Compliance and risk
Cannabis Dispensary Incident Reporting Data 2026
A source-bounded method for measuring incident reports, response time, and evidence quality in dispensary operations.
Key takeaways
- A report count is not an incident rate without an exposure denominator.
- NIST CSF 2.0 has 6 functions, including Govern, for organizing response evidence [S1].
- State reporting duties depend on the license and incident type.
Incident volume needs context. Ten reports may mean more events, better reporting, a larger store, or a changed definition. Report the numerator with operating days, transactions, shifts, or another stated denominator. Do not present a local series as a national cannabis rate.
Build the record around decisions
Capture the event time, location, people who need to know, immediate containment, and evidence owner. Keep allegations, observations, and confirmed findings in separate fields. A report should route work; it should not force an assistant to decide a legal conclusion.
NIST CSF 2.0 organizes cybersecurity outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover [S1]. A dispensary can map account access, POS anomalies, and document loss to those functions without claiming NIST is cannabis law.
| Metric | Formula | Caveat |
|---|---|---|
| Reports per 1,000 transactions | Reports / transactions x 1,000 | Define report scope |
| Acknowledgement time | First acknowledgement minus receipt | Preserve timestamps |
| Open cases | Cases without closure evidence | Do not count drafts |
| Repeat category | Same category in window | Require a category definition |
Read the NIST CSF 2.0, NIST CSF FAQ, NIST SP 800-53, and NIST Privacy Framework together. Virginia operators should check CCA laws, processor regulations, and CCA reports. OSHA recordkeeping and OSHA incident resources are separate from cannabis reporting. The FDA recall guide, NARA records guidance, FinCEN guidance, and IRS marijuana guidance provide bounded analogies for traceability and record controls.
A denominator example
If 6 reports occurred during 12,000 recorded transactions, the local rate is 0.5 reports per 1,000 transactions. That calculation says nothing about severity. Show severity and open-case counts beside it.
Use the customer service benchmark for complaint categories and the cybersecurity statistics review for access-event controls.
Frequently asked questions
Is a report count a compliance score?
No. Reporting behavior and underlying events are different variables.
Who closes an incident?
The licensee's written procedure should name the role, evidence standard, and escalation path.
Should names be copied into every report?
No. Use the minimum personal information needed for the decision and retention rule.
Can a trend prove the control caused improvement?
No. Staffing, definitions, exposure, and reporting culture may have changed too.
Sources
- [S1] NIST, CSF 2.0, 2024.
- [S2] NIST, CSF FAQ, accessed August 10, 2026.
- [S3] NIST, SP 800-53, 2020.
- [S4] NIST, Privacy Framework, 2020.
- [S5] Virginia CCA, Laws, accessed August 10, 2026.
- [S6] Virginia Administrative Code, Processor rules, accessed August 10, 2026.
- [S7] Virginia CCA, Reports, accessed August 10, 2026.
- [S8] OSHA, Recordkeeping, accessed August 10, 2026.
- [S9] FDA, Recalls, accessed August 10, 2026.
- [S10] National Archives, Records management, accessed August 10, 2026.
- [S11] FinCEN, Marijuana businesses, 2014.
- [S12] IRS, Marijuana industry, accessed August 10, 2026.
Conclusion
The useful incident statistic is a transparent local measure with a denominator, scope, and evidence owner. Keep the reporting process separate from legal conclusions.
Reviewed by the DispensaryVA editorial team on 2026-08-10.