Environmentally conscious manufacturing has never been more important; for the survival of both the planet and your business. The internet makes CBD product comparisons quick and efficient, so consumers can interrogate every aspect of your product and processes before deciding to make a purchase. Sustainability credentials are now a primary decision making factor for your customers.
Water jacketed vessels are a cost-effective way of achieving more consistent blends than is possible manually
For business of all sizes, improving resource use and efficiency is a great place to start. This will reduce waste and improve your environmental impact, and has the added benefit of improving your return on investment!
I always recommend investing in stainless steel equipment for manufacturing and distributing CBD oils. Stainless steel is one of the most environmentally efficient raw materials, because of its durability and ability to be recycled. Vessels last an extremely long time, and even once their service life is over, they should never enter the waste stream. Many of our US customers transport their CBD products around the world in stainless steel vessels, which can then either be shipped back for re-use, or re-used at the recipient site.
In terms of finding your ideal equipment supplier, those who have won awards for their environmental initiatives are the cream of the crop; they can be a real asset to your business and will often collaborate on sustainability-themed social content, which is really valuable to get in front of your customers.
Once you’ve investigated the credentials of suitable suppliers, how do you make sure their blending equipment will perfectly meet your needs?
Here are my recommended four points for consideration:
Adding Toggle Clamps keeps your products airtight and reduces the chance of contamination in transit
Vessel Capacity: Vessel capacity must be considered in two ways; maximum and minimum working capacity. Standard vessels have their capacity listed as ‘brim full’ – suppliers tell you the total overall volume of space in the vessel. However, maximum capacity must allow for 10-20% free space below ‘brim full’, so that if product is being mixed and stirred, there is no overspill. For example; to blend 75L batches of CBD oil, it’s generally recommended to purchase a 100L mixing vessel.
Vessel Bottom Shape: Standard vessels have flat bottoms, which makes it difficult to drain them to completely empty. An experienced supplier such as Pharma Hygiene Products has the capability to modify standard vessels, to include a sloped bottom at 3 degrees, which reduces leftover product pooling when draining your oils. Vessels can also be custom-made with a cone or dish shaped bottom, whereby a valve can be positioned in the centre of the base to allow full draining, to reduce waste and increase profitability.
Stainless Steel Grade: Stainless steel blending vessels for CBD oils are generally offered in 304 or 316L pharmaceutical-grade material. A simple description of the difference is that 316L grade contains an extra 2% molybdenum, for additional corrosion-resistance. Increased regional and international legislation concerning CBD products has come hand-in-hand with tighter interrogation of hygiene practices. Contaminant-free materials such as stainless steel are ideal to ensure international pharma-quality compliance for your business’ blending processes. Critically, at Pharma Hygiene Products a comprehensive range of compliance certification is available to confirm the grade of material, to prove surface smoothness, and to guarantee that no cross-contamination from BSE or CJD diseases occurs.
Lastly, don’t forget to let your supplier know in advance if you have any special requirements for your product or vessel. Some common examples include:
Temperature control – Adding a water jacket to your vessel is a simple solution for heating, cooling or maintaining the temperature of your product as it blends.
Toggles and seals – For airtight, contaminant-free transportation.
Viewing holes – For easy visual inspection whilst blending.
Your equipment supplier can be a real financial and reputational asset, so be sure to do your homework before making an investment!
According to a press release published last week, Medicinal Genomics has hired Sherman Hom, Ph.D. to be their first director of regulatory affairs. Dr. Hom is coming from a position at New Jersey’s Division of Public Health and Environmental Laboratories (PHEL) where he was the leading research scientist for the state’s cannabis testing lab as well as coordinating their pre-analytical activities for SARS-CoV-2 testing.
Sherman Hom, Director of Regulatory Affairs at Medicinal Genomics
As project manager for the state’s cannabis testing lab, he was responsible for validating microbial testing in cannabis. He has also been a professor of microbiology, a lab manager, a senior research scientist, a writer and an inventor, according to the press release.
“My passion is regulatory affairs,” says Dr. Hom. “For the last 4 years, we’ve been building a facts and comparison database of required state medical cannabis testing. It’s formidable. Of course, the states will all have the same regulations eventually. In the meantime, it’s my job to help them craft the safest, most efficient and effective set of regulations possible. I’m here because I know Medicinal Genomics shares that passion.”
Delta 8 THC (delta-8-tetrahydrocannabinol) sprung onto the scene late last year in a big way. While similar to the much more widely-known delta-9-tetrahydrocannabinol that produces a lot of the psychoactive effects associated with ingesting cannabis, delta 8 THC can be derived from hemp with less than 0.3% delta 9 THC. Given the legality of hemp-derived products following the 2018 Farm Bill, delta 8 THC can be produced in some states where delta 9 THC still remains illegal.
While delta 8 is considerably different in its psychoactive effects from its cousin, it does overlap in some ways. It can still produce some more manageable, less “heady” versions of delta 9’s effects like euphoria and relief found in the many medical applications of cannabis. DeltaVera, a company that launched less than six months ago, aims to share that more manageable THC experience with the masses.
The sharp rise of the delta 8 market means that DeltaVera is poised for growth. With distribution contracts inked, exciting partnerships in the works and a large surge in consumer demand, the founders of DeltaVera are at the ready to capitalize on this lesser-known molecule and bring it to the forefront of the nascent hemp industry. Starting out as a small family business, Sam and Craig Andrus launched DeltaVera with their third founder, PK Isacs.
We sat down with Sam Andrus and PK Isacs, two of the founders of DeltaVera, an award-winning brand, to ask them about their plans for expanding, how they became entrepreneurs and why they think delta 8 is the next big thing in cannabis.
Cannabis Industry Journal: Tell me about your company. How did you get started in the cannabis space?
Sam Andrus, cofounder of DeltaVera
Sam Andrus: I had an early start in the Delta 8 THC industry on the sales side. We knew we wanted to get into the market, but observed a number of aspects in the space that needed to be addressed: the most important being quality control, transparency and brand trust. With this as a backdrop we launched DeltaVera. Highly curated, approachable, transparent and value-oriented with a strong focus on reliability and trust. The DeltaVera family is made up of three operating managers and the sales team. We are three founders with complementary skill sets: Craig, who has domain expertise in finance, governance and startups, PK who has experience in business and marketing and my sales experience round out the management team.
We have yet to solicit outside capital and have funded ourselves internally as we create our brand and refine our product offering. That said, we are seeing numerous opportunities in strategic partnerships and expansion, which will require additional capital. And we are excited to start this expansion process.
CIJ: What makes the Delta 8 space so remarkable? Why are your SKUs primarily formulated with Delta 8?
Sam Andrus & PK Isacs: Delta 8 THC is an alternative/complement to delta 9 THC, CBD and other cannabinoids. Its status as non-federally scheduled and its less potent psychoactive effects make it appealing in its own right. Delta 8 THC can help with healthier sleep patterns and with pain management in a way that CBD can’t, without a strong “head high” that many of our customers like to avoid. Additionally, it’s shorter lived and doesn’t give you any negative residual effects, which makes it beneficial for people on tighter schedules. These factors make it easier for us to approach markets that are inaccessible to both delta 9 THC and CBD, such as older demographics. In a world where delta 9 is legal, there will still be a place for delta 8.
PK Isacs, cofounder of DeltaVera
While we are very proud of our suite of smokable products, we are currently focusing our efforts on edibles: our Delta Discs are our mainstay, though we are expanding our product line to include nano-emulsion products such as liquid shots and nano gummies. They strongly appeal to our target demographics; additionally, the edible market is growing very quickly in states that allow the sale of hemp-derived consumables.
CIJ: Continuing on the delta 8 front – right now it is considered a cannabinoid legal for interstate commerce, much like CBD, correct? Do you think that will change?
Sam & PK: That is currently the case. Delta 8 THC is newer, and as such, it has even more ambiguity in regards to its legal future. But what’s most exciting (and our most challenging task right now), is informing consumers about the benefits of delta 8. We are one of a few companies solely focused on the consumption of delta 8, because of its similar benefits to delta 9 and CBD – our products are the perfect happy medium: a high with less psychoactive effects and all the health benefits of both, making it a desirable alternative to all consumers.
In addition, we are looking at some combinations of delta 8/CBDA, delta 8/CBN, delta 8/THCV and are very excited to begin test marketing these combinations. These proprietary blends of minor/major cannabinoids can cater to a niche target demographic as they can be curated to have very specific and unique effects when combined in the right quantities with the right delivery system. They will also be able to serve a larger customer base as these cannabinoids can all be derived from hemp.
CIJ: How do you think the FDA would regulate your product? Do you welcome federal oversight?
DeltaVera gummy products
Sam & PK: Regardless of whether or not we are regulated we are committed to a high level of transparency and trust. As noted in unregulated markets, like the supplement market, you don’t always know what you are getting in terms of purity and potency. We are changing that paradigm by adding unique QR codes to our sustainable containers which reference COAs [certificates of analyses] specific to the contents of the case. A lot of the space is naturally trying to avoid that kind of regulatory interference, but we are currently doing our best to self-regulate and make sure that our consumers are fully informed about what they’re receiving.
We will be the first to say that there aren’t as many laws governing delta 8 THC as there could be, and that’s why we’ve spent so much time and money on self-regulation. All of our products have very clear nutritional information in addition to test results down to one hundredth of one percent. As for what category these products should fall under: we have a wide range of products, and each one has its place under a different umbrella of regulation. We hope that the federal government will take advantage of the vast array of studies that have been conducted on delta 8 THC since it was first extracted in 1942 to step up to this product that is, in our experience, helping so many people.
CIJ: Tell me about how your business has grown so far.
Sam & PK: When we sell to a retailer, we try to provide them with as much material as possible on what delta 8 THC is and what differentiates DeltaVera’s products. Still, we’ve had some difficulty in places with limited delta 8 THC exposure. That being said, when someone tries our product, there is a high likelihood that they become a repeat customer (and they tell their friends). Given our newness to the market (Our brand launched in January 2021) initial indications are – we have a good rate of repeat orders, and we’ve heard the same from our brick-and-mortar partners.
The DeltaVera Delta Discs
Our distribution network has grown tremendously; we’ve taken a three-pronged approach to distribution: partnerships with like-minded companies in compatible spaces, an e-commerce market on our website, and a commission-based sales structure to reach brick-and-mortar establishments. To date, most of our distribution takes place in the latter two spaces, due to the added time and commitment involved in forming partnerships. As a company we are taking a more creative approach on how we present our product and alternative ways to consume it. We have some exciting collaborations in the works; follow us on social media to stay up to date with everything on the horizon. We are very enthusiastic about our partnerships however, with our first collaboration with WaxNax, a Denver-based company revolutionizing the cannabis dabbing experience, hitting the shelves this week.
CIJ: What is your marketing plan?
Sam & PK: We are working on building a social media presence. Natalie, who is leading the charge on social media, recommended we take an organic approach to build our base. We want to avoid falling into the “paid ad”, “spam” vibe as long as we can. We are currently focused on building a community through delta 8. Our mission is making DeltaVera a brand for all lifestyles, athletes, creatives, travelers or business professionals. We’re confident in our product, and have faith that it can speak for itself.
CIJ: How do you ensure quality in your products?
Sam & PK: Our products are of guaranteed quality with our licensed growers and manufacturers. We provide COAs, informing the retailer & consumer about each product, displaying full panel tests on cannabinoids and heavy metals. These preliminary and secondary lab tests ensure our product is below 0.3% delta 9 THC in all our products. Through third-party labs, we run full panel tests which pick up a variety of cannabinoids; for most of our products we focus on the level/purity of delta 8. Our products are screened for both contaminants and heavy metals.
All this information is housed conveniently on our website that can be reached through our QR codes.
CIJ: What are your plans to grow the business in the future?
Sam & PK: We feel very confident in our three methods of distribution: partnerships, e-commerce and a commission-based sales structure. We’ve made tremendous ground on partnerships, and are very excited about numerous partnerships we have in the pipeline. We’ve reached out to some incredible groups in the CBD space, the THC space and a few groups that you wouldn’t normally associate with cannabinoids, but with whom we’ve workshopped some really creative ideas that we’re really looking forward to bringing to market.
Readers can use promo code “CIJ” to get 15% off their first order here.
Things are about to change for cannabis and cannabis-related businesses, as landmark legislation to reform federal cannabis banking and insurance laws is just around the corner with the SAFE and CLAIM Acts now making their way through Congress.
The Secure and Fair Enforcement (SAFE) Banking Act, which already passed in the House, would allow financial institutions to do business with cannabis companies without facing federal penalties. There are high expectations the proposal will make its way through the Senate and onto President Biden’s desk.
The Clarifying Law Around Insurance of Marijuana (CLAIM) Act was introduced in Congress in March and is in the first stage of the legislative process. If it passed, it would allow insurance companies to service cannabis businesses without the threat of federal penalties.
For years, fear of sanctions kept banks and credit unions from working with the cannabis industry, forcing cannabis businesses to operate on a cash basis which made them targets of crime and created complications for financial regulators. This is a significant first step for cannabis businesses toward conducting more legitimate and safe operations.
The SAFE Banking Act: Providing a Legitimate Avenue to Banking and Loans
With 37 states and D.C. having taken action to legalize cannabis in some way, it is clear the federal cannabis regulatory model has shifted and the path forward for the SAFE Banking Act shows promise.
The bill creates a safe harbor for banks and credit unions to the extent they would not be liable or subject to federal forfeiture action for providing financial services to a cannabis-related business.More competition means greater capacity and lower premiums for all.
The bill would prohibit a federal banking regulator from:
Recommending, incentivizing or encouraging a depository institution not to offer financial services to an account holder affiliated with a cannabis-related business or prohibit or otherwise discouraging a depository institution from offering services to such a business
Terminating or limiting the deposit insurance or share insurance of a depository institution solely because the institution provides services to a cannabis-related business
Taking any adverse or corrective supervisory action on a loan made to a person solely because the person either owns such a business or owns real estate or equipment leased to such a business.
The CLAIM Act: Backing Cannabis Businesses with the Right Insurance Coverage
Should the CLAIM Act pass, it will protect insurance companies that provide coverage to a state-sanctioned and regulated cannabis business. It would also prohibit the federal government from terminating an insurance policy issued to a cannabis business and protect employees of an insurer from liability due to backing a cannabis-related business.
The CLAIM Act will be a boost for the insurance market and drive more underwriters to write cannabis policies. More competition means greater capacity and lower premiums for all. The act would also have a notable impact on currently hard-to-source policies like Cyber coverage, Directors & Officers (D&O) insurance, Errors & Omissions (E&O) and other management liability policies that have been extremely limited to cannabis businesses.
Cannabis Sales Still Growing Strong Globally
The cannabis market is not slowing down in the United States or globally. Recent forecasts have U.S. sales reaching $28 billion in 2022.
As was the case in Canada where cannabis was made federally legal in 2018, there’s going to be a steep learning curve industry-wide for financial services and insurance vendors who don’t yet understand the risks and liabilities of cannabis operations, even if the SAFE and CLAIM Acts pass this year. And yet this is one giant step in the right direction toward the safe and equitable sales of cannabis country-wide.
In this “Flower-Side Chats” series of articles, Green interviews integrated cannabis companies and flower brands that are bringing unique business models to the industry. Particular attention is focused on how these businesses integrate innovative practices in order to navigate a rapidly changing landscape of regulatory, supply chain and consumer demand.
Multi-state operators (MSOs) are on the rise in the United States, navigating complex regulatory frameworks to drive profitability through economies of scale and scope. As an MSO and an early mover in the space, a significant part of MariMed’s current strategy is to complete the acquisition and consolidation of the licensed state cannabis businesses it has developed. It takes seasoned leadership to make that happen, and MariMed’s is led by one of the most experienced and successful MSO management teams in the industry. Over the last eight years, Bob Fireman and his colleagues have won 17 licenses in 6 states, and designed and developed over 300,000 square feet of cannabis cultivation, production and dispensing facilities.
MariMed has also developed a portfolio of award-winning cannabis brands and infused products which are licensed, manufactured and distributed in Delaware, Illinois, Maine, Maryland, Nevada, Rhode Island and Puerto Rico. A recently announced $46 million financing for a facility with Hadron Healthcare Fund will help repay all MariMed debt other than mortgage-backed bank loans and one convertible note, as well as help upgrade and expand the company’s owned and managed cannabis facilities.
We spoke with Bob Fireman, CEO of MariMed. Bob started the foundations of MariMed in 2008 after getting into large-scale hydroponics for urban sustainable agriculture. Prior to MariMed, Bob served as a startup lawyer focused on tech and emerging industries.
Aaron Green: Bob, tell me about how you got started in the cannabis industry.
Bob Fireman: I practiced law for decades. Part of my practice was to help startups in all sorts of industries, particularly technology and new emerging markets. At one point, I was introduced to a fascinating sustainable food business opportunity – to build hydroponic farms on rooftops in cities across the country.
Bob Fireman, CEO of MariMed, Inc.
When one of our projects in San Francisco hit some roadblocks, our team there pivoted to what was becoming the Wild West of California cannabis. My friend and current MariMed CFO, Jon Levine, and I began investing and managing a cultivation site there. That’s where we built our early foundation of industry knowledge.
Fast forward a few years, and I was afforded the opportunity to be involved in the drafting of the proposed Massachusetts medical cannabis legislation.
Through that work, we met a team that had won one of three cannabis licenses in Rhode Island. We formed a real estate LLC and raised the capital to develop a seed to sale cannabis facility in Providence, which was later leased to the Slater Center, a not-for-profit medical cannabis licensed business. Today, the Slater Center is a nationally acclaimed operation that services over 10,000 medical patients.
From there, we took our know-how and formed a new entity that was the formal beginning of the company we now know as MariMed. Initially, we helped win licenses for clients in Massachusetts, Delaware, Maryland, Illinois and Nevada. We also provided management services, working capital and other necessities. Under our management, we organically built these businesses from the ground up, advancing best practices and somewhat quietly creating a network of best-in-class operations throughout the industry.
That led to the consolidation of those businesses that we’re focused on today as a core strategic pillar.
I’m incredibly proud of our team, the core of which has been at this for 10 years. We’ve watched other MSOs try different models of success, with varying degrees of success. For us, focusing on growth markets, building at a reasonable and scalable clip, attracting incredible talent at all levels of the company, and developing fantastic brands that customers love, are the ingredients that have translated to where we are now – strong performance and an exceptionally bright future. “Slow and steady wins the race” has become a mantra.
Green: What trends are you looking at right now? What’s on your radar?
Fireman: My radar has a singular focus, and that’s to create shareholder value. That’s why completing the consolidation of the cannabis licensed businesses we’ve developed and manage into our public company is so critical. Back in the day, the initial available licenses were in medical-only state programs where applicants were required to be not-for-profit state companies. Accordingly, we raised the capital in the real estate entity which leased facilities to the licensees. Our revenue was from rents, management services and licensing fees.
Panacea Wellness in Middleborough, MA is one of MariMed’s adult use cannabis dispensaries
In 2019, we implemented a new strategic plan to consolidate these businesses. While that translates to our being structured similarly to other MSOs in that we are a vertically integrated seed to sale company, we are distinct in our operational excellence, quality product portfolio, and strong balance sheet. Other MSOs have raised large amounts of capital to pay large sums to acquire licensed state cannabis businesses and have found themselves over-leveraged and challenged to assimilate other companies’ methodologies and cultures. By consolidating the businesses and talented people we developed and managed from day one and utilizing our best practices and processes system-wide, we realize enormous capital efficiencies.
Our strategy is paying off. Our core cannabis revenue in 2020 increased 207% to $50.9 million, and our 10k reported EBITDA of $16.3 million. And now we’re on track to double our revenue in 2021.
The last piece of the puzzle is to let the world know what we’ve been doing. Slow and steady has worked for us but gone are the days of doing so quietly. We’re proud of what we’ve accomplished and exceedingly bullish on what’s to come.
Green: What do you look for in an M&A target?
Fireman: When M&A makes sense for us, we first look for single operators and entrepreneurs in states where we are not active and look to partner with business leaders that had the vision and the courage to get into this industry and build solid cannabis businesses from the ground up. I’m looking for businesses that could benefit from being part of a larger, more experienced and well-capitalized company like MariMed. Obviously, as an MSO with a solid platform, MariMed is approached regularly by other MSOs and banks suggesting candidates for M&A opportunities. Lining up with a company that has complementary cannabis licenses in other states and who shares our vision and ethics could be a win-win situation. They must embrace our commitment to diversity, the environment and proper corporate governance. We have been somewhat reticent to do this until we see some increase in our share price and market capitalization.
Green: Are there any new products, or product trends that you’re looking at?
Fireman: Marimed looks to be the most trusted source of high-quality cannabis products that consistently delivers innovative health and wellness solutions to our patients and customers. Our lab scientists are constantly creating and testing new and innovative formulations of cannabinoid compounds including CBD, THCa, CBG, CBN and others that will improve the health and wellness of our customers.
Our brand portfolio is ever-expanding with new and better product offerings. Our award-winning Betty’s Eddies Fruit Chews brand is adding new SKUs of varieties and flavors for both medical and adult use programs. Our Nature’s Heritage flower and concentrates brand is adding a line of solventless concentrates, live rosin, as well as new formulations for RSO, an oil popular with medical patients. Kalm Fusion is expanding its successful line of powdered drink mixes as we see more movement in the cannabis beverage category.
Microdosing is hugely popular right now, and we’re rolling out products in the 2-5mg dosage range. Health and dietary concerns are top of mind as well, and we offer products that are vegan, sugar-free and gluten-free. Ultimately, we want to be sure that we have something on the shelves for every single consumer. The financial hardship created by the pandemic has made consumers more attracted to value added products such as popcorn buds.
Green: You recently announced an equity financing from Hadron. I’m curious to learn more about it from a nuts-and-bolts perspective if you can share any of that information.
Fireman: Over the last year, access to the capital markets for equity raises in cannabis public companies was difficult. The cost of debt was and is still high, and we were looking for a long-term financial partner that understood the industry and could assist us. Hadron Capital has been successful for several years investing in some of the most successful MSOs and they saw the value and potential in MariMed’s experienced management and great assets.
Hadron invested $46 million in equity in MariMed this March. Approximately $16 million was utilized to retire all our short- and long-term debt but for bank secured debt and one convertible note. $7 million is committed to funding our capex and expanding the capabilities of our facilities, enabling us to grow more flower and automate production. The balance of funding will support our consolidation strategy to fund two more roll ups of state licensed cannabis businesses into the public company.
Going forward, it is comforting to have a capital partner to assist us in future acquisitions and M&A opportunities.
Green: I’d love to learn more about your Nature’s Heritage brand, particularly as it relates to the cultivation and the flower products.
Fireman: Our COO Tim Shaw has assembled a cultivation and production team with expertise in all aspects of genetics, growing methodologies, extraction techniques, and packaging innovation. That’s provided us a rich collection of quality genetics that make up Nature’s Heritage, our top-selling flower, oil and concentrate brand in Massachusetts and Maryland. We’ve recently expanded the line to include Rick Simpson Oil (RSO) and solventless concentrates (including live rosin) and have been receiving stellar feedback.
Green: What are you interested in learning more about?
Fireman: Over the last decade, the MariMed core team has seen the emergence and amazing growth of the cannabis industry. The initial medical programs in California and Colorado have now led to some form of legal medical or adult use cannabis programs in over 33 states and districts.
We are most interested in learning and following the federal, state, and international laws and regulations. It is vital to know how these laws will affect our company and the industry as a whole. When might full federal legalization become a reality? What might different versions of the law be? Will state legal programs be protected as well as the companies that took the risk in investing in the industry at its nascent state and how? What will FDA requirements and regulations look like? What medical claims will companies be allowed to make, and what kind of research or trials will be required to put a product on the shelf? What are the ramifications of the MORE Act or the SAFE Banking Act?
Responsible MSOs need to be prepared to rise to or above the standards of care of other industries. A lot of this was impossible in the past because of federal prohibition laws. Soon, if not already, labs and manufacturing processes will need to be GMP certified and more. Consumer data will need to be HIPAA compliant. Cannabis companies have to be good corporate citizens: diversity and equal opportunity should be embedded in business decisions, and commitment to ESG and sound environmental and social policies with good corporate governance need to be in planning and implemented.
Following the laws and holding ourselves to the highest possible safety and business standards will allow the cannabis industry to finally become “mainstream.”
Green: Alright, great. Thank you, Bob. That concludes the interview!
In Part 1 of this series we answered the question: What is “hemp”; and addressed some of the consequences of defining “hemp” as a thing. In Part 2, I will explore this topic in more detail and provide some commonsense definitions for several traditional hemp products based on a classification approach rather than separating “cannabis” from “hemp”.
Classifications, Specifications, and Test Methods – Establishing Market Protections for Hemp Products Through Standardization
Does making a distinction between “hemp” and “cannabis” make it easier to protect the interests of the seed and fiber markets?
On the face of it, this question seems obvious. Yes, it does.
Up to this point in history, the bifurcation of the cannabis plant into resin types and non-resin types has served to provide protections for the seed and fiber markets by making it easier for producers to operate, since the resins (the scary cannabinoids, namely d9-THC) were not involved. Today, however, the line in the sand, has been washed away, and “hemp” no longer only refers to non-resin producing varieties of the cannabis plant.
The structure of cannabidiol (CBD), one of 400 active compounds found in cannabis.
As more and more hemp marketplaces come online with varying limits for d9-THC the need for standardization becomes even more pressing. Without standardization, each marketplace will have its own requirements, forcing businesses looking to sell their products in multiple jurisdictions to comply with each region’s mandates and adds a significant level of burden to their operations.
Providing an internationally harmonized definition for hemp is an important first step but allowing the d9-THC limit to vary from jurisdiction to jurisdiction has some unintended (or intended) consequences (#NewReeferMadness). These discrepancies between legal marketplaces will inevitably lead to the establishment of global trade regions; where, if your product cannot meet the definition of “hemp” in that region, then you could effectively be barred from participating in it.
A process which has already started. Harmonizing around 0.3% is great for the US, Canada, and European Union, but what about other stakeholders outside of these markets?
And, at what point does the conflict of hemp from one region with a d9-THC content of 0.3% and hemp from another region with a d9-THC content of 1% being sold into the same market become a problem?
Perhaps a better long-term solution for protecting the market interests of “hemp product” stakeholders would be to establish specifications, such as identity metrics, total cannabinoid content, especially d9-THC, and other quality attributes which have to be verified using test methods for a product to be classified as “hemp”. This system of standards (classifications, specifications, and test methods) would allow for more innovation and make it significantly easier for cannabis raw materials that meet these specifications to find a use rather than being sent to the landfill. Bolstering advancements and opening the door for more market acceptance of the cannabis plant, its parts, and products.
An Alternative Approach to Defining Hemp
Below are some proposed definitions related to common terminology used in the hemp marketplace based on the concept that there are no hemp plants, there are only cannabis plants that can be classified as hemp, and hemp products are simply cannabis products that meet certain specifications to allow them to be classified and represented as hemp.
Hemp, n—commercial name given to a cannabis plant, its parts, and products derived therefrom with a total d9-THC content no more than the maximum allowable limit for the item in question. (Maybe not the best definition, but it makes it clear that not only does the limit for d9-THC vary from jurisdiction to jurisdiction it varies from product type to product type as well.)
Hemp flower, n—commercial name for the inflorescence of a cannabis plant that can be classified as hemp.
Hemp seed, n—commercial name for the seeds of a cannabis plant which are intended to be used to grow another cannabis plant that can be classified as hemp.
Hempseed, n—commercial name for the seeds of a cannabis plant which are intended to be used as food or as an ingredient in food.
Hemp seed oil, n—commercial name for the oils expressed from the seeds of a cannabis plant.
Hemp seed cake, n—commercial name for the solid material byproduct generated during the expression of the oil from the seeds of a cannabis plant.
Hemp flour/meal/dietary-fiber, n—commercial name for the powdered seed cake of a cannabis plant intended to be used as a food or as an ingredient in food with a protein content no more than 35% by weight.
Hemp protein powder, n—commercial name for the powdered seed cake of a cannabis plant intended to be used as a food or as an ingredient in food with a protein content between 35% and 80% by weight.
Hemp protein isolate, n—commercial name for the powdered seed cake of a cannabis plant intended to be used as a food or as an ingredient in food with a protein content above 80% by weight.
Hemp fiber, n—commercial name for the cellulosic-based natural fibers of a cannabis plant.
Hemp shives, n—commercial name for the hurd of a cannabis plant which have been processed to defined specifications.
Hempcrete, n—commercial name for a solid amalgamation of various aggregates and binders, typically comprised of the hurd (shives) of a cannabis plant and lime.
The d9-THC limits for each product were purposefully omitted because these specifications still need to be defined for each product type. Leaving the d9-THC limit up to each authority having jurisdiction, however, is not the answer. It is fine if you comply with a lower d9-THC limit and want to sell into a market with a higher d9-THC limit, but what do you do if you are above the limit for the market you want to sell into? For now, you lose out on potential revenue.
Hemp-derived CBD extract
I am not advocating that everyone starts selling “hemp” as “cannabis,” or vice versa, far from it. I am advocating for a more commonsense and inclusive approach to the marketplace though. One that would allow for the commercialization of materials that would normally be going to waste.
To me it is simply logical. There are no hemp plants, there are only cannabis plants that can be classified as hemp. There are no hemp products, there are only cannabis products that can be classified as hemp. In order for a cannabis product to be marketed, labeled, and sold as a hemp product, i.e. to be classified as a hemp, it would need to meet a set of specifications and be verified using a set of test methods first. But fundamentally the product would be a cannabis product being certified as “hemp”. And that is the shift in thinking that I am trying to get across.
The cannabis plant is an amazing plant and to fully capitalize on the potential of this crop we have to start allowing for the commercialization of cannabis raw materials that are not controlled by the UN Single Conventions, i.e. the seeds, stalks, roots, and leaves when not accompanied by the fruiting tops or the resin glands. Not to do so disenfranchises a significant number of stakeholders from participating in established legal avenues of trade for these goods. A concept proposed and endorsed the ASTM D37 in the published standard D8245-19: Guide for Disposal of Resin-Containing Cannabis Raw Materials and Downstream Products.
If you are stakeholder in the hemp marketplace, you may feel threatened by the idea of the market getting flooded with material, but how are the demands of the so called “green economy” going to be met without access to more supply? Organic hemp seed for food production is scarce but there is plenty of conventional hemp seed for the current demand, but what happens when hempmilk is positioned to displace soymilk in every major grocery store? To feed the growth of the human population and allow for a transition to a truly “green economy,” we need to ensure that the policies that we are putting in place are not excluding those looking to participate in the industry and disenfranchising stakeholders from burgeoning marketplaces, nor alienating a segment of the marketplace simply because their plant cannot be classified as “hemp”.
Cannabis, we have a problem. Legalizing adult use cannabis in California caused the demand for high-potency cannabis to increase dramatically over the last several years. Today, many dispensary buyers enforce THC minimums for the products that they sell. If smokeable flower products don’t have COAs proving the THC levels are above 20% or more, there is a good chance many dispensaries won’t carry them on their shelves. Unfortunately, these kinds of demands only put undue pressure on the industry and mislead the consumer.
Lab Shopping: Where the Problems Lie
Lab shopping for potency analysis isn’t new, but it has become more prevalent with the increasing demand for high-potency flower over the last couple of years. Sadly, many producers submit valid, certified COAs to the California Bureau of Cannabis Control (BCC), which show two to three times the actual potency value.
At InfiniteCAL, we’ve purchased products from dispensary shelves and found significant discrepancies between the analysis we perform and the report submitted to the BCC by the producer. So, how can this happen? Several factors are creating the perfect storm in cannabis testing.
Problems with Potency
Many consumers still don’t understand that THC potency is not the only factor in determining quality cannabis, and they are unwittingly contributing to the demand for testing and analysis fraud. It is alarming for cultivation pioneers and ethical labs to see producers and profit-hungry testing facilities falsifying data to make it more appealing to the unaware consumer.
Basically, what’s happening is growers are contacting labs and asking, “I get 30% THC at this lab; what can you do?” When they see our COA reporting their flower tested lower than anticipated, they will go to another lab to get higher test results. Unfortunately, there are all too many labs that are willing to comply.
I recently saw a compliant COA that claimed that this particular flower was testing at 54% THC. Understanding cannabis genetics, we know this isn’t possible. Another product I reviewed claimed that after diluting an 88% THC distillate with 10-15% terpenes, the final potency test was 92% THC. You cannot cut a product and expect the potency to increase. Finally, a third product we reviewed claimed 98% total cannabinoids (while only looking at seven cannabinoids) with 10% terpenes for a total of 108% of the product.
These labs only make themselves look foolish to professionals, mislead laymen consumers and skirt under the radar of the BCC with basic mathematical errors.
The Pesticide Predicament
Frighteningly, inflating potency numbers isn’t the most nefarious testing fraud happening in the cannabis industry. If a manufacturer has 1000 liters of cannabis oil fail pesticide testing, they could lose millions of dollars – or have it retested by a less scrupulous lab.
Photo: Michelle Tribe, Flickr
As the industry continues to expand and new labs pop up left and right, cultivators and manufacturers have learned which labs are “easy graders” and which ones aren’t. Certain labs can miss up to ten times the action level of a pesticide and still report it as non-detectable. So, if the producer fails for a pesticide at one lab, they know four others won’t see it.
In fact, I’ve had labs send my clients promotional materials guaranteeing compliant lab results without ever receiving a sample for testing. So now, these companies aren’t just tricking the consumer; they are potentially harming them.
An Easy Fix
Cannabis testing is missing just one critical factor that could quickly fix these problems – checks and balances. The BCC only needs to do one of two things:
Verifying Lab Accuracy
InfiniteCAL also operates in Michigan, where the Marijuana Regulatory Agency (MRA) has already implemented a system to ensure labs are maintaining the highest testing standards. The MRA will automatically flag all COAs which test above a certain percentage and require the product to be retested by multiple labs.
Labs are required to keep a back stock of material. So, when test results come back abnormally high from Lab A, then Labs B, C and D are commissioned to retest the material to compare data. If Lab A reports 40% THC, but the other labs all report 18%, then it’s easy to see Lab A has made an error.
Secret Shopping
By simply buying products off the shelves and having them blind-tested by other labs, it would be simple for the BCC to determine if the existing COA is correct. They already have all the data in Metrc, so this would be a quick and easy fix that could potentially solve the problem overnight.
For example, at InfiniteCAL, we once purchased 30 samples of Blue Dream flower from different cultivators ranging in certified COA potencies from 16% to 38%. Genetically, we know the Blue Dream cultivar doesn’t produce high levels of THC. When we tested the samples we purchased, nearly every sample came back in the mid-teens to low 20% range.
Labs Aren’t Supposed to Be Profit Centers
At InfiniteCAL, we’ve contacted labs in California where we’ve uncovered discrepancies to help find and flush out the errors in testing. All too often, we hear the excuses:
“If I fix my problem, I’ll lose my clients.”
“I’m just a businessman who owns a lab; I don’t know chemistry.”
“My chemist messed up; it’s their fault!”
If you own a lab, you are responsible for quality control. We are not here to get rich; we are here to act as public safety agents who ensure these products are safe for the consumer and provide detailed information about what they choose to put in their bodies. Be professional, and remember you’re testing for the consumer, not the producer.
With data forecasting expert BDSA predicting that the global cannabis market will reach $56B by 2026, there is no time to waste. Whether it’s Oklahoma, New York or even Macedonia, the frenzy is on. Investment decisions are immediate, and you have to be correct out of the box. This is where an expert like Andrew Lange and his company, Ascendant Management, come in. Andrew has designed more than 1.5 million square feet of cannabis facilities and moved them into profitable production in North America and Europe. One of his active customers is Onyx Agronomics in Washington. Bailee Syrek is the director of operations at Onyx and this is the story of the key points in designing a precision cannabis facility with state-of-the-art efficiency.
Background
Andrew Lange, a navy veteran, runs a global cannabis consulting business based in Washington. With a “prove it to me” approach, he regularly tests the best new technologies in the facilities he designs. He integrates his knowledge of what works in practice into his subsequent facilities. One of his previous projects, Onyx Agronomics in Washington, started in 2014 and moved quickly into production in a retrofitted warehouse. Many of his best ideas started with Onyx, including some new innovations in the latest expansion there this month. Onyx is a tier 3 cannabis cultivator.
Bailee Syrek’s operation at Onyx currently produces 9,000 lbs. of dry trim bud per year in 8,000 square feet of canopy. She operates the state-of-the-art, clean room style, indoor grow facility around the clock, delivering 2.7 grams/watt from every square foot of canopy in her building. She runs a highly efficient facility.
Onyx has had an ongoing relationship with Ascendant Management and chose to leverage them again with their current expansion to increase their capacity further. Onyx uses a range of advanced technologies including aeroponic cultivation equipment and control software from AEssenseGrows to hit their metrics.
Precision, Quality & Consistency
“I look for ways that my clients can differentiate themselves,” says Lange. Maybe it’s his military background, but Andrew demands precision, quality and consistency in the operations he designs. “Cannabis is a just a plant really so we look for the highest performance grow methodology. I find that to be AEssenseGrows aeroponics,” says Lange. “The AEtrium Systems provides a good foundation to manipulate for grow recipes and business process. I add teamwork, communications, and operations procedures to that foundation.”
At Onyx, Bailee Syrek works closely with her channels. She invites her customers in regularly to review the Onyx cultivars and to cover their ideal requirements. These can range from bud size for their packaging to THC or terpene profiles (Yes, channels do want both higher and lower THC content for different consumers and price points). Based on that feedback, Bailee and Andrew work together to dial in the ideal grow recipe in the AEssenseGrows Guardian Grow Manager central control software. They push their target strains to optimize the results in the direction requested by their customers. For example, “How do you get the highest possible THC out of 9lb Hammer?” You’ll have to ask Andrew and Ascendant Management.
Driven by customer requests, Onyx is adding new strains to build on their innovative brand. Bailee expects to reach new levels of terpene bundles with Cheeseburger Jones, Koffee Breath, Shangri-La and OK Boomer. Utilizing Andrew’s expert knowledge, they can take typical sub-20% cannabinoid bundles and improve them using aeroponics and better controls, into standout aeroponic 30% packages.
The Onyx Vision
Andrew Lange, Ascendant Management
Bailee Syrek believes this is the most exciting time yet for Onyx. Delivering premium grade cannabis as a white label flower supplier for years, Onyx is a profitable and successful business. But even with doubling capacity every year, they are still having trouble keeping up with customer demand. Bailee wants to get to the point where she can always say yes and accept an order from their white label customers. With this objective, she again engaged Ascendant and Andrew to get beyond 15,000 lbs. of output in 2021 to make her customers happier. Beyond that basic expansion, she is also ambitious and is preparing plans for additional lines of revenue with their own proprietary flower, oil and derivative products.
“This expansion will be a new challenge,” says Syrek. “Flower production is in our wheelhouse. We have tighter operations, with the most consistent bud size, terpenes and test results in our state. These new products will require that same quality but now in new areas.”
Her Path to Leadership
Bailee started with Onyx in a compliance position that grew out of the constant demands for government licensing and reporting. In that compliance role, she had the opportunity to work a bit in every department, giving her a good understanding of all of the facility operations and workflows. All of that experience led her to eventually take over the operations leadership role. She instills care and effort to maintain the cleanest and most efficient operations possible. “With aeroponics, we don’t have to lug soil from room to room or in and out of the facility. This saves us a ton of work that we can redirect to plant health and maintenance,” says Syrek. “Medical precision and GMP quality is a given. Each room on average is 105 lights and one room manager and one cultivation technician take the room from clone/veg transfer to harvest as a two-person team.”
Bailee Syrek, director of operations at Onyx Agronomics
Bailee prides herself with results. “Medical grade precision is normal for us. We use medical grade SOPs for every aspect of our production.” Bailee has designed these guides into their control system that runs on the Guardian Grow Manager software. From sensor tracking, to performance graphs to time cards; everything is integrated in her performance monitoring.
A quality focus is very apparent in every Onyx flower room. Every watt of light energy is transferred to the pristinely manicured canopy. Naked stems feed nutrients up to the fat buds at the trained canopy surface. Fan leaves are removed and all possible energy turns into bud weight and potency. The room technician has a passion for plant health, table care and plant maintenance all the way through to the harvest bonanza.
What is the biggest challenge for Bailee as she drives the operation? Even at 105-110 grams per square foot per harvest, they are sold out. “Every customer wants to buy beyond our capacity. It is a good problem to have,” Bailee says. “Customers want our quality and love the consistency. This is the most exciting thing about our expansion. We will finally be able to make additional channels happy with high quality supply.”
This is where Andrew credits Onyx’s performance. “Most well running operations deliver 1.1-1.8 grams of dry trim bud per watt of electricity used in powering a grow room,” says Andrew. The Onyx grow formula results leave this in the dust. Running Fluence SPYDR 2i grow lights and the AEtrium System aeroponics, Onyx plants are delivering just shy of 4 lbs. per light with every harvest cycle. At 630 watts max output, that delivers ~2.7 grams/Watt, the most efficient operation he has seen. The Onyx process and execution works.
“Bailee is a great example as a professional. She builds a motivated team that executes better than her competition,” says Andrew.
At the same time, Onyx runs a highly space efficient nursery with just enough mother plants feeding energetic cuttings into the 4-layer stacked AEtrium-2.1 SmartFarms in their environmentally controlled clone room. They produce more than enough healthy clones to jump from veg to flower in the span of a week. Grow time, harvest turn time and no veg space, results in very efficient use of power in the complete operation.
Mirroring Onyx for Medical Grade Cannabis in Europe
Andrew Lange’s current passion is a green-field project in Portugal. Self-funded, Andrew says that this facility will be one of the first that is pure enough in operations to supply non-irradiated clean-room-level-quality cannabis beyond the precise standards required by European regulators. Current importers have not been able to clear the European standards for cleanliness without irradiating their buds. Other companies like Aurora have abandoned efforts to access the market due to the precision requirements. Typical methods used for fruit imports use gamma radiation to get bacterial counts down. This was tried with cannabis to sterilize buds, but the problem with cannabis is this degrades the quality of the flower.
Andrew’s Portugal facility will be using a sterile perimeter surrounding his grow space (mothers, clones/veg, flower rooms) and harvest and processing areas (dry, trim, packaging). Andrew creates a safe environment for healthy production. A steady harvest cleaning regimen is built into his operational designs from the beginning. All operators are trained in procedures to exclude pathogens and limit all possible transmission (airborne, physical/mechanical touching, or water carried). Every area is cleaned during and between harvests. Andrew is confident he will reach a consistent level of accuracy and purity beyond European requirements because it is routine in all of his designs.
Certified Efficiency is the Message
Good Manufacturing Practices (GMP) and Good Agricultural and Collection Practices (GACP) are required for certification and access to European markets. Andrew always builds tight operations, but in this case, his Portugal facility is designed with the fit and finish to be GMP and GACP compliant from day one with advanced air filtration and air management throughout.
Automated aeroponics is a foundation technology that Andrew recommends for his facility designs. The automatic data logging, report generation, cloud access and storage make this a foundational technology. Andrew does get some resistance from cultivators that are used to the classic soil media approaches but he explains that software configurable grow recipes, precision controls, zero soil/no pests and hyper-fast growth makes aeroponics the foundation of competitive advantage. Precisely controlled medical quality precision operations are built on top of this foundation.
The initial phase of the Portugal facility is 630 lights and this facility is Andrew’s latest personal investment. From secure perimeters to modular grow rooms and highly automated equipment, this location will be state-of-the-art in terms of grams/watt yields and renewable energy with an output of 6 metric tons per year. Solar powered electricity from a 4-megawatt farm will use Tesla megapacks for storage and be grid independent.
Technology & Innovation, Onyx & Ascendant
From his first experience with AEssenseGrows aeroponics, Andrew has been able to design complete grow recipes in the Guardian Grow Manager software with very tight precision on dosage. This makes it possible to create ideal recipes for each strain (nutrition, irrigation cycles, lighting and environmental management). This frees up the operations teams to focus on plant health and execution. The nutrients, pH, CO2, temperature and humidity, follow the Guardian directions that he sets.
Working with Bailee at Onyx, Andrew is now consulting on the post-harvesting side of operations (drying, trimming, extracts and packaging). In parallel with his efforts, Bailee is optimizing THC & terpene production on the cultivation side with UV lighting (considering far-right red frequency light recipe enhancements).
That is the Ascendant Management approach to innovation. Trial, test constantly, perfect ideas in practice. Optimize the results for consistent, high-quality results. Even while driving for the personal craft touch, use automation to increase efficiency of mundane, but important tasks. With these methods, Andrew believes that the Onyx labor cost is one third of typical soil media grow operations. Zero soil aeroponics offers many benefits. Bailee’s team is able to give each plant more attention and delivery better quality. Automation is a win-win for them.
Bailee finds that constant testing is useful for two things: one, great results, and two, surface the best talent with their hand’s-on approach.
Always Finish with People
Bailee says that her staff works incredibly hard. “We are a different grow, with better ergonomics on the job, aeroponics for precision and yields, and advanced technology at the leading edge in every part of our grow. No dirt up and down stairs. People are proud to work here. We are not your dad’s grow operation.”
“We promote from within. Everyone starts as a room tech and has the opportunity to move up. Teams are isolated by rooms so there is no contamination between rooms or humans. Put in the work, and you will get promoted with expansions, and grow with the company as we take a bigger share in the market.” Female employees make up almost half of the current staff, and Bailee encourages employees to refer their friends. “Good people invite good people,” she says.
Her training program introduces the technical aspects of their unique operation, the positive expectations and career path for every new employee. The social environment is friendly with good pay and regular raises. Each new employee fills a range of roles during their 1-month training circuit and are assigned to a cultivation space under a lead as an official cultivation tech at the end of 30 days. “One thing that we do more than at other grows is constant cleaning,” says Bailee. “This is an ever-present mantra for the staff.”
The cannabis industry’s advancement towards legalization continues to dominate national headlines, from the stance of incoming Attorney General Merrick Garland to deprioritize enforcement of low-level cannabis crimes, Senate Majority Leader Chuck Schumer’s continued advocacy, to the recent passing of legislation in New York, New Mexico and Virginia (the first in the South) to authorize adult-use cannabis. While these updates are likely to intrigue customers and investors alike, they are also sure to draw the attention of cyber criminals who could look at the relative youth of the industry, as well as its rapid growth, as a prime target of opportunity for nefarious acts.
In order to understand risk mitigation best practices across a wide spectrum of private sector industries, this article will first identify the current security environment in order to understand the threats, briefly highlight specific case studies and assess the risks and identify methods that individual organizations, as well as the cannabis industry as a whole, can take action to enhance security and preparedness and to develop resiliency against future attacks.
Understanding the Threats
For an industry that has operated in a largely cash-based system for much of its existence, the idea of security is not foreign. Typically, these concerns focused on physical security implementation. The topic has received plenty of coverage, including a recent article in this journal articulating Important Security Considerations When Designing Cannabis Facilities. While an audit of physical security measures is a valuable part to any all-hazards threat assessment, securing a growing online network – from email to online finances to connected devices within cannabis facilities – can pose more unfamiliar challenges. When consulted for this article, Patten Wood, a former VP of marketing for a prominent west-coast cannabis retail brand noted: “While the topic of cybersecurity is critically important to customers, businesses, and the industry at large, it isn’t top of mind for many of the cannabis companies that I’ve experienced.” Understanding what risks are present is the first step to mitigating them, so we must first discuss several common cyber threats for the cannabis industry.
Phishing: Phishing happens when cybercriminals impersonate a trusted individual or entity, typically through email. The goal in this instance is to get the target to share confidential information or download software that can allow unauthorized access into an organization’s network. Phishing is one of the most common types of cyberattacks as it is relatively easy to conduct and surprisingly effective.
Ransomware Attacks: Ransomware attacks are used to gain access to a computer network and then lock and encrypt either the entire system or certain sets of high-value files, which can compromise important business information, and impact client and vendor privacy. A ransom is then demanded for restoring access, but paying the ransom comes with its own risk as it doesn’t guarantee the files will be restored.
Cyber Extortion: Similar to ransomware attacks in their design, cyber extortion typically deals with a threat of leaking personal information and will generally demand payment in cryptocurrency in order to maintain their anonymity.
Lumu: 2020 Ransomware Flashcard
Remote Access Threats: As 2020 has forced organizations to rethink how they conduct business and shift to more remote operations than they had in the past, it can open up several new threats. According to a survey by IT social network SpiceWorks.com, six out of every ten organizations allow their employees to connect their company-issued devices to public Wi-Fi networks. Utilizing unsecured Wi-Fi networks opens the user up to man-in-the-middle attacks, allowing hackers to intercept company data. Unsecure Wi-Fi also brings the threat of malware distribution. An additional consideration with remote workers is the uptick in cyber attacks against remote access software referred to as remote desktop protocol (RDP) attacks. According to Atlas VPN, RDP attacks skyrocketed 241% in 2020 and we’ve seen numerous RDP attacks against critical infrastructure throughout the pandemic and across all industries.
Internet of Things (IoT) Leaks: With IoT devices running everything from security systems to automated growing operations, the convenience has been a huge boost for the industry. Unfortunately, many IoT devices don’t have sophisticated built-in security. Another common problem is the tendency of users to keep default passwords upon installation, which can make devices easy for cyber criminals to access. Once they are inside the system, malware can easily be installed, and the actors can move laterally throughout the network.
Personal and Medical Record Security: Many cyberattacks expose some level of personal data, whether that be customer, employee or vendor information. An extra consideration for retail operations that either treat medical patients, or medical and adult-use customers, is the additional information they must store about their clients. Medical facilities will maintain protected health information (PHI), which are much more valuable on the dark web than personally identifiable information (PII). But even adult use facilities may keep government-issued ID or other additional information above that of a typical retailer, which makes the potential value of their information much more intriguing for a cybercriminal.
Assessing the Risks
Depending on where your organization lies in the seed to sale chain, you will have different levels of risk for various types of attacks. We briefly discussed ransomware attacks earlier. Ransoms can range widely depending on the size of the organization that is attacked, but the ransom alone isn’t the only risk consideration. Businesses must also factor in the cost of downtime (an average of 18 days in 2020) caused by the ransomware when evaluating the impact to business operations, as well as reputation. While small – medium businesses are absolutely at risk, especially given their relative lack of cybersecurity resources and sophistication, a recent trend involves “Big Game Hunting” where cybercriminals are targeting larger organizations with the potential for bigger paydays. Criminals understand that big business can rarely afford major delays, and may be more able and willing to pay, and pay big, for a return to normal operations.
Group-IB: Ransomware Uncovered
Below are several examples of attacks which have either directly impacted the cannabis industry, or have valuable lessons the industry can learn from.
GrowDiaries: In October 2020 researcher Bob Diachenko discovered that 3.4 million records including passwords, posts, emails and IP addresses were exposed after two open-source application Kibana apps were left exposed online. As a platform for cannabis growers around the world (who are not all growing legally), this type of exposure puts the community at great risk, and can lower user confidence in the product, as well as putting them at personal risk of harm or legal ramifications. The applications being left open is a prime example of either a lack of good cybersecurity policies, or not following through on those policies.
Aurora Cannabis: On December 25th, 2020 Canadian company Aurora Cannabis suffered a data breach when SharePoint and OneDrive were illegally accessed. Included in the data that was compromised was credit card information, government identification, home addresses and banking details. The access point coming through Microsoft cloud software is a prime example of some of the challenges facing businesses who have an increasingly remote workforce yet still need that workforce to access critical (and usually highly sensitive) information.
THSuite: A database owned by seed to sale Point-Of-Sale (POS) software provider THSuite was discovered by researchers in December 2019. The database contained PHI/PII for 30,000 people, with over 85,000 files being exposed. The information that was left accessible included scanned government IDs, personal contact information and medical ID numbers. Clearly this gets into HIPAA territory, which can result in fines of up to $50,000 for every exposed record.
Door Dash: As cannabis delivery apps become more prevalent, it’s good to reference how similar businesses in other industries have been targeted. In May of 2019 nearly 5 million user records were accessed by an unauthorized third party, exposing PII and partial payment card information.
Taking Action
On an organizational level, employee training, password hygiene and malware protection are some of the basic and most important steps that should be taken by all organizations. But, if “knowledge is power,” the best defense for any organization against cyber threats is a well-informed organization- including leadership down to the front-line employees. Excellent tools to assist in this are Information Sharing & Analysis Centers/Organizations (ISACs/ISAOs). ISACs were established under a presidential directive in 1998 to enable critical infrastructure owners and operators to share cyber threat information and best practices. The National Council of ISACs currently has over 20 member ISACs including Real Estate, Water, Automotive and Energy. ISAOs were created by a 2015 executive order to encourage cyber threat information sharing within private industry sectors that fall outside of those listed as “critical infrastructure”. Christy Coffey, vice president of operations at the Maritime and Port Security ISAO (MPS-ISAO) says information sharing enabled by the executive order is critical. “We need to accelerate private sector information sharing, and I believe that the ISAO is the vehicle.”
According to Michael Echols, CEO of the International Association of Certified ISAO’s (IACI) at the Kennedy Space Center, security experts have long understood that threat information sharing can allow for better situational awareness and help organizations better identify common threats and ways to address them. “On the other side, hackers in a very documented way are already teaming up and sharing information on new approaches and opportunities to bring more value (to their efforts).” The ongoing crisis surrounding the Microsoft Exchange Server Vulnerability demonstrates that different cybercriminal groups will work simultaneously to abuse system flaws. As of March 5th it was reported that at least 30,000 organizations in the U.S. – and hundreds of thousands worldwide – have backdoors installed which makes them vulnerable to future attacks, including ransomware.
Below are several links to recent products that have been shared by various ISACs/ISAOs, which are provided as an example of the type of information that is commonly shared via these organizations.
If organizations are interested in learning more about enhancing their cybersecurity resiliency through private-sector led information sharing, please reach out to the newly formed Cannabis ISAO at ben@cannabisisao.org
What is the role of the Quality Control (QC) Laboratory?
The Quality Control (QC) laboratory serves as one of the most critical functions in consumer product manufacturing. The QC laboratory has the final say on product release based on adherence to established product specifications. Specifications establish a set of criteria to which a product should conform to be considered acceptable for its intended use. Specifications are proposed, justified and approved as part of an overall strategy to ensure the quality, safety, and consistency of consumer products. Subsequently, the quality of consumer products is determined by design, development, Good Manufacturing Practice (GMP) controls, product and process validations, and the specifications applied throughout product development and manufacturing. These specifications are specifically the validated test methods and procedures and the established acceptance criteria for product release and throughout shelf life/stability studies.
The Code of Federal Regulations, 21 CFR Part 211, Good Manufacturing Practice for Finished Pharmaceuticals, provides the minimum requirements for the manufacture of safe products that are consumed by humans or animals. More specifically, 21 CFR Part 211: Subpart I-Laboratory Controls, outlines the requirements and expectations for the quality control laboratory and drug product testing. Additionally, 21 CFR Part 117, Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food: Subpart B-Processes and Controls states that appropriate QC operations must be implemented to ensure food products are safe for consumption and food packing materials and components are safe and fit for purpose. Both food and drug products must be tested against established specifications to verify quality and safety, and laboratory operations must have the appropriate processes and procedures to support and defend testing results.
ISO/IEC 17025, General Requirements for the Competence of Testing and Calibration Laboratories is used to develop and implement laboratory management systems. Originally known as ISO/IEC Guide 25, first released in 1978, ISO/IEC 17025 was created with the belief that “third party certification systems [for laboratories] should, to the extent possible, be based on internationally agreed standards and procedures”7. National accreditation bodies are responsible for accrediting laboratories to ISO/IEC 17025. Accreditation bodies are responsible for assessing the quality system and technical aspects of a laboratory’s Quality Management System (QMS) to determine compliance to the requirements of ISO/IEC 17025. ISO/IEC 17025 accreditation is pursued by many laboratories as a way to set them apart from competitors. In some cannabis markets accreditation to the standard is mandatory.
The approach to ISO/IEC 17025 accreditation is typically summarizing the standard requirements through the use of a checklist. Documentation is requested and reviewed to determine if what is provided satisfies the item listed on the checklist, which correlate directly to the requirements of the standard. ISO/IEC 17025 covers the requirements for both testing and calibration laboratories. Due to the wide range of testing laboratories, the standard cannot and should not be overly specific on how a laboratory would meet defined requirements. The objective of any laboratory seeking accreditation is to demonstrate they have an established QMS. Equally as critical, for product testing laboratories in particular, is the objective to establish GxP, “good practices”, to ensure test methods and laboratory operations verify product safety and quality. ISO/IEC 17025 provides the baseline, but compliance to Good Laboratory Practice (GLP), Good Manufacturing Practice (GMP) and even Good Safety Practices (GSP) are essential for cannabis testing laboratories to be successful and demonstrate testing data is reliable and accurate.
Where ISO/IEC 17025 accreditation falls short
Adherence to ISO/IEC 17025, and subsequently receiving accreditation, is an excellent way to ensure laboratories have put forth the effort to establish a QMS. However, for product testing laboratories specifically there are a number of “gaps” within the standard and the accreditation process. Below are my “Top Five” that I believe have the greatest impact on a cannabis testing laboratory’s ability to maintain compliance and consistency, verify data integrity and robust testing methods, and ensure the safety of laboratory personnel.
Standard Operating Procedures (SOPs)
The understanding of what qualifies as a Standard Operating Procedure (SOP) is often misunderstood by cannabis operators. An SOP is a stand-alone set of step-by-step instructions which allow workers to consistently carry out routine operations, and documented training on SOPs confirms an employee’s comprehension of their job tasks. Although not required per the current version of the standard, many laboratories develop a Quality Manual (QM). A QM defines an organization’s Quality Policy, Quality Objectives, QMS, and the procedures which support the QMS. It is not an uncommon practice for cannabis laboratories to use the QM as the repository for their “procedures”. The intent of a QM is to be a high-level operations policy document. The QM is NOT a step-by-step procedure, or at least it shouldn’t be.
Test Method Transfer (TMT)
Some cannabis laboratories develop their own test methods, but a common practice in many cannabis laboratories is to purchase equipment from vendors that provide “validated” test methods. Laboratories purchase equipment, install equipment with pre-loaded methods and jump in to testing products. There is no formal verification (what is known as a Test Method Transfer (TMT)) by the laboratory to demonstrate the method validated by the vendor on the vendor’s equipment, with the vendor’s technicians, using the vendor’s standards and reagents, performs the same and generates “valid” results when the method is run on their own equipment, with their own technician(s), and using their own standards and reagents. When discrepancies or variances in results are identified (most likely the result of an inadequate TMT), changes to test methods may be made with no justification or data to support the change, and the subsequent method becomes the “validated” method used for final release testing. The standard requires the laboratory to utilize “validated” methods. Most laboratories can easily provide documentation to meet that requirement. However, there is no verification that the process of either validating in house methods or transferring methods from a vendor were developed using any standard guidance on test method validation to confirm the methods are accurate, precise, robust and repeatable. Subsequently, there is no requirement to define, document, and justify changes to test methods. These requirements are mentioned in ISO/IEC 17025, Step 7.2.2, Validation of Methods, but they are written as “Notes” and not as actual necessities for accreditation acceptance.
Change Control
The standard speaks to identifying “changes” in documents and authorizing changes made to software but the standard, and subsequently the accreditation criteria, is loose on the requirement of a Change Control process and procedure as part of the QMS. The laboratory is not offered any clear instruction of how to manage change control, including specific requirements for making changes to procedures and/or test methods, documented justification of those changes, and the identification of individuals authorized to approve those changes.
Out of Specification (OOS) results
The documentation and management of Out of Specification (OOS) testing results is perhaps one of the most critical liabilities witnessed for cannabis testing laboratories. The standard requires a procedure for “Nonconforming Work”. There is no mention of requiring a root cause investigation, no requirement to document actions, and most importantly there is no requirement to document a retesting plan, including justification for retesting. “Testing into compliance”, as this practice is commonly referred to, was ruled unacceptable by the FDA in the highly publicized 1993 court case United States vs. Barr Laboratories.
Laboratory Safety
Safe laboratory practices are not addressed at all in ISO/IEC 17025. A “Culture of Safety” (as defined by the Occupational Safety and Health Administration (OSHA)) is lacking in most cannabis laboratories. Policies and procedures should be established to define required Personal Protective Equipment (PPE), the safe handling of hazardous materials and spills, and a posted evacuation plan in the event of an emergency. Gas chromatography (GC) is a common test method utilized in an analytical testing laboratory. GC instrumentation requires the use of compressed gas which is commonly supplied in gas cylinders. Proper handling, operation and storage of gas cylinders must be defined. A Preventative Maintenance (PM) schedule should be established for eye wash stations, safety showers and fire extinguishers. Finally, Safety Data Sheets (SDSs) should be printed and maintained as reference for laboratory personnel.
ISO/IEC 17025 accreditation provides an added level of trust, respect and confidence in the eyes of regulators and consumers. However, the current process of accreditation misses the mark on the establishment of GxP, “good practices” into laboratory operations. Based on my experience, there has been some leniency given to cannabis testing laboratories seeking accreditation as they are “new” to standards implementation. In my opinion, this is doing cannabis testing laboratories a disservice and setting them up for failure on future accreditations and potential regulatory inspections. It is essential to provide cannabis testing laboratory owners and operators the proper guidance from the beginning and hold them up to the same rigor and scrutiny as other consumer product testing laboratories. Setting the precedence up front drives uniformity, compliance and standardization into an industry that desperately needs it.
References:
21 Code of Federal Regulations (CFR) Part 211- Good Manufacturing Practice for Finished Pharmaceuticals.
21 Code of Federal Regulations (CFR) Part 117;Current Good Manufacturing Practice, Hazard Analysis, and Risk-Based Preventative Controls for Human Food: Subpart B-Processes and Controls.
ICH Q7 Good Manufacturing Practice Guidance for Active Pharmaceutical Ingredients; Laboratory Controls.
World Health Organization (WHO).
International Building Code (IBC).
International Fire Code (IFC).
National Fire Protection Association (NFPA).
Occupational Safety and Health Administration; Laboratories.
ASTM D8244-21; Standard Guide for Analytical Operations Supporting the Cannabis/Hemp Industry.
This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.
Strictly Necessary Cookies
Strictly Necessary Cookie should be enabled at all times so that we can save your preferences for cookie settings.
We use tracking pixels that set your arrival time at our website, this is used as part of our anti-spam and security measures. Disabling this tracking pixel would disable some of our security measures, and is therefore considered necessary for the safe operation of the website. This tracking pixel is cleared from your system when you delete files in your history.
We also use cookies to store your preferences regarding the setting of 3rd Party Cookies.
If you disable this cookie, we will not be able to save your preferences. This means that every time you visit this website you will need to enable or disable cookies again.
