Security at Pharmaceutical Warehouses and Manufacturing Facilities

Steve Morkovsky
January 6, 2012


Pharmaceutical manufacturing involves the scientific blending and mixing of chemicals to produce specific drugs in liquid, powder or pill form. Due to the use of these chemical substances, tightly controlled security practices are critical. Manufacturers must have controls in place at every stage of the manufacturing and handling process to protect these substances and prevent theft. This includes processes around rejected, returned and damaged product.

Many of these controls are, in fact, law. More than 50 pieces of legislation pertaining to the control and diversion (loss) of drugs were enacted by Congress between 1914 and 1970, most of which were combined into one in 1971 called the Controlled Substances Act (CSA). The Drug Enforcement Administration (DEA) is the government agency responsible for ensuring that effective security is maintained around the use of controlled substances. Their directives involve accounting and reporting as well as security requirements when it comes to receiving, storing, manufacturing, labeling, packaging and shipping. While the DEA can inspect and fine those who are not in compliance, most of their efforts are focused on the more serious problems that face both practitioner and non-practitioner—diversions of controlled substances in the form of burglary, robbery, employee theft, loss in-transit, illegal sale, falsified prescription orders and customer/patient theft.

Controlled Substance Classifications

The CSA classifies controlled substances into five groups or schedules of drugs. The group into which a particular drug (or other substance) falls depends on the medical use, potential for abuse and safety or dependence liability. Schedule I substances (CI - LSD, marijuana, heroin) are those that, basically, have no medical use but have a very high abuse potential. Schedule V substances (CV) are those that have very little abuse potential and are usually available without a prescription. There are different minimum security standards when it comes to schedule CI and CII versus CIII, CIV and CV. Most pharmaceutical manufacturing involves the use of CII, CIII and CIV substances.

Security Requirements

The Code of Federal Regulations provides general security requirements to assist manufacturers in establishing processes and procedures to minimize theft and diversion of controlled substances. When the DEA evaluates a manufacturing applicant, it looks at the type of activity being conducted (e.g., processing of bulk chemicals, preparing dosage forms, packaging, etc.), as well as the type, form and quantity of controlled substances being used. It also evaluates the applicant’s facilities, and any safety measures, such as safes or vaults, key and lock controls, alarm systems, perimeter fencing and supervision of employees. It may also evaluate visitor procedures, the abilities/capabilities of the local police department and controls over storage and transport.

While an applicant may supply all of the above information to the DEA, final approval is not generally given until all systems are in place and inspected on location. The DEA may even require another review if there are substantial changes made to the building, the amount of drugs being used in the processes, or with the security controls.

Schedule I & II

For small quantities of CI and CII substances, such as those awaiting further processing, a safe must be used for storage. The minimum standards include specifications on how long a perpetrator attempting to get at the drug must be delayed. There are guidelines for types of locks and security containers that can be used, and these must meet or exceed the following security protection:

  • 30 man-minutes against secretive type entry
  • 10 man-minutes against forced entry
  • 20 man-hours against lock manipulation
  • 20 man-hours against radiological attack

If the safe being used can be carried off (under 750 lbs), then there are other guidelines pertaining to how it must be fastened to the floor or wall, along with other requirements for alarms which ring to police stations that have a duty to respond.For larger quantities that can not be stored in a safe, vault storage is necessary. Guidelines for vaults state that:

  • Construction of walls, floors and ceilings must be a minimum of 8" thick of reinforced concrete with rebar within. Rebar must be arranged in a grid formation using 1/2" steel rods tied 6" on center. An alternative is UL listed modular vault panels.
  • Doors and frames must be UL listed as burglary-resistant, GSA Class V rated, or equivalent, and a locking device must meet other required minimums such as resistance to carbide bit drilling.
  • If the vault must be left open on a frequent basis, then a self-closing, self-locking day gate is required.
  • The walls or perimeter must be equipped with an alarm system. This system must be monitored by a central protection company, local or state police, or a proprietary central station.
  • The door into the vault must have contact switches as well as some type of sensor (ultrasonic, infrared, sound) that will detect unauthorized entry.

However, the DEA has final word on what is acceptable for each registrant, and sometimes that deviates from the guidelines. For example, if a manufacturing facility has 24/7 guard surveillance, then it may deem that a full alarm system is not necessary. Or, if the location is dealing primarily with liquid drugs that are contained within a pipeline, they may waive the need for a vault all together.

Schedule III

For small quantities of the less addictive classes (CIII-V), a UL listed burglary-resistant safe or security container which complies with the CI&II requirements is acceptable. However, large quantities have these requirements:

  • A building or area within a building must have perimeter security which provides security after working hours, and also limits access during working hours. It must also have these controls:
    • An electronic alarm system similar to that described previously for CI and CII
    • Self-closing, self-locking doors of substantial construction that are lockable, with key control and key change (i.e. combination lock) procedures

  • A cage within a building constructed of #10 gauge steel with steel posts set in concrete. Specifications exist for the diameter of the posts, how they are anchored, spaced, the size of the openings in the metal mesh used for constructing the cage and the door material, etc.

  • A masonry enclosure or other secure storage area approved by the DEA


In addition to all of the storage and handling requirements, there are responsibilities involved with transporting controlled substances. Even though common carriers can be used, it is up to the registrant to properly screen and select carriers that will provide adequate security against loss. Selecting a carrier may include inspection of their fleet for physical security features (vehicle alarms, trailer locks, key control procedures, unauthorized door open alarms, etc.). It may also involve requesting the carrier not use the same route routinely, checking their driver-screening controls, and inquiring as to the experience levels of their drivers.


When it comes to storage of pharmaceutical goods in warehouses, the requirements are not as stringent, as it would be cost prohibitive to store all controlled substances in vaults. There are, however, guidelines that state "adequate" security must be maintained to guard against loss and theft. If a public or shared space warehouse is used, the responsibility for security still rests on the registrant, and not the warehouse owner. Per the DEA, items to consider when selecting a warehouse include:

  • Perimeter controls to include fencing, lighting, electronic security and check points
  • Confirming that the order tracking system is adequate to ensure total control of all product
  • Reviewing employee and HR (drug, background) screening procedures at the warehouse
  • Hours of operation
  • Use of contract or proprietary guards
  • Controls that are present for inbound and outbound containers, tractors and trailers
  • Controls over drivers and l trucks/tractors/trailers in the yard

Ensuring a continuous vigilance against diversion of controlled substances is no easy task. If there is a significant loss of a controlled substance, the DEA requires registrants to submit information on the occurrence. An investigation by the DEA into the event could lead to fines being levied against the registrant. Some of these fines can be very large if it is determined that previously approved security measures and procedures were not followed. Many pharmaceutical manufacturers do use CI-V materials in their manufacturing processes. Criminals are becoming increasingly crafty and sophisticated in their approaches to diverting scheduled pharmaceuticals, and it is the registrant’s responsibility to ensure adequate security of their operations.

To learn more about how OneBeacon Technology Insurance can help you manage technology risks, please contact Dan Bauman, Vice President of Risk Control for OneBeacon Technology Insurance at or 262.966.2739.


This article is provided for general informational purposes only and does not constitute and is not intended to take the place of legal or risk management advice. Readers should consult their own counsel or other representatives for any such advice. Any and all external websites or sources referred to herein are for informational purposes only and are not affiliated with or endorsed by OneBeacon Insurance Group. OneBeacon Insurance Group hereby disclaims any and all liability arising out of the information contained herein.


Controlled Substances Security Manual, United States Department of Justice -