Controlled Substances Security Manual
General Security Requirements
The general security requirements set forth in the Code of Federal Regulations (CFR) require all registrants and applicants for registration to provide effective physical security controls and operating procedures to guard against theft and diversion of controlled substances. Substantial compliance with these requirements and standards set forth in Title 21 CFR Sections 1301.72-1301.76 may be deemed sufficient by DEA after evaluation of the overall security system and needs of the individual applicant or registrant considering the following factors:
- Type of activity conducted (e.g., processing of bulk chemicals, preparing dosage forms, packaging, labelling, cooperative buying, etc.).
- Type and form of controlled substances (e.g., bulk liquids or dosage units, usable powders or non-usable powders, etc.).
- Quantity of controlled substances.
- Location of premises/security needs (e.g., high vs. low crime areas, waterfront boundaries, adjacent/attached buildings, urban vs. suburban vs. rural areas, etc.).
- Type of building construction/general characteristics (e.g., metal curtain, wood frame, masonry, number and type of doors, windows and other openings, etc.).
- Types of safes/vaults/secure enclosures (e.g., automatic storage and retrieval, construction of vaults and cages, modular vaults, container weight and type, Underwriters Lab listing/General Services Administration rating, etc.).
- Type of closure (e.g., built-in combination locks, key locks, padlocks, self closing and locking day gates, vault doors and frames, etc.).
- Key and lock control (e.g., adequacy, accountability, routine changing, issuance and control procedures, logging, central repository, combination security, etc.).
- Alarm systems (e.g., adequacy of supervision, method of signal transmission, proprietary vs. central station vs. police connection, adequacy of standby power sources, maintenance and testing, signal and response time, etc.).
- Public access/perimeter fencing (e.g., adequacy of gates and fencing, if any, control at entry/exit points, parking location and proximity to facility, extent of unsupervised public access to the facility, etc.).
- Supervision of employees (e.g., access control to manufacturing and storage areas, identification media and systems, control of and accountability for identification, responsibilities of employees, etc.).
- Guest/visitor procedures (e.g., access control, logging procedures, identification media, internal movement control, etc.).
- Local police/security force (e.g., availability, legal obligation to respond, frequency of patrol, adequacy of training, alarm response time, size of force, etc.).
- Adequacy of internal systems for monitoring controlled substances (e.g., storage security, common or contract carrier security, etc.).
Any applicant or registrant who wants to know whether or not a proposed security system substantially complies with DEA requirements as prescribed by the regulations may submit plans, blueprints or sketches of the proposed system to the appropriate DEA Field Office. Even with preliminary Field Office approval of the proposed system, final approval will only be given at the time the system is completed and can be inspected at the location where it is to be used.
Physical security controls at locations registered and approved under the former Harrison Narcotic Act (HNA) or the former Narcotic Manufacturing Act (NMA) of 1960 as of April 30, 1971, are considered to be in compliance with present security regulations. However, new or modified facilities or work and storage areas which have not previously been approved by DEA (even if these facilities are similar to those previously approved by the Bureau of Narcotics and Dangerous Drugs) will not necessarily be deemed in compliance with the security regulations. Furthermore, any change in ownership or control after April 30, 1971 of locations registered and approved under the former HNA or the former NMA would negate this waiver.
It is important to note that physical security controls and procedures must be expanded and extended accordingly if existing systems become inadequate as a result of a controlled substance being transferred to a different schedule, being placed in a schedule, or if there is a significant increase in the quantity of controlled substances in the possession of a registrant during normal business operations.