Guidance

Security guidance for all existing or prospective Home Office controlled drug licensees and/or precursor chemical licensees or registrants (accessible)

Updated 22 December 2022

This document provides general advice and guidance on security measures which are appropriate for premises that are licensed to possess and/or supply and/or produce controlled drugs (CDs), CD products and/or precursor chemicals

1. Scope

This document provides general guidance on security measures which should be considered for premises that are licensed, or intending to be licensed, in connection with the possession and/or supply and/or production of controlled drugs (CDs), CD preparations and/or precursor chemicals (PCs).

This is general guidance and licensees may wish to seek independent legal advice to ensure they are compliant with any relevant legislation.

Topics covered include:

1. Site and building security

2. CD storage

3. Keys and locking mechanisms

Transportation of CDs is outlined in a separate document.

2. Introduction

This document is neither exhaustive nor prescriptive, but is designed to support prospective and existing Home Office licensees (CDs and Category 1 PCs) and registrants (Categories 2 and 3 PCs) in determining how their premises and the CD and/or PC stocks within them should be secured and stored.

There are some legislative requirements relating to the storage of specific schedules of controlled drugs – see the Misuse of Drugs (Safe Custody) Regulations 1973)^{[footnote 1]} (S.I. 1973/798) (MD SCR 1973). Each licensee, or prospective licensee’s premises and the business conducted will carry different and specific risks which security measures should seek to mitigate. In considering the suitability of a company to hold a licence or registration, no single security measure will be determinative. The Home Office Drugs and Firearms Licensing Unitconsiders sites holistically and location, physical security, business type, procedures, practices and personnel are all included in the evaluation.

This document has been produced in line with a commitment to working with existing and prospective licensees to ensure compliance with the relevant Regulations and accepted ‘best practice’. The following provides an indication of the elements or factors individuals or companies should have regard to.

Whilst applications are individually considered, there are certain expectations and minimum standards to be met. For example, the physical security measures outlined in the MD SCRs 1973 are, in practice, seen as acceptable minimum standards to be met for the storage of all CDs/PCS, irrespective of schedule or activity. We recognise there are certain limited circumstances where alternative arrangements may be appropriate, but also note many of our licensees to have security measures in place which far exceed these, and are considered proportionate to the risks involved in handling controlled drugs.

This is general guidance and applicants and licensees may wish to seek independent legal advice to ensure they are compliant with the regulations.

3. Site and building security

The site and building security measures adopted in a particular location will be affected by the:

• Location and wider environment

• Scale of the business, size of premises, staff numbers etc

• Nature of business

• Amounts of CDs/PCs held on the premises

General principles

The list below outlines some common security arrangements for prospective or existing Home Office CD or PC licensees or registrants. Licence applicants should consider the following when establishing security procedures at their premises:

i. External doors and windows fitted with secure locks;

ii. Where possible, and amounts permit, bulk stocks kept on racks above ground level. Stock which is ready for delivery/has just been delivered may be kept at ground level for a short time;

iii. The premises and the area where the CDs and/or PCs are stored protected by an intruder detection system. Applicants may wish to have an alarm installed by an alarm company registered with the National Security Inspectorate (NSI) (formerly NACOSS or SSAIB);

iv. An alarm system which is monitored by an off-site company which is alerted when the system is activated. A dual path communicator may be appropriate.

v. The company which receives the alert may undertake to notify the police in the event of an alarm activation;

vi. Certain levels of police response attached to the alarm (e.g. ‘immediate’ or ‘level 1’) may be the most appropriate;

vii. An agreed set of Standard Operating Procedures (SOPs) should exist which governs the manner in which CDs and/or PCs are produced, stored and handled on site, subjected to periodic stock checks and, where relevant, supplied to customers. This document should be regularly reviewed and updated and it is helpful if all employees are familiar with these SOPs and a hard copy is available for reference.

Additional requirements for those handling higher risk Controlled Drugs/Precursor Chemicals, including those specifically referenced in the Misuse of Drugs (Safe Custody) Regulations 1973

Licensees handling CDs/PCs, especially those in Schedules 1 and 2 to the Misuse of Drugs Regulations 2001 (MDR 2001) or those listed in Schedule 3 to the MDR 2001 which are subject to the secure storage provisions of the Misuse of Drugs (Safe Custody) Regulations 1973^{[footnote 2]}, should be aware that these drugs are generally considered to be at a higher risk of diversion, and companies should consider the following to further secure their stocks:

i. A perimeter fence and lockable/ access control gates (local planning regulations permitting);

ii. Perimeter surveillance e.g. detector-activated CCTV which is recorded;

iii. External doors (including fire escape doors) manufactured to the recommended standard (LPS 1175 SR4);

iv. An electronic access control system with a clear audit trail e.g swipe cards or fobs used by all staff;

v. A CD store/safe/cabinet which is manufactured to the appropriate standard (see Section 3 below).

4. Controlled Drug Storage

General principles

Licensees handling CDs/PCs, especially those in Schedules 1 and 2 to the Misuse of Drugs Regulations 2001 (MDR 2001) or those listed in Schedule 3 of the MDR 2001 which are subject to the secure storage provisions of the Misuse of Drugs (Safe Custody) Regulations 1973 (see below), should be aware that these drugs are generally considered to be at a higher risk of diversion, and should consider holding stocks in one of the following ways.

The size of the stocks will determine which of the following is most suitable:

i. A prefabricated strong room (PSR) that has been certified to CEN Grade VI of BS/EN 1143-1

ii. A safe that has been certified to an appropriate CEN Grade (e.g. I to

XIII) of BS/EN 1143-1

iii. A small safe that has been certified to Grades S1 or S2 of BS/EN 14450

iv. A cabinet that complies with the specifications set out in the Misuse of Drugs (Safe Custody) Regulations 1973.

Where possible, it is recommended that safes/cabinets are installed in an area that is already protected by the alarm system installed on the premises. If that is not possible, consideration should be given to adapting the existing system to ensure that it protects the area around the cabinet. PSRs would normally be separately alarmed or zoned.

Prefabricated strong rooms (PSRs)

i. CD stocks that are too large to be accommodated in a safe should be held in a PSR which is formed from panels that are bolted or welded together depending on the supplier. PSRs can be constructed to virtually any size consistent with the scale of a licensee’s business and can be equipped internally with racking to hold multiple pallets of stock and to permit forklift operations.

ii. Given the substances often held in PSRs, it would generally be held to be good practice for them to be protected by an intruder alarm system that has a circuit that is separate from the main circuit for the premises.

iii. Licensees may wish to explore adapting the alarm system for the premises to ensure that it protects the area around the exterior of the PSR e.g. Installation of additional movement detectors.

Safes certified to a CEN Grade of BS/EN 1143-1

Drums containing more than 500 grams of raw materials and finished products whose active ingredients exceed 500 grams should be held in safes that have been certified to an appropriate CEN Grade under BS/EN 1143-1.

Small safes that have been certified to Grades S1 or S2 of BS/EN 14450

Small stocks of CD raw materials, for example those not exceeding 500 grams in total or CD preparations whose active ingredients do not exceed that weight may be

held in safes that have been certified to Grades S1 or S2 of BS/EN 14450.

CD cabinets

i. Cabinets that comply, as a minimum, with the specifications set out in the Misuse of Drugs (Safe Custody) Regulations 1973, would not be expected to hold stocks of raw materials exceeding 250 grams or CD preparations whose active ingredients do not exceed that weight.

ii. Generally, such cabinets would be expected to have been constructed of, at a minimum, mild steel sheet at least 2 to 3mm thick.

iii. The locking mechanism should be as robust as possible to maximise security (e.g. a multiple-point).

Certification of PSRS, safes and cabinets

The Home Office is aware there are PSRs, safes and cabinets on the market that have not been tested at a laboratory recognised by certification bodies within the European Fire and Safety Group (EFSG).

To this end, licensees considering the procurement of such items may wish to check that they are certified by any of the following EFSG members and can produce paperwork to confirm this:

• UK – BRE

• France – CNPP

• Sweden – SBSC

• Germany – ESSA

• Germany – VdS

• Italy – I.C.I.M

Special circumstances

Alternative arrangements may be appropriate for temperature-sensitive substances and/or preparations. These should be discussed with the Home Office Drugs Licensing and Compliance Unit, using the contact details below, before purchase.

5. Transporting controlled drugs

Typically, we would consider that Controlled Drugs being transported between licensees remain the responsibility of the original licensee until ownership is transferred to the recipient (e.g. a customer or patient). As a result, while controlled drugs are in transit, responsibility for their security remains with the owner (normally the supplier) and does not transfer to either the courier or the customer until the drugs arrive at their destination and are signed for. This may still be the case even when the original owner/ supplying company does not physically possess the drugs at all stages during transit because they are using a third party courier (or storage firm) who may also need to hold a Home Office licence.

Those supplying controlled drugs therefore should consult the additional guidance on transit which can be found on our website.

6. Keys and locking mechanisms

When deciding which PSR, safe or cabinet to purchase for the secure storage of CD/precursor stock(s), licensees are encouraged to consider using a product that has been fitted with a combination lock as this avoids the need to make separate arrangements for the safe storage of a key.

Combination locks

Combination locks which permit each authorised person to use a separate combination are available and are recommended.

In the case of PSRs and some safes, the locks may require two persons to enter their respective combinations and some provide an audit facility which enables data to be downloaded to a computer for managers to monitor the use of the lock(s). Such audit trails are useful as a starting point for any investigation following a theft/loss.

If businesses decide to use combination locks, the combinations should only be known to those persons authorised to operate the lock. The following rules are regarded as good practice with regard to the use of combination locks:

i. Combinations should not be written down;

ii. Combinations that are issued to individual members of staff should not be shared with anyone else, including colleagues;

iii. All combinations should be changed regularly, or at least every six months as a minimum, to prevent the locks from being compromised;

iv. Combinations should also be changed whenever there are grounds to suspect that they may have become known to an unauthorised person;

v. Regardless of whether a combination is shared by a group of people or issued to individuals, it should be changed whenever a member of that group or the individual to whom it was issued leaves the business or otherwise no longer requires access to the lock.

Securing keys

The Home Office suggests that licensees apply the same levels of security controls to all key(s) (including spares) to safes and/or PSRs as they would to the CDs contained within them since failure to do so compromises the security arrangements and undermines the value of the safe/PSR. Access to individual keys should be audited and recorded, with a witnessed key signing/ in/ out procedure.

It is recommended that spare keys should be kept in a separate safe to which only very few employees (most likely, senior managers), have access. Combination locks are often cheaper to install than a separate CEN graded container for keys and are therefore recommended.

Key boxes may be considered for holding the key for a cabinet or a small safe. Where a business requires a key box, the Home Office recommends a model that is formed from steel sheet that is at least 3mm thick, has a combination lock without a separate key override and is secured by internal bolts to a solid wall. Boxes formed from thinner metal or other metals (e.g. aluminium) carry a greater risk since they are easier to break into. We would not consider it good key management practice to lock a key in a desk drawer or other office furniture, irrespective of whether the key is locked in an additional box.

7. Contact us

If you require any further information and/or would like to discuss your security arrangements in more detail, please contact a Home Office Compliance Officer using the details below:

By email: DFLU.dom@homeoffice.gov.uk

By phone: Speak to the Duty Compliance Officer. Our number can be found on the Drugs Licensing web page

In addition to this, further advice on premises security may be available from your local police force and licensees/registrants should contact them directly to see if this is available in their area.

We recognise that meeting the security requirements outlined above may require considerable financial investment. Whilst we cannot at this time visit prospective licensees before an application is made and certain pre-requisites- e.g. enhanced DBS checks- are undertaken, we would much rather discuss what may be required before you undertake works which may be expensive and not meet the required standards. The Home Office cannot accept any liability for any losses as a result of a licence not being granted.

8. Data protection

The Home Office collects, processes, and shares personal information to enable it to carry out its statutory and other functions, including those related to law enforcement, safeguarding against, and the prevention of, threats to public security.

We are only allowed to process your data where there is a lawful basis for doing so.

We may share your information with other organisations in the course of carrying out our functions, or to enable others to perform theirs and which are consistent with the Home Office functions.

More information about the ways in which the Home Office may use your personal information, including the purposes for which we use it, the legal basis, and who we share your information with can be found at:

• https://www.gov.uk/government/organisations/home-office/about/personal-information-charter

• https://www.gov.uk/government/publications/drugs-and-firearms-licensing-privacy-information-notices

1. http://www.legislation.gov.uk/uksi/1973/798/contents/made ↩

2. The most commonly encountered CDs of this type are buprenorphine, diethylpropion or phenazepam and temazepam. ↩