Teams should design video controls around both operational protection and regulatory evidence. That means verifying camera placement, image quality, retention periods, remote access, and backup power before relying on the system. They should also ensure footage can be retrieved quickly for audits or incidents. In practice, the system must support day-to-day monitoring and formal compliance demands without creating coverage gaps.
Design the video system for evidence, not just monitoring
A cannabis video system has to do two jobs at once: deter or detect incidents and produce footage that stands up as evidence. That changes the design standard. Teams should treat camera coverage, image fidelity, time synchronisation, and retention settings as compliance-critical controls, not just technical preferences.
In practice, the system should be tested against the specific questions an auditor, investigator, or security lead will ask: can you see the right area, identify activity clearly, and retrieve the right clip without delay? If any of those fail, the system may still function as surveillance, but it will not function reliably as evidence.
Operational constraints that usually decide whether the system is defensible
Coverage gaps are the most obvious failure mode, but they are not the only one. Blind spots, poor low-light performance, misaligned retention periods, disabled remote access, and weak backup power can all make a system fail its security purpose even when the cameras are technically online.
Teams should also assume that compliance demands are time-sensitive. If footage cannot be retrieved quickly, exported cleanly, or preserved without alteration concerns, the system becomes hard to use during audits, incident reviews, or disputes. That is why retrieval process and evidence handling matter as much as camera placement.
Build the control set around reviewability and continuity
The control objective is not simply to record video, but to maintain a trustworthy chain from capture to review. That usually means validating retention settings against local requirements, confirming that remote viewing does not weaken access control, and checking that power or connectivity loss does not create silent evidence gaps.
Teams should also separate day-to-day security use from formal compliance use. A system that is sufficient for live monitoring may still be too fragile for record preservation, export, or post-incident reconstruction. The safest design is one that keeps those workflows aligned rather than assuming they are the same.
Risk and Threat Considerations
When security and compliance share the same video platform, the main risk is false confidence: the organisation assumes it has usable evidence even though a camera angle, retention setting, outage, or access problem would block retrieval when it matters. That creates both operational exposure and audit exposure.
Failure mechanism: Poor placement, weak storage continuity, inadequate backup power, or unreliable remote retrieval can leave gaps in coverage or evidence integrity, especially during the exact window when an incident or audit requires proof.
Impact: Teams may be unable to confirm what happened, demonstrate control operation, or retain footage long enough to satisfy compliance, which can turn a manageable event into a reporting, enforcement, or dispute problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.PS-01 — Protection of Technology Assets | Video systems need resilient capture and evidence continuity. |
| Recommendation — Validate camera coverage, storage continuity, and backup power as part of protective controls. | ||
| NIST SP 800-53 Rev 5 | AU-11 — Audit Record Retention | Footage retention and retrievability are central to compliance evidence. |
| PE-6 — Monitoring Physical Access | Cameras are used to monitor physical areas and activity. | |
| Recommendation — Set retention and preservation settings so footage remains available for audits and incidents. Place cameras to monitor critical zones without blind spots or unnecessary coverage gaps. | ||
| ISO/IEC 27001:2022 | A.7.4 — Physical security monitoring | The subject is physical surveillance used for security and assurance. |
| Recommendation — Define monitoring requirements so physical surveillance supports both security and compliance. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Video footage serves a log-like evidentiary function and must be retained and retrievable. |
| Recommendation — Preserve recorded evidence with retention and access controls that support investigation and audit. | ||
Practitioner Guidance
What to verify: Validate camera angles, image quality, retention, retrieval speed, and failover behaviour as a single control set. If any one of those breaks the evidence chain, the system should be treated as incomplete for compliance purposes.
What good looks like: The same footage that supports live security review can be located, exported, and explained without special handling, delay, or manual reconstruction. If your team needs workarounds to make the evidence usable, the design is not yet mature enough.
Practitioner takeaway: For cannabis facilities, the right standard is evidence-ready monitoring, a system that remains usable under outage, access, and audit conditions, not just one that records video on a good day.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
