The IT Compliance Problem Cannabis Businesses Don’t Talk About

Monterey County now has dozens of licensed cannabis operators — cultivators in the Salinas Valley, dispensaries near Marina and Seaside, distributors moving product through the region — and almost none of them are talking about their IT compliance exposure. That’s not an accusation. It’s just the reality of an industry that spent its first years focused on licensing, banking, and staying legal at the state level.

But California cannabis compliance doesn’t stop at CDTFA tax filings and METRC seed-to-sale tracking. The moment you store employee records, process card payments, collect customer data, or run a camera system tied to your network, you’ve entered compliance territory that has nothing to do with your cannabis license and everything to do with your IT infrastructure.

This article isn’t about scaring anyone. It’s about identifying the two or three IT compliance gaps that show up most often in cannabis operations — and explaining what it actually takes to close them.

Why Cannabis Businesses Face Compliance Pressure From Multiple Directions

Most industries answer to one or two regulatory frameworks. A dental office deals with HIPAA. A financial services firm deals with GLBA. Cannabis businesses in California answer to at least four overlapping compliance layers simultaneously — and IT systems sit at the intersection of almost all of them.

Here’s what’s actually in play:

• California Consumer Privacy Act (CCPA): If your dispensary collects customer information — even just names and purchase history through a loyalty program — CCPA applies. You’re required to disclose what data you collect, honor deletion requests, and protect that data from unauthorized access.
• California’s data breach notification law (Civil Code § 1798.82): If personal information stored on your systems is compromised, you have a legal obligation to notify affected individuals. There’s no minimum business size exemption.
• PCI DSS: Any operation processing credit or debit card payments must meet Payment Card Industry Data Security Standards. Most small cannabis retailers are either unaware of this or assume their point-of-sale vendor handles it automatically — often incorrectly.
• State license conditions: The California Department of Cannabis Control requires security camera systems, access controls, and record retention. Many of those requirements have direct IT implications that operators don’t connect to their compliance checklist.

As the compliance landscape for Salinas businesses gets more detailed each year, cannabis operators are starting to realize that their IT setup is either a compliance asset or a liability — and right now, for most, it’s the latter.

The Access Control Gap Nobody Audits

Walk through almost any cannabis operation in Monterey County and you’ll find the same pattern: everyone uses the same login credentials for the back-office software, the camera system admin panel runs on a default password from the vendor, and the Wi-Fi password gets shared with every new employee on their first day.

That’s not a security complaint — it’s just what happens when a business grows fast and nobody’s job is to think about IT access controls. But it creates a compliance problem that cuts across multiple frameworks at once.

Under PCI DSS, you’re required to restrict access to cardholder data on a need-to-know basis, assign unique IDs to each person with computer access, and maintain logs that show who accessed what and when. Shared credentials make that impossible.

Under CCPA, if a disgruntled former employee walks out with customer loyalty data because they still have access to systems you forgot to revoke, your business is the one with the exposure — not the employee.

What a proper access control structure actually looks like:

• Every employee has their own named login with role-based permissions
• Access is revoked within hours of someone leaving the company — not days or weeks
• Administrative credentials for cameras, Wi-Fi, and software are held by a designated person or your IT provider, not written on a sticky note in the break room
• Access logs are retained for at least 90 days and reviewed periodically

This is one of the areas where reactive break-fix IT support consistently fails cannabis businesses — nobody’s reviewing access logs or auditing user accounts until something goes wrong.

Four IT Compliance Layers Cannabis Businesses Must Address

California cannabis operators don’t face a single compliance framework — they face four overlapping ones, each with direct IT implications.

What Happens to Your Network When Security Cameras Are on the Same System as Everything Else

The California Department of Cannabis Control requires licensed operators to maintain security camera systems with specific coverage and retention requirements — typically 90 days of recorded footage for most license types. Most operators handle this by installing an NVR or DVR system and calling it done.

The problem is where that camera system lives on your network.

In most cannabis businesses, the security cameras, the point-of-sale terminals, the back-office computers, and the employee Wi-Fi all run on the same flat network. That means a vulnerability in any one of those systems creates a path to all the others. Security cameras in particular are notorious for running outdated firmware and rarely getting patched — which makes them a common entry point for attackers.

The fix isn’t complicated, but it requires someone to actually configure it. Network segmentation — separating cameras, POS systems, and general office traffic into distinct network zones — is a standard practice that most small businesses skip because nobody ever explained why it matters.

For Monterey County cannabis operators, this also intersects with your physical security compliance. If your camera system is compromised and footage is lost or tampered with, that’s not just a cybersecurity incident — it’s potentially a licensing violation. The problems that arise when IoT devices aren’t properly managed show up in exactly this kind of scenario: connected devices that are ignored until they become a liability.

Proper network architecture for a cannabis operation typically includes:

• A dedicated VLAN for security cameras with no access to business systems
• Separate network segments for POS terminals and office computers
• Guest Wi-Fi that is completely isolated from any business or compliance-critical system
• Firewall rules that control what can talk to what — not just what can reach the internet

Common IT Compliance Gaps in Cannabis Operations

These are the gaps that show up most consistently when auditing cannabis business IT environments in California — along with the framework affected and what closing the gap actually requires.

Why Most Cannabis Businesses Don’t Have an IT Partner at All

Cannabis is a cash-intensive, compliance-heavy, rapidly evolving industry — and traditional IT providers often don’t want the business. Some MSPs decline cannabis clients because of internal policy. Others worry about reputational risk or simply don’t understand the regulatory environment well enough to be helpful.

That leaves many cannabis operators doing IT completely on their own or relying on whoever set up the system during buildout and hasn’t been heard from since. It’s one of the reasons some industries have a genuinely harder time finding IT support — the problem is real, not imagined.

And the cost of going without is real too. According to the IBM Cost of a Data Breach Report, the average cost of a data breach for a small business now exceeds $4.45 million globally — but even a localized breach at a Monterey County dispensary could trigger CCPA notification obligations, card brand fines under PCI, and California Attorney General scrutiny. None of those are survivable for most small operators.

Finding an IT provider who will work with a cannabis business — and who understands the compliance framework well enough to actually help — requires looking for someone local with direct SMB experience rather than a national MSP that treats every client identically. What separates a local IT provider from a national one often comes down to exactly this kind of industry-specific knowledge and willingness to engage.

Frequently Asked Questions About Cannabis Business IT Compliance