With various cybersecurity threats looming over all businesses, it only makes sense for cannabis brands to set up security measures to mitigate these risks.
Although the Office of Cannabis Management has not yet delegated any cybersecurity requirements for New York cannabis companies, your cybersecurity plan should not be a second thought or just thrown together because it is required. Cyberattacks are extremely costly, both directly and regarding reputation management.
While a variety of solutions may fit your specific needs, there are some common sense steps you can take to begin developing your plan and hardening your business systems against hacks, breaches and attacks.
Assess your risks for cyber breach
The first step in shoring up your cybersecurity is identifying your weaknesses and being knowledgeable of the sensitive data you may be storing. Assess what kind of data your business is harboring and where that data is held, then identify how it can be vulnerable to hackers, data leaks and breaches. These risks are where you want to start when developing your cybersecurity plan. It is key to quickly address your most obvious weak points. If you can identify them, there is no doubt that hackers can as well.
Harden your systems and information databases
Generally, it is best to ensure all your online systems and databases are hardened from breaches via hackers, spyware and bots. This could mean adding extra firewalls, additional levels of access authentication, access management measures and mobile device security management. Privacy is very important in cannabis because of the nature of the data you could be storing, especially in a medical setting which can include sensitive patient information. Like in any business, you want your customers to feel confident that the information you’re collecting from them is safe and not going to end up in a leak.
Establish intrusion detection systems
If a breach happens, you’ll want to know as soon as possible. Be sure to set up parameters for detecting a hack or leak and identifying the compromised database or information. While the hack may have already occurred, you’ll want to be able to move quickly to absolve the situation and prevent further information from being accessed or exposed.

