Ransomware Continuity for Dispensary Operations

A dispensary can lose access to its point of sale, inventory system, email, payroll, camera archive, and customer records in a single ransomware event. The store may still have product and staff, but the systems that connect them are unavailable. The operational question is not only how to remove the malware. It is how to keep the business lawful, safe, and communicative while the systems are down.

CISA's #StopRansomware Guide and the NIST Cybersecurity Framework provide a structure for that work. They are written for a general audience, not specifically for cannabis retail. This review translates the public guidance into the decisions a dispensary should settle before an incident, with attention to the parts of the business that cannot simply wait for IT.

Why retail dispensaries are exposed

A dispensary is a retail business with a regulated inventory system, a customer-facing POS, an e-commerce or menu presence, and a back office that handles payroll, invoices, and records. Each of those systems can be an entry point or a dependency. A phishing email to the buyer, a compromised vendor account, an exposed remote-access service, or a reused password can start an incident that spreads across the store.

The continuity risk is not evenly distributed. The POS and inventory system are usually critical because they connect sales to regulated inventory. Email is critical because it carries vendor, regulator, and customer communications. Payroll and scheduling are critical because staff need to know when to work and how they will be paid. The camera system may be critical for security and evidence. A dispensary should rank these systems before an incident, not during one.

CISA's Cyber Essentials toolkit frames the basics: inventory the assets, secure the accounts, patch the software, and prepare for recovery. The details matter, but the sequence is useful. A store that does not know which systems hold regulated records cannot prioritize recovery.

What the public guidance actually recommends

The CISA guide recommends maintaining offline, encrypted backups and testing their availability and integrity in a disaster recovery scenario. It warns that some ransomware variants attempt to find and encrypt accessible backups, which is why an online-only backup may not be enough. It also recommends a written incident response plan, a communications plan, multi-factor authentication, phishing-resistant authentication for critical services, endpoint detection and response, network segmentation, and third-party risk management.

NIST's Cybersecurity Framework organizes the work into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. The framework is not a checklist, but it is a useful way to assign ownership. A dispensary owner can use the functions to ask who owns the asset inventory, who approves a recovery priority, who talks to the bank, and who communicates with customers.

NIST Special Publication 800-53 provides a deeper control catalog for organizations that need it. A small dispensary may not implement every control, but the catalog helps identify gaps in access control, audit logging, contingency planning, and incident response. The goal is proportionate risk management, not a perfect enterprise program.

The dispensary-specific continuity problem

Generic ransomware advice says to restore from backup and continue. A dispensary has additional constraints. The regulated inventory system may require specific reporting before or after a transaction. The POS may be the only place where age verification, purchase limits, and sales records are captured. The menu may be connected to the POS and may show stale prices or availability during an outage. The bank and payment processor may have their own fraud and settlement rules.

A useful continuity plan separates three modes:

1. Full operations. All critical systems are available.
2. Constrained operations. Some systems are down, but the store can sell with an approved manual or alternate process.
3. Suspended operations. The store cannot meet the required sales, safety, or recordkeeping conditions and must pause or close.

The plan should define who may declare each mode, what evidence is required, and how the store returns to full operations. A manager should not improvise a manual sales process during an incident if the state rules or the store's own policy do not allow it.

Five decisions to settle before an incident

The first decision is the communication chain. Who calls the owner, the IT provider, the bank, the payment processor, the insurer, and the state regulator? Who speaks to customers and staff? Who talks to law enforcement? A call tree with names and backup names is more useful than a generic "contact IT" instruction.

The second decision is the recovery order. Which system comes back first: email, POS, inventory, payroll, or the website? The answer depends on the store's legal and operational obligations. Write the order down and review it with the people who run the floor.

The third decision is the manual fallback. If the POS is unavailable, can the store record sales on paper? If yes, what form, what approvals, and what later entry process? If no, the store may need to pause sales. The fallback should be tested, not invented during the outage.

The fourth decision is the evidence hold. A ransomware event may require preserving logs, messages, and affected devices for the insurer, counsel, or law enforcement. The team should know not to wipe or rebuild a device before the evidence owner says it is safe.

The fifth decision is the public message. Customers need to know whether the store is open, whether orders are being accepted, and how to reach the team. Staff need to know what to say and what not to say. A short holding statement approved in advance reduces the chance of conflicting messages.

Backup evidence is a control, not a checkbox

A backup is only useful if it can be restored. CISA recommends testing the availability and integrity of backups in a disaster recovery scenario. For a dispensary, that means more than checking that a nightly job turned green. It means restoring a sample of the POS, inventory, email, and document systems into a test environment and confirming that the data is usable.

Record the backup scope, frequency, encryption, storage location, retention, and restoration test date. Note who has access to the backup and whether the access requires multi-factor authentication. If the backup is managed by a third party, confirm the vendor's restoration responsibilities in the contract and test the escalation path.

A three-part test is practical. First, restore a single file or record and verify its contents. Second, restore a system into an isolated environment and verify that it starts. Third, run a tabletop exercise in which the team must find the backup, request the restore, and communicate the downtime. The third test often reveals the real gap: nobody knows who is allowed to authorize the restore.

A tabletop that fits a dispensary

A two-hour tabletop can be more valuable than a long policy document. Use a realistic scenario: the POS and email are unavailable on a Saturday afternoon, the store has a line, and the payment processor reports unusual activity. Assign roles: incident lead, operations lead, communications lead, records lead, and scribe.

Walk through the first 30 minutes. Who notices the problem? Who declares constrained operations? How are customers told? How are sales recorded, if at all? Who calls the bank? Who preserves the evidence? What happens to the delivery orders already in progress? What is the next update time?

Then walk through the first 24 hours. Who talks to the insurer? Who decides whether to pay a ransom? The public guidance generally discourages paying, and the decision should involve counsel, law enforcement, and the insurer. The tabletop should make clear that the decision is not delegated to an IT vendor or a shift manager.

Document the gaps and assign owners. Repeat the exercise after a major system change or a staff change. A plan that has never been exercised is a hypothesis.

Evidence to retain

The incident record should include the time the problem was detected, the systems affected, the people who responded, the communications sent, the recovery steps, and the final status. Preserve relevant logs, emails, screenshots, and vendor tickets. Record the backup restoration test and the data validation result.

Do not place sensitive incident details in a public task board or a shared chat that is not approved for the purpose. Use a restricted incident channel and a controlled evidence folder. If customer data may have been exposed, route the notification analysis to counsel and the privacy owner. The customer privacy request log workflow may need to handle an increase in customer questions after a breach.

What the guidance cannot decide

CISA and NIST can describe good practice. They cannot tell a dispensary whether a particular manual sales process is allowed by state cannabis rules, whether a ransom payment is lawful or insurable, or whether a specific customer notification is required. Those questions depend on the jurisdiction, the data, the contracts, and the facts.

The public guidance is also not a guarantee. An organization can follow the recommendations and still experience a destructive incident. The purpose of the plan is to reduce the likelihood and the impact, not to eliminate risk.

Practical conclusion

Ransomware continuity for a dispensary starts with a short list of decisions: who leads, what comes back first, how sales work when the POS is down, what evidence is preserved, and what the public is told. The technical controls matter, but they are not the whole plan.

Use the CISA guide to check the controls, the NIST framework to assign ownership, and a tabletop to test the assumptions. Then connect the incident record to the store's security incident handoff and POS support workflows. The store may not be able to prevent every attack, but it can avoid discovering its plan for the first time during one.

Sources

1. CISA #StopRansomware Guide
2. CISA StopRansomware
3. CISA Cyber Essentials
4. NIST Cybersecurity Framework
5. NIST SP 800-53 Rev. 5
6. FBI Internet Crime Complaint Center annual reports

Internal reading: security incident handoff and POS support.