What Should a Cannabis Dispensary Prove in a Least-Privilege Access Review?

Research question

What can a cannabis dispensary prove when it reviews access to point-of-sale, inventory, compliance, and customer systems? The easy output is a spreadsheet of usernames. The harder question is whether each permission has a stated business purpose, an accountable owner, a current assignment, and evidence that excessive or dormant access was resolved. This matters because cannabis operations use systems that touch inventory, customer information, financial records, and regulated reporting, while staff roles and vendors change over time.

Methodology and scope

This bounded research review compares NIST Cybersecurity Framework 2.0, NIST least-privilege and access-control publications, CISA identity guidance, FTC privacy and security guidance, and Virginia CCA laws and regulations. The sources are authoritative context for control design, not proof of a specific operator’s compliance. Facts are separated from analysis. The article does not inspect credentials, recommend a particular software package, or infer an employee’s trustworthiness from an access record.

The unit is a permission assignment

Review a permission assignment, not just an account. The assignment combines a subject, system, role or entitlement, business owner, start condition, end condition, and evidence of the review decision. A person may have one account with several permissions, a vendor may have a time-limited support role, and a shared account may prevent attribution altogether. “Active” is an account state; it is not proof that every entitlement is necessary.

For each assignment, ask what the role needs to read, create, approve, export, or delete. Separate ordinary work from exceptional authority. A user who can enter inventory may not need to approve an adjustment. A person who can view customer records may not need bulk export. These distinctions are analysis grounded in least-privilege principles, not a claim that every dispensary must use the same role map. The owner of the process should approve the boundary and record the reason.

Evidence of review and remediation

A defensible review packet includes the population source, review date, scope of systems, role definitions, reviewer, owner decision, exceptions, and remediation evidence. Preserve the before state when access is removed or changed. A screenshot may show a moment but not necessarily the source query, so pair it with an export or system event where available. Do not record passwords, recovery answers, access tokens, or unnecessary personal information in the packet.

Dormant accounts, terminated assignments, shared credentials, emergency access, and vendor accounts deserve separate states. A dormant account may be disabled; a terminated assignment may need investigation of recent actions; emergency access may be valid only with a reason and expiration; a vendor account may need a named sponsor and end date. Collapsing all four into “inactive” loses the decision that a reviewer must later defend.

NIST CSF 2.0 frames governance and protection as connected outcomes, while NIST access-control publications explain least privilege and separation of duties [S1][S2]. CISA identity guidance emphasizes identity and access management as an operational discipline [S3]. FTC guidance addresses reasonable security and data protection practices [S4]. Virginia CCA sources establish the cannabis program context [S5]. None provides a universal number of users per role, a required review frequency for every situation, or proof that a local configuration is compliant.

Measuring the queue without inventing a benchmark

Useful local measures include assignments reviewed, assignments with a named owner, exceptions open at the end of the window, remediation elapsed time, and accounts whose source assignment was unknown. State the denominator for each. “Eighty percent reviewed” is incomplete unless the population excludes service accounts, vendors, or systems that could not export data. Record the extraction time and filters so a second reviewer can reproduce the list.

The numbers describe an administrative queue. They do not prove that no unauthorized action occurred, that a person acted improperly, or that a security incident happened. If an access change follows a review, connect the change event and effective timestamp. If the system cannot provide that evidence, say so. Honest uncertainty is more useful than a green status that hides an unverified state.

Limitations and conclusion

The public sources do not reveal a dispensary’s applications, identity provider, role catalog, employment lifecycle, or vendor contracts. Framework language is intentionally general and requires local interpretation. A review can also miss access granted outside the system being sampled. Privacy constraints limit who should see the packet, and security constraints mean the packet itself needs protection.

The evidence-led conclusion is that least privilege is reviewable when the operator can connect each entitlement to a current role, owner, reason, effective boundary, and remediation trail. A user inventory is only the starting population. Separate inactive, emergency, vendor, and unexplained states; measure the queue with explicit denominators; and keep secrets out of evidence. That approach helps a cannabis dispensary improve access governance without claiming a universal benchmark or exposing sensitive credentials.

One useful quality check is to have a second reviewer select an entitlement from the source population and independently trace it to the role owner and change event. Record disagreement as a method issue, not as a silent edit. If the two reviewers see different populations, retain both query definitions and reconcile the difference. This small test exposes stale exports, duplicate identities, inherited permissions, and missing termination events before a summary number is used in an operational decision.

Public sources

1. [S1] NIST, Cybersecurity Framework 2.0.
2. [S2] NIST, Access Control and Least Privilege.
3. [S3] CISA, Identity and Access Management.
4. [S4] Federal Trade Commission, privacy and security.
5. [S5] Virginia Cannabis Control Authority, laws and regulations.