinal and related scientific purposes. States and territories are responsible for regulating the cultivation and production of cannabis for industrial purposes. This Guideline is for the cultivation, production and manufacture of cannabis for medicinal and related scientific purposes. Manufacture of, and patient access to, medicinal cannabis products is a joint responsibility of the Commonwealth and the state and territories. As such, as described below, our approach to assessing security arrangements will differ for the different licence types under the ND Act and THC content present in cannabis.
For cultivation/production licences, assessment of your security arrangements will involve a desktop assessment and an inspection of your facility to verify that the security arrangements are in place and operational.
If, at the time of your application, you have completed construction of the facility and installation of the security features, the ODC will undertake the inspection before granting the licence.
Otherwise, we may grant your licence based on the desktop assessment, but will conduct the inspection prior to granting a permit to cultivate.
For manufacture licences, the ODC may undertake a desktop assessment only, provided the physical security has been subject to satisfactory inspection by a state or territory authority.
The ODC will review your security arrangements through the ongoing inspection and compliance framework.
This Guideline is designed, where practicable, to allow a licence applicant/holder to demonstrate compliance with the security requirements in a manner which is fit for purpose for that applicant's operations. Provided that the applicant is able to demonstrate the proposed security measures will deliver the security outcome required by the circumstances of the proposed activities those arrangements are likely to be consistent with the Act requirements. The Guideline does not specify the precise security measures that need to be implemented.
Compliance with this Guideline
The Guideline uses the word 'must' to indicate a mandatory requirement and the word 'should' to indicate a suggested method for achieving that expectation.
This Guideline, specifically Annex A which sets out examples of compliance with the required security measures, uses the word 'must' to indicate a mandatory requirement and the word 'should' to indicate a suggested method for achieving that expectation.
Where the word 'must' is used, you will be required to demonstrate how your security arrangements meet the specified expectation. Where the word 'should' is used, you will be required to demonstrate how your security arrangements meet that expectation but there is some flexibility for you to show that your arrangements equate to, or are better than, those outlined in the Guideline.
Once accepted, your security arrangements will become part of your licence conditions and the Department of Health will expect that you can demonstrate these arrangements are operational when facilities are inspected.
Truthfulness
The security requirements are extensive and require the disclosure of a significant depth of information. It is important to undertake your best endeavours to be comprehensive in responding to the information requests.
Matters which affect your ability to meet the security expectations may be grounds for revocation of the licence at any time.
Applicants, and licensees, are also advised that in applying for a cannabis licence, or conducting activities under that licence, a person may commit an offence if the person provides false or misleading information in relation to that application or in the provision of information when requested to provide information by the ODC on behalf of the Commonwealth (see section 137.1 of the Criminal Code).
Hemp
Cannabis containing less than 1% THC (note that some jurisdictions may regulate hemp containing a lower threshold of THC) is usually referred to as hemp when cultivated for fibre and seed.
The Act allows an entity licensed for cultivating hemp under state/territory law, to utilise the same crop for medicinal cannabis purposes provided the hemp licensee also holds a licence and permit under the Act.
The security arrangements required by an applicant/licence holder under the Act for the activities of cultivation, production or manufacturing of cannabis with a low THC content but relatively higher cannabidiol (CBD) content are informed by the low risk of crop interference. That risk is likely to be more opportunistic; the low THC content means that it is not attractive for ‘recreational’ use and it would therefore be far less attractive to black market diversion. Essentially, low THC medicinal cannabis is no more attractive to criminal diversion than is industrial hemp.
Taking this qualitative risk assessment into account, this Guideline explains in the table on the next page that security requirements vary in accordance with should be the type of medicinal cannabis crop a licence holder may wish to cultivate. If, for example, a licence holder has agreed, as a condition of its licence, that it will only cultivate low THC and high CBD crops, then the expectations of measures necessary to manage intruder resistance and access controls, generally, are substantially reduced.
Should a 'low THC crop' licence holder subsequently apply to vary its licence to include cultivation of a high THC crop the ODC will treat the application as a licence variation application requiring, among other things, an assessment of the appropriateness of the security arrangements. An application for a new permit will also be required.
Without limiting the way in which an applicant or licence holder may wish to provide security measures appropriate to the risk of the THC content of the proposed crop, the following table sets out some examples of the kinds of security required for a 'high THC site' and that required for a 'low THC site's:
| Requirements | High THC (>1%) | Low THC (<=1% THC) |
|---|---|---|
| Intruder resistant cannabis site | Two layer perimeters such as building walls or climb-proof fencing | Description of mitigation measures |
| Physical security systems | Alarms, monitoring and CCTV | Description of measures to protect crop security |
| Destruction and disposal processes | Monitored incineration or other tracked destruction | Local incineration or mulching. Plant may be used for fibre if licensee holds a State/Territory Hemp licence |
Applicants who intend to grow low THC cannabis for hemp and medicinal purposes should ensure that they meet the requirements in their relevant jurisdictions. Refer to Annex B for more information.
Persons holding a state or territory hemp licence may supply a copy of their licence and compliance history in support of their application.
Security of Medicinal Cannabis
Security Principles
There are a number of underpinning security principles that should be reflected in your security arrangements:
- Deter: to discourage a person or people from attempting to breach the security measures.
- Delay: the act of making a breach of security measures more difficult or slower, which provides time for defence or leading to the intrusion to be abandoned.
- Deny: measures taken that allow some people access while decline access to others.
- Detect: to discover or notice any security breaches.
- Defend: actions taken to respond to a security breach.
These principles should be supported by effective record keeping and information management mechanisms to allow the licence holder to both demonstrate how security arrangements meet the principles, and provide tools to secure evidence where there are attempts to overcome or breach the security arrangements.
Risk of Diversion
Diversion of cannabis to illicit use is the most significant risk facing the medicinal cannabis scheme. Theft and loss are the two most likely ways in which diversion can occur and may be the result of deliberate acts or simply occur through negligence.
The following scenarios outline possible mechanisms resulting in theft, loss or substitution of cannabis.
- Unauthorised access by an external person
This is likely to be intrusion by a person or people with no legitimate reason for accessing the site or the cannabis. It is likely to be a deliberate act, but may be assisted through negligence.
Such scenarios might include covert attack (break-ins) and overt attack (armed hold-ups), and are most closely controlled through intruder resistance mechanisms.
Transport is another point of potential deliberate attack and careful consideration needs to be given to the security of cannabis whilst being transported.
- Unauthorised access by an employee or visitor
This scenario could be the result of an employee or visitor obtaining access to an area of the cannabis site that they have no authorised reason to access. This could occur through deliberate deception, physical damage or negligence.
This is why we expect that there will be internal access controls within cannabis sites, preventing unauthorised access by employees or visitors.
- Authorised access by an employee or visitor
This scenario accounts for the employee or visitor who uses their authorised access for theft or substitution of cannabis, or sabotages security arrangements to enable later unauthorised access.
This is the most difficult scenario to defend against as it requires the imposition of controls over persons in positions of trust. Personnel security, restrictions on clothing or bags, provisions around employee searching might be the types of mechanisms used to avoid this scenario.
The likelihood and risk of the occurrence of these scenarios should be thoroughly considered in a security risk management plan.
Note that in the event of an intrusion, theft or loss of cannabis, a licence holder is required to notify both the law enforcement agency in the state or territory and ODC of the event as soon as possible.
Mandatory requirements
There are a number of requirements prescribed in the Act and Regulations that direct a licence holder to design, implement and maintain a business operation that ensures the security of medicinal cannabis.
Regardless of the type of licence, under the Act, The ODC must refuse to grant a licence if not satisfied that the applicant will:
- take all reasonable measures to ensure the physical security of cannabis
- ensure that there are suitable security arrangements at all locations where activity related to the licence will occur.
Further, the Act foresees the prescription of conditions on all licences such that security, transport, destruction, reporting and employment of suitable persons are all included as enforceable requirements. The Act also requires conditions around inspection, compliance and monitoring.
The Regulation specifically requires that an application must contain a range of information, including on the measures the applicant will take to ensure the physical security of cannabis plants, cannabis or cannabis resin in their possession or control, or obtained, cultivated or produced under the licence. Details of these measures may include, but are not limited to, security arrangements the licence holder will have in place to:
- ensure that loss or theft of cannabis is immediately reported
- ensure the safe and secure disposal or destruction of cannabis
- ensure safety and security of the supply, delivery and transportation (including storage during transportation) of cannabis
- ensure communication with emergency services, police and local government authorities to deal with the loss, theft, spoilage or disposal or destruction of cannabis
- prevent unauthorised access to the location, premises or facilities, or any areas where cannabis plants, cannabis or cannabis resin are stored
- control of all persons (including staff and contractors) entering the location, premises or facilities where the activities will be undertaken; where cannabis plants, cannabis or cannabis resin will be stored; or having access to cannabis plants, cannabis or cannabis resin
- detail equipment (such as visual monitoring equipment, visual recording devices and intrusion detection systems) and any other arrangements that will be used to prevent, monitor, detect and record unauthorised access to the location, premises or facilities; and the cannabis plants, cannabis or cannabis resin at the location, premises or facilities.
It is important to remember that the design of any cannabis site should consider security as an end to end process.
Key concepts for security arrangements
In addition to the principles discussed earlier, there are a number of key concepts that should inform the design of security arrangements. These key concepts are discussed below with more explicit examples outlined further under Annex A - Requirements and Examples.
Access Controls
Any security arrangements need to take into account the actions of employees, contractors, visitors and other people who may have access or knowledge of the cannabis site. Access controls are the first step in denying people access to the cannabis and assist in the detection of, and response to, unauthorised activity.
Access controls should be in place to both control ingress and egress to the perimeter of the facility, but equally importantly, within the facility itself. This might include locks or pass access between different sections of the facility and would need to consider the relevant level of risk of any given location. For example, a storage area for finished product may require more stringent access controls than an office area.
Intruder resistance
Intruder resistance can be achieved through a number of physical and technological measures. Careful design, construction and ongoing maintenance are important considerations for intruder resistance. The objective is to deny, deter and delay any person or people who may attempt to access the cannabis.
Intruder resistance refers to the concept of preventing or delaying unauthorised access or forcible attack. Intruder resistance may also include the ability to detect attempts to tamper with the barriers.
Crop integrity
Crop integrity means ensuring that you are growing the right number and types of plants. Particularly where growing on an outdoor site, or where there is not an enclosed air filtration system, the risk of cross-pollination is one the licence holder should manage appropriately. Further for outdoor sites, volunteer plants or rogue plants should be carefully controlled to make sure you do not exceed your permitted crop size.
Detection and response
While the access controls and intruder resistance measures should prevent unauthorised access to cannabis, the licence holder should have measures in place to detect and then respond appropriately to unauthorised access to, theft or loss of, cannabis. The objective of these measures is to minimise the effect of a serious incident and, where possible, intervene to thwart any attempts.
Examples of detection capability include monitored alarms and visitor escorting practices. Note that video recording of premises can only be considered a detection control when it is actively monitored.
Procedural security measures
Effective security arrangements require integration between physical infrastructure and procedural measures. The objective of procedural security measures is to ensure that the licence holder has procedures in place that support and complement intruder resistance and detection measures, while also managing security during the handling of cannabis in business operations.
Procedural security should be reflected in operational practice and tested to ensure this is the case.
Disposal and destruction of cannabis
Any cannabis that is disposed of can still hold value on the illicit market, so the security around disposal and eventual destruction of cannabis cultivated and produced remains critical to prevent diversion. In some respects, diversion risk during the destruction process is in fact higher than other processes. It is possible that licence holders will seek external assistance in disposal and destruction and any business arrangements should be carefully considered to ensure that risk is controlled.
It is important to note that the licence holder is responsible for preventing loss or theft during the destruction process, even where separate contractual arrangements are in place.
Transportation of Cannabis
The key principle of transport security is to develop arrangements that adapt according to the risk associated with the movement. This means that large scale transport activities will require a substantially more vigorous application of the principles, where smaller scale transport may be satisfied with fewer controls. Note that, in some cases, transport of cannabis may be outsourced to appropriate secure transport service providers. As above for disposal and destruction, the licence holder remains responsible for the cannabis under such arrangements.
Factors to be considered when preparing transport security arrangements include (but are not limited to):
- security requirements at the point of origin
- security requirements at the destination point (including handover)
- the duration of travel
- security considerations specific to any areas traversed
- size of consignment
- means of transport
- areas where consignments may be travelling outside of the licensee's control.
The licence holder needs to be able to demonstrate effective controls around these issues before any activities can commence. Ongoing compliance with security arrangements is required to be maintained for the duration of any licence and failure to comply could result in revocation of the licence or referral of the matter to the relevant law enforcement agency.
Note also that any changes to the arrangements must be reported to ODC for assessment of the effect the changes have on the security of the cannabis. These changes may require a variation to your licence.
Where a licence holder manages multiple sites where cannabis is located, the security arrangements and measures must be adapted to the specific infrastructure and operations of each site. In the situation where two entities operate on a single site under separate licences (one for cultivation and one for production for example), the cultivation licence holder holds overall responsibility for physical site security, but the production licence holder will have additional responsibilities around handling, transport and storage.
Annex A - Requirements and Examples
The following examples apply to the cultivation of cannabis with >1% THC.
Crops with less than 1% THC should have security equal the state/territory Hemp requirements. Requirements the storage of harvested cannabis will considered based on THC content and size of crops or storage requirements. The ODC reserves the right to impose requirements greater than that required by the states and territories.
1. Access Controls
Mandatory requirement: The licence holder must maintain a set of access controls preventing unauthorised access to cannabis, including the site as a whole and during transportation. This must include recording of movements at both internal and external perimeters.
| Expectations | Rationale | Example |
|---|---|---|
| Access to the cannabis site should be limited to people with a need to be there. | This is to minimise the number of people that are allowed onto the cannabis site. The nature of the business should also be kept discreet. |
No access to the general public - gates to block access. Visitor policy that documents classes of people allowed on site (and circumstances). Sign in/out registers. No external advertising of the business / cannabis not visible to the public. |
| Access to cannabis should be limited to people who have a direct role in cultivating and producing the cannabis. | To minimise the number of people that have direct access and contact with the cannabis, to reduce the opportunity for theft. |
Physical access controls so that only staff who need to access cannabis can do so. Physical controls that are limited to hours/days of required access. |
| The licence holder should have controls on people who can access and operate security and surveillance equipment/facilities. | Where security of a cannabis site requires oversight by an administrator/security officer, there should be additional measures in place to monitor the actions of this person. | Monitoring of security officers/ IT administrators, including audits of access. |
2. Intruder resistance
Mandatory requirement: The licence holder must maintain an intruder resistant cannabis site, designed to prevent intrusion by external parties and to prevent removal of cannabis from within the cannabis site.
| Expectations | Rationale | Example |
|---|---|---|
| The cannabis site should be designed and maintained to deter intruders | Through its physical design, the ability to covertly access the cannabis site is reduced and therefore intruders may be deterred from breaking in |
There should not be shrubbery immediately against fences Sites should be well lit and no large objects stored near access points |
| The outer perimeter of the cannabis site should have an intruder resistant physical barrier | To ensure that an intruder is denied, delayed or deterred from entering the cannabis site. |
Climb proof perimeter fencing that complies with Australian standards. Mechanisms to prevent entry from above or below the cannabis site. |
| Cannabis should be protected by two or more layers of intruder resistant physical barriers |
The illicit value of cannabis requires that it has an added layer of security to deny, deter and delay an intruder. Two layers of resistance seeks to control the risk of forcible attack. |
For an outdoor operation, the second layer could take the form of another layer of fencing that complies with Australian standards. For an indoor operation, the cannabis could be contained in a separate room that is securely locked. |
| For outdoor sites, there should be measures in place to prevent cross-pollination. | Cross-pollination may result in different strains and cannabinoid concentrations leading to breaches of permit conditions. | Mechanisms to prevent cross-pollination such as the utilisation of distance, crop time separation, natural barriers, pollen traps or exclusions zones. |
| The layers of intruder resistant physical barriers should be constructed so that they cannot be breached by a single movement or act | This is to ensure that the two layers of security provide two points of defence for any intrusion |
Where two layers of barrier are used, the fences should be at a distance that ensures both fences are effective in their own right. A room containing cannabis should not share a wall with the exterior of the building unless that exterior wall has additional controls. |
| Any receptacle that contains cannabis, including waste disposal units, should be contained within two layers of intruder resistant physical barriers. | This is to ensure the physical security of bins where cannabis may be placed or storage containers of cannabis |
Bins are kept in a locked room or within two layers of fencing. Given that waste disposal might be only an occasional activity, additional controls are required to store material over a longer period. |
| Refined cannabis (such an extracted flower product) should be protected by two layers of intruder resistant physical barriers, one of which should be a secure storage unit. | The term 'secure storage unit' allows for the licence holder to provide security that is appropriate to the volume of cannabis to be stored. The additional security requirement reflects the risk of diversion of the cannabis in this state. |
A safe, vault or strong room depending on the volume of cannabis to be stored. Additional access controls into such spaces should also be considered. |
| The cannabis site should not identify the nature of activities conducted at the cannabis site. | It is important to not identify the existence of the cannabis site to prevent targeting by criminals. |
The site should be void of signs that identify the company or business. Vehicles that identify the company should not be visible to the public. Cannabis should not be visible from the perimeter of the site. |
| The cannabis site should be designed and maintained to prevent the theft or loss of cannabis during daily operations. |
Thorough careful physical design, the ability for an employee to access and remove cannabis without authorisation is minimised. Employees and visitors should not be presented the opportunity to remove cannabis product. This may require the use of clothing inspections or pocket-less clothing, and/or restrictions around bags and other containers. |
Work areas should be separate from break areas. Physical separation of office space from cannabis cultivation and productions sites. |
3. Detection and response
The licence holder must have physical security systems and documented procedures in place to detect and respond to intrusion or unauthorised access, theft or loss of cannabis.
The licence holder must have arrangements in place with emergency services, police and local government authorities to deal with loss or theft of cannabis.
| Expectations | Rationale | Example |
|---|---|---|
| The cannabis site should have a physical intruder detection system that monitors and records activity. | This is to detect if intrusion or unauthorised access occurs and provide the evidence for any possible investigation. |
CCTV. Alarm system. Motion sensors. |
| The licence holder should have procedures in place to maintain and test the efficacy of the security equipment and procedures. | This is to ensure that the system is working as expected. |
Regular testing of security systems and drills for procedures. Regular inspections of equipment and infrastructure. |
| The cannabis site should be physically attended on a daily basis. | This is to verify that a breach of security has not occurred. |
Staff making daily perimeter inspections. Outsourced security services. |
| The licence holder should have procedures in place to rapidly respond to unauthorised access | The procedures should outline how the licence holder uses the physical detection system with operational procedures to detect intrusion or unauthorised access. |
Procedures to respond to alarms, regular and random checks of access logs, and review of CCTV footage. Training and regular drills for staff in preparation for intrusion. |
| The licence holder should have procedures and clear lines of responsibility to ensure local services, police and ODC are contacted in the event of a serious incident. |
This is to ensure that the licence holder and employees are prepared and take the necessary steps to involve the relevant services. It is also important that local services are aware of the potential risks around criminal activity (for police) or fire or injury (emergency services). |
Policies that document the events that require police intervention and procedures to follow in this event. Procedures to handle immediate threats. Procedures for contacting ODC. |
|
The licence holder should retain all video recordings for a minimum of 30 days. The licence holder should retain all access records (for electronic passes) for the period of the licence. |
This is to ensure that recordings can be reviewed to identify the source of theft or loss and for assistance of law enforcement during any potential investigation. |
IT systems to back up CCTV recordings. Access logs on pass access (where available) are much smaller in size and might be useful in security auditing. |
4. Procedural security measures
Mandatory requirement: The licence holder must design and maintain operational policies and procedures to support physical security measures and prevent the theft or loss of cannabis.
| Expectations | Rationale | Example |
|---|---|---|
| The licence holder should have policies and procedures in place to minimise the opportunity of theft or loss of cannabis. |
Ensuring staff and visitors are aware of procedures around activity on a cannabis site reduces the risk of diversion. Divergence from standard operating procedures should be seen as a potential concern and reviewed. |
Staff rotation or scheduling policy. Daily procedures for checking inventory and cross checking by a second person. |
| The licence holder should have policies and procedures in place for responding to unauthorised access or theft of cannabis by an internal source. | This is so the licence holder is prepared to respond to a situation appropriately. The existence of such policies may also act as a deterrent. |
Policies and procedures for staff management and referral to ODC and law enforcement. Contingency plans in the event of staff suspension or termination. |
| Cannabis should be reconciled against records once custody of the cannabis is formally transferred, including receipt. | This is to make a clear point where responsibility is transferred and to identify any loss or theft at different stages. |
Procedures for transfer and receipt of the cannabis. Procedures to validate tamper evident packaging along chain of custody. |
| The licence holder should have procedures to track the movement of cannabis through the cannabis site and during operational activities. | This is to ensure that theft or loss of cannabis can be identified. |
Plant stocktakes and mortality registers. Procedures that control and document the transfer, testing, or cloning of plants. |
5. Disposal and destruction of cannabis
Mandatory requirements
The licence holder must have procedures in place to ensure that all cannabis that is not to be manufactured into a medicinal product is disposed of or destroyed in a safe and secure manner.
The licence holder must provide details of the method of destruction of cannabis and any arrangements with third parties to dispose of or destroy cannabis.
The licence holder must have arrangements in place with emergency services, police and local government authorities to deal with disposal or destruction of cannabis.
| Expectations | Rationale | Example |
|---|---|---|
| The licence holder should have procedures that identify activities that generate cannabis that requires disposal or destruction. | To ensure that all cannabis is accounted for, and appropriately disposed of, or destroyed. | Standard operation procedures around destruction, including storage and transport of material to destruction. |
| Any equipment used for cultivation or production of cannabis should be regularly cleaned and any cannabis that is attached to the equipment disposed of or destroyed. | During the production process, resin may become attached to the equipment. Cleaning ensures that any cannabis is removed from the equipment and prevents the risk of diversion. |
Procedures for cleaning equipment between tasks or moving to another site. Designated waste bins for cannabis with procedures for emptying. |
| Contracts with third parties should outline security requirements to ensure that cannabis is not diverted before or during disposal or destruction | This is to address the risk that any third party presents where cannabis is outside of the licence holder's control. |
Contract with a location that has a secure site or approval from a law enforcement agency. Record keeping from the third party to demonstrate the completion of the task. |
6. Transportation of cannabis
Mandatory requirements: The licence holder must have procedures and contingency measures in place to ensure the transportation of cannabis is discreet, and that security of cannabis is maintained during transportation and at receipt at the final destination.
| Expectations | Rationale | Example |
|---|---|---|
| During the transportation cannabis should be contained within two intruder resistant physical barriers. | This expectation should be covered regardless of mode of transportation, air, road, rail of shipping. |
Cannabis stowed in a secure locked receptacle in a secure vehicle. In transit, cannabis is stowed in a secure locked receptacle within a secure locked room. |
| Cannabis should be transported in tamper-evident containers or packaging. | This is to ensure integrity of the consignment along the end to end transport route. |
Tamper evident tapes or seals. Security bags or pouches. Time delay access to containers. |
| During transportation, the cannabis should have a physical intruder detection system that monitors and records activity. | This is to alert the person in control of the cannabis to a possible intrusion or unauthorised access to the cannabis. |
Time delay safes/locking systems. CCTV recordings. Alarms /Motion detection systems. Physical guarding. |
| A consignment of cannabis should not be marked in such a way that identifies its contents. | This is to keep the contents of the container as discreet as possible. | No external signage or symbols on vehicles or containers that would indicate that cannabis is being transported. |
| The licence holder should be able to identify who has custody of the cannabis at any point in time during transportation. |
An expectation from law enforcement agencies that the consignment be tracked. Custody control is important to prevent substitution of product. |
GPS tracking chips to accompany the consignment. Barcode tracking and log in systems. Procedures for reporting when cannabis is exchanged and responsibility is securely transferred. |
| The chain of custody of cannabis during transportation should be clearly documented. | This enables any potential investigation to determine the point of weakness in the chain of security and makes people in the process accountable. This is to prevent the loss of product through negligence. |
Registers with signatures and names to record people who handle cannabis Procures that outline the point in time where someone accepts responsibility for the cannabis. Training for staff involved in the process. Contractual obligations documented for third parties with responsibility for the cannabis. |
| The licence holder should have procedures in place to detect the theft, substitution or loss of cannabis during transportation. | This requirement is to address the situation where it may not be obvious that cannabis has been removed, particularly when an employee has authorised access to the cannabis. |
Procedures to reconcile inventory when cannabis is handed from one person to another. Procedures to verify tamper proof packaging/seals on containers. |
| Details of delivery schedules and routes should be only disclosed to people that have a need to know | To prevent stealing or diversion of a consignment through leaked information. |
Internal office security to conceal plans. Minimal time notification of routes or schedules to people involved. |
| Delivery schedules and routes should be regularly varied | To prevent the observation of the transportation practises for the cannabis, which could lead to a hold up |
Internal office security to conceal routes and schedules. Policy for regular alteration of routes and schedules and staffing. |
| Delivery routes should be planned to ensure the minimum number of stops along the route | For long distance trips some stops, for example for refuelling, may be essential. This requirement is to ensure any stops are planned and cannabis is secure during the stops. |
Routes should be the most direct possible. Vehicles should be filled with fuel before travel to avoid the need to stop for refuelling. |
| The vehicle should be appropriately secured during any planned stops during road transport of cannabis. | The vehicle should be appropriately secured during any planned stops during road transport of cannabis. | When refuelling is required, two people are present. |
| The licence holder should be aware when any deviation or delay occurs to a planned delivery route. | So the licence holder can respond to any possible issues and organise additional security if required. | Reporting procedures for incidents. |
| The licence holder should ensure that the person receiving the cannabis is aware of the delivery and available to receive it. | To ensure that once in transit cannabis can be securely received and stored | Procedures for updating the recipient of any changes to the delivery�s arrival. |
| The licence holder should have a contingency plan in the event that the cannabis cannot be received at any destination. | To ensure cannabis will be controlled and secured in the event of any failures in the planned transport route. |
A back up location for storage of cannabis that complies with site security expectations. Where possible, return of the consignment to the cannabis site. Different routes for the return journey. |
| The licence holder should have contingency plans in place in the event of vehicle breakdown, incapacitation of a driver, accidents or road closures. | This is to ensure drivers or third parties are prepared for any possible issues that may arise. |
Regular training for staff in contingency plans. Clear reporting mechanisms. |
Annex B – Security Requirements for Growing Low THC Crops under State and Territory Legislation
| State or Territory | Name of Legislation | Summary of security requirements for licence holders | Additional Resources |
|---|---|---|---|
| ACT | Hemp Fibre Industry Facilitation Act 2004 |
|
|
| NSW | Hemp Industry Act 2008 and the Hemp Industry Regulation 2016 |
|
|
| NT | Hemp Industry Act 2019 and the Hemp Industry Regulations 2020 |
|
|
| Qld | Drugs Misuse Act 1986 and the Drugs Misuse Regulation 1987 |
|
|
| SA | Industrial Hemp Act 2017 and the Industrial Hemp Regulations 2017 |
|
Guidelines for industrial hemp licence applicants |
| Tas | Industrial Hemp Act 2015 and the Industrial Hemp Regulations 2016 |
|
|
| Vic | Part IVA of the Drugs, Poisons and Controlled Substances Act 1981 and fees prescribed by the Drugs, Poisons and Controlled Substances (Industrial Hemp) Regulations 2018 |
|
|
| WA | Industrial Hemp Act 2004 and Industrial Hemp Regulations 2004 |
|
'Notes to assist in applying for an industrial hemp licence' |
Definitions
The following words are defined specifically for use within this document. Where a word is not defined below, the definition should be taken to be the same as the Act or Regulations and where not defined in legislation, as defined in the Macquarie Dictionary.
| Word | Definition |
|---|---|
| Cannabis | For ease of interpretation, where the term cannabis is used in this document it is taken to mean cannabis plant (including seeds), cannabis, or cannabis resin as defined in the Act. |
| Cannabis site | Means the physical location including the buildings, rooms and designated areas where activities authorised under a cannabis licence occur. |
| Employee | Permanent employee or person contracted to work on behalf of the licence holder. |
| Hemp | Cannabis which contains <=1% Tetrahydrocannabinol* in the flowers and leaves. |
| Employee | Permanent employee or person contracted to work on behalf of the licence holder. |
| Licence holder | The person or body corporate that has been granted a Cannabis Licence |
| Production |
Means the separation of cannabis and cannabis resin from the plants from which they are obtained. (Single Convention on Narcotic Drugs, 1961, Article 10) |
| Visitor | Any person that attends a Cannabis site and is not employed by the Licence Holder to undertake activities authorised by the Licence or permit. |
* %THC threshold may be lower in some jurisdictions.
References
A number of Australian and international resources should be considered when designing, implementing and maintaining effective security of medicinal cannabis.
- Australian/New Zealand Standard: Security Risk Management Handbook HB 167:2006
- Australian/New Zealand Standard: Safes and strongrooms - AS/NZS 3809:1998
- Australian/New Zealand Standard: Fraud and corruption Control - AS/NZS 8001-2008