Get out of jail free card
As a regulated industry, if you don’t maintain records of your transactions, you face serious legal consequences. CyberAssureTech offers a ‘get out of jail free card’ to cannabis retail shops by archiving your POS system on an immutable ledger.
Cannabis Retail shops are becoming a target for Ransomware due to their small operation size leaving IT vulnerabilities, and their reputation to pay.
California mandates that all cannabis business owners save any paperwork related to commercial cannabis activity for a minimum period of seven years. The consequence for not doing so can land the business a fine of up to $30,000 per violation.
Unlike other small businesses, the Federal Bureau of Investigation will not assist Cannabis businesses experiencing ransomware.
Cannabis owners face potential jail time for data breach:
Local Regulations:
Canada
A holder of a license must retain a copy of any organizational security plan
-
Retention periods — previous versions
(3) The holder must retain
-
(a) each version of the list referred to in paragraph (1)(b), for at least two years after the day on which it is replaced by a new version or, if it has not been replaced, at least two years after the day on which the licence expires or is revoked; and
-
(b) each version of the document referred to in subparagraph (1)(d)(i), for at least two years after the day on which the validated methods are replaced or, if the methods have not been replaced, two years after the day on which the licence expires or is revoked.
-
California
Section 15037 – General Record Retention Requirements (a) Licensees must keep and maintain records in connection with the licensed commercial cannabis business. Records must be kept for at least seven years from the date of creation, unless a shorter time is specified.
Colorado
(1) Each commercial, registered limited commercial, licensed private, and registered public applicator shall keep and maintain records of each pesticide application in the form and manner designated by the commissioner. The applicator shall retain the records for three years after the date of the pesticide application; except that the record retention period for private applicators is two years.
Connecticut
(a) Each cannabis establishment shall maintain all records necessary to fully demonstrate business transactions related to cannabis for a period covering the current taxable year and the three immediately preceding taxable years, all of which shall be made available to the department pursuant to subsection (c) of this section.
(b) The commissioner may require any licensee to furnish such information as the commissioner considers necessary for the proper administration of RERACA, and may require an audit of any cannabis establishment, the expense thereof to be paid by such cannabis establishment.
Hawaii
(a) A dispensary licensee shall maintain business operation records including but not limited to:
(1) Inventory tracking including transport of cannabis and manufactured cannabis products;
(2) Sales and compliance with dispensing limitations for each qualifying patient, primary caregiver, qualifying out-of-state patient, and caregiver of a qualifying out-of-state patient;
(3) Financial records including income, expenses, bank deposits and withdrawals, and audit reports;
(4) Logs of entry and exit for dispensary facilities; and
(5) Employee records.