IT for New Mexico Cannabis Businesses: Track and Trace, POS, Cameras, and Compliance

A cannabis business in New Mexico is a retailer, a regulated manufacturer, and a reporting entity at the same time, and all three depend on systems that most other small businesses do not run. The point of sale has to talk to the state tracking system. Inventory has to reconcile every night. Cameras have to record and retain. Banking is harder than it is for everyone else. This article covers the technology obligations that come with a Cannabis Control Division license, where operators most often run into trouble, and what a managed IT arrangement should cover for a dispensary, grower, or manufacturer.

The systems a licensee is required to run

New Mexico’s Cannabis Regulation Act (2021) put licensing under the Cannabis Control Division of the Regulation and Licensing Department. The Division’s rules (Title 16, Chapter 8 of the New Mexico Administrative Code) set requirements that are, in practice, IT requirements.

• Track and trace. Every licensee must record cannabis activity in the state’s track-and-trace system (New Mexico uses BioTrack). Under 16.8.7 NMAC, licensees must reconcile all on-premises and in-transit cannabis each day by 11:59 p.m., synchronize the system before closing a session, keep a current list of authorized users, train staff before giving them access, and remove accounts promptly when someone leaves. Each person must log activity only under their own unique account. Shared logins are a rule violation, not just a bad habit.
• Point of sale and inventory software. Licensees may use their own POS and inventory tools alongside the state system, and almost all do. Those tools have to integrate with track and trace reliably, which means the network, the integration credentials, and the hardware all become compliance components.
• Security and surveillance. The Division’s security rules require video surveillance of licensed premises with footage retained for a set period and available to the Division on request. Camera storage that fills up or a recorder that silently fails is a licensing problem.
• Records. Licensees must keep business and inventory records available for inspection. Where those records live, who can change them, and whether they are backed up all matter at inspection time.
• Patient and customer data. Medical cannabis patient information is confidential under New Mexico law, and any customer data a dispensary collects, such as ID scans or loyalty program details, falls under the state Data Breach Notification Act. Most dispensaries are not HIPAA covered entities, but they still have a legal duty to protect the data and to notify if it is exposed.

Where cannabis operators get into trouble

• The nightly reconciliation fails because the integration broke. A POS update, an expired API credential, or an internet outage at closing time, and the 11:59 p.m. deadline is missed. Operators find out when the numbers do not match the next morning.
• Shared budtender logins. Fast onboarding and high turnover lead to one login used by several people. It violates the unique-account rule, and it makes diversion impossible to investigate because the audit trail is meaningless.
• Departed staff keep access. Removing a former employee from BioTrack, the POS, the cameras, and the alarm system is four separate tasks. If nobody owns the list, one of them is missed.
• Camera retention lapses. Recorders fill up, a camera goes offline, or the footage is only on one drive with no copy. The Division asks for footage from a specific date and it is not there.
• Single internet connection. Many dispensaries run on one consumer-grade connection. When it drops, sales stop and the state system cannot be updated. A cellular backup path that fails over automatically is inexpensive insurance.
• No power protection on the POS. A brief outage reboots registers mid-transaction and can corrupt the local inventory database. Our guide to what a UPS is and how long it should run covers sizing.
• Backups that do not include the POS database or the camera system. Cloud POS vendors back up their side, but local databases, integration configurations, and surveillance footage are the operator’s responsibility.
• Cash-heavy operations and fraud. Limited banking access means more cash, more manual processes, and more exposure to employee fraud and business email compromise aimed at vendors and payroll.

What managed IT should cover for a cannabis business

Managed IT means a provider is responsible for keeping your systems running, secure, and documented for a flat monthly fee, instead of being called after a failure. For a licensee, the scope should include the following.

What it costs

Our pricing is flat per user per month and published on the managed IT packages page. A dispensary with eight staff on Total Advantage plus Secure Advantage, which is $125 per user, would pay $1,000 per month for unlimited support and the full security layer. Network hardware, cameras, and failover connections are one-time or carrier costs on top, scoped per location.

How Corporate Technologies works with New Mexico licensees

We support businesses across the state from our Rio Rancho office, with a 24/7 help desk and security operations center shared across our 21 locations. We work alongside your POS and track-and-trace vendors rather than replacing them, and we treat the Division’s rules as part of the system design. If you want a quick view of where your systems stand, the network health check takes about three minutes.

This article describes regulatory requirements in general terms. Confirm specifics against the current 16.8 NMAC rules and your license conditions, or with your compliance counsel.

Frequently asked questions

Can you support BioTrack and our POS directly?

We support the environment they run in: the network, the devices, the credentials, the integration health, and the backups. Application defects are handled with the vendor, and we manage that process so you are not stuck between two support desks.

Do we need separate networks for POS and cameras?

Yes. Segmenting POS, surveillance, guest Wi-Fi, and office traffic limits the damage from any single compromised device and keeps a guest’s phone off the same network as your registers. It is standard practice and inexpensive to do during setup.

Does HIPAA apply to a dispensary?

Generally no, unless the business is also a healthcare provider that bills insurance. Medical patient information is still confidential under state law, and customer personal information is covered by the state breach law, so the protections are similar in practice even though the statute is different.

How do you handle employee turnover?

With a single offboarding checklist that covers every system, executed the same day, and a periodic access review to catch anything missed. Turnover is the biggest ongoing compliance risk in cannabis retail, and process fixes it.