IWA INTERNATIONAL WORKSHOP 37-2 AGREEMENT First edition 2022-10 Safety, security and sustainability of cannabis facilities and operations - Part 2: Requirements for the secure handling of cannabis and cannabis products Reference number IWA 37-2:2022(E) ISO @IS02022 IWA 37-2:2022(E) COPYRIGHT PROTECTED DOCUMENT @ IS0 2022 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet oran intranet, without prior written permission.Permission can berequested from either Iso attheaddress below orIso's memberbody inthe countryoftherequester. ISO copyright office CP 401 · Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +4122 749 0111 Email: [email protected] Website: www.iso.org Published in Switzerland i @ IS0 2022 - All rights reserved IWA 37-2:2022(E) Contents Page Foreword. ..V Introduction. .. vi 1 Scope. .1 2 Normative references. 3 Terms and definitions. .2 4 Risk assessment ..11 4.1 General .11 4.2 Risk identification. ..12 4.3 Risk analysis. .12 4.4 Risk evaluation. 4.5 Risk treatment .13 4.6 Securityriskassessment ..13 4.7 Selection of risk treatment options. ..14 4.8 Risk acceptance. .. 15 5 Physical and technical controls ..15 5.1 General. .15 5.2 Security risk assessment (SRA) .16 5.3 Physical controls - Specific requirements .17 5.3.1 Outer physical barriers. 17 5.3.2 Cultivation areas.. .17 5.3.3 Doors/portals 17 5.3.4 Areas of protection and/or secure storage areas ..18 5.3.5 Lighting. 18 5.3.6 Security film .18 5.4 Technical/electronic controls - Specific requirements .18 5.4.1 General .18 5.4.2 Electronic security systems 18 5.4.3 Installation, maintenance, and inspection of the electronic security systems.. 18 5.4.4 Intrusion detection systems. 18 5.4.5 Access control systems.. 19 5.4.6 Video surveillance systems 19 5.5 Cybersecurity controls for operational technology 20 5.5.1 General 20 5.5.2 Roles and responsibilities 21 5.5.3 Cybersecurity risk assessment. 22 6 Administrative controls. .23 6.1 General .23 6.1.1 Continual improvement cycle 23 6.1.2 Administrative controls table 23 6.1.3 Security management policy 23 6.1.4 Implementation and operation 24 6.1.5 Preparing and implementing risk treatment plans. 25 6.1.6 Competence training and awareness. 25 6.2 Traceability system. 25 6.2.1 General 25 6.2.2 General design considerations. 27 6.2.3 Minimum requirements 28 6.2.4 Verification/ mass balance / products reconciliation .31 6.2.5 Monitoring .31 6.2.6 Key performance indicators. .31 6.2.7 Audit scheduled. 31 6.2.8 Review 31 @ IS0 2022 - All rights reserved iii IWA 37-2:2022(E) 6.3 Security management documentation 31 6.3.1 General .31 6.3.2 Document and data control 32 6.3.3 Operational control .32 6.3.4 Emergency response and security recovery 33 7 Requirements for specific activities. .33 7.1 Cultivation 33 7.1.1 Physical and technical/electronic controls for cultivation 33 7.1.2 Administrative controls for cultivation security .33 7.2 Processing. 36 7.2.1 Physical controls for processing. .36 7.2.2 Technical/Electronic controls for processing 36 7.2.3 Administrative controls for processing 36 7.3 Storage/distribution 40 7.3.1 Physical and technical/electronic controls for storage/distribution 40 7.3.2 Cybersecurity controls for storage/distribution .40 7.3.3 Administrative controls for storage/distribution 40 7.4 Research/Testing laboratory 41 7.4.1 Physical controls for research/testing laboratory 41 7.4.2 Technical/Electronic controls for research/testing laboratory 42 7.4.3 Cybersecurity for research/testing laboratory 43 7.4.4 Administrative controls for research/testing laboratory 44 7.5 Retail/dispensary 46 7.5.1 Physical controls for retail/dispensary 46 7.5.2 Technical/electronic controls for retail/dispensary 47 7.5.3 Cybersecurity controls for retail/dispensary 49 7.5.4 Administrativ