DEA controlled substance storage requirements are set out in 21 CFR Part 1301 and scale with the drug’s schedule and the type of registrant. Schedules I and II must be kept in a safe, steel cabinet, or vault that meets specific resistance thresholds and is tied to a transmitting alarm system. Schedules III, IV, and V can go in a securely locked, substantially constructed cabinet. Individual practitioners such as physicians and veterinarians operate under a lighter, separate rule, and pharmacies have the option to disperse Schedule II–V stock through non-controlled inventory instead of using a dedicated cabinet.
Underneath those headline rules sit alarm, access, and personnel requirements that apply across every schedule. The DEA judges the whole package: the container, the room, the alarm, and who holds the keys.1eCFR. 21 CFR Part 1301 – Security Requirements
Schedule I and II Storage for Non-Practitioners
Substances in Schedules I and II carry the highest diversion risk, and the storage rules reflect it. Non-practitioners handling these materials must use one of three containers: a safe, a steel cabinet, or a vault.2eCFR. 21 CFR 1301.72 – Physical Security Controls for Non-Practitioners
Safe and Steel Cabinet Specifications
A safe or steel cabinet used for Schedule I or II storage must meet four performance thresholds, or their equivalent:
- 30 man-minutes of resistance against surreptitious entry
- 10 man-minutes of resistance against forced entry
- 20 man-hours of resistance against lock manipulation
- 20 man-hours of resistance against radiological techniques
Those figures come directly from 21 CFR 1301.72.3eCFR. 21 CFR 1301.72 – Physical Security Controls for Non-Practitioners The “man-minutes” and “man-hours” measure how long the container resists a single skilled attacker using common tools. Any safe or steel cabinet weighing less than 750 pounds must be bolted or cemented to the floor or wall so it cannot be carried off.4USC Environmental Health & Safety. Storage and Security
Vault Construction
Vaults built after September 1, 1971 have detailed construction specs. The walls, floors, and ceilings must be at least 8 inches of reinforced concrete or equivalent masonry, reinforced with half-inch steel rods tied on 6-inch centers both vertically and horizontally. The vault door and frame must meet the same four resistance thresholds as a safe or steel cabinet.
Vaults built before that date get relaxed specs. They need substantial construction with a steel door, a combination or key lock, and an alarm system, but the concrete thickness and rebar rules do not apply retroactively.2eCFR. 21 CFR 1301.72 – Physical Security Controls for Non-Practitioners
Alarms on Schedule I and II Storage
Every Schedule I or II storage area, whether safe, cabinet, or vault, must be equipped with an alarm system that transmits a signal upon any attempt at unauthorized entry. The signal has to reach one of three acceptable recipients: a central station protection company, a local or state police agency with a legal duty to respond, or a 24-hour control station operated by the registrant.2eCFR. 21 CFR 1301.72 – Physical Security Controls for Non-Practitioners A local siren with no transmission does not satisfy the rule. Backup power is not framed as a hard mandate, but the DEA weighs it heavily when judging whether your overall security is adequate.
Schedule III, IV, and V Storage
The rules for Schedules III through V are lighter but still concrete. These substances must be stored in a securely locked, substantially constructed cabinet.1eCFR. 21 CFR Part 1301 – Security Requirements The regulation does not spell out dimensions for “substantially constructed,” but a flimsy filing cabinet or a desk drawer with a basic latch is not what the DEA has in mind. Commercial-grade steel with a built-in lock is the practical baseline.
If the room housing the cabinet is accessible to people who are not authorized to handle controlled substances, you need an additional layer such as a small drug safe or lock box inside the cabinet or drawer.4USC Environmental Health & Safety. Storage and Security The principle is simple: an unauthorized person who happens to enter the room should still not be able to reach the substances.
Storage Rules for Individual Practitioners
Physicians, dentists, veterinarians, and other individual practitioners fall under 21 CFR 1301.75, which recognizes that a solo clinic handles far less volume than a distributor or manufacturer. Schedule I substances must be stored in a securely locked, substantially constructed cabinet. Schedules II through V follow the same baseline: a locked, substantially constructed cabinet.5eCFR. 21 CFR 1301.75 – Physical Security Controls for Practitioners
For many small practices, one high-quality locking cabinet holding the entire inventory covers the rule. The cabinet must remain inaccessible to patients and unauthorized staff at all times.
The Dispersal Option for Pharmacies
Pharmacies and institutional practitioners such as hospitals with on-site pharmacies get an additional option for Schedules II through V. They can disperse those substances throughout the stock of non-controlled inventory rather than keeping them in a dedicated locked cabinet.5eCFR. 21 CFR 1301.75 – Physical Security Controls for Practitioners Scattering the controlled items across thousands of non-controlled products makes them harder to find and grab quickly. Schedule I substances cannot use this method and must stay in a locked cabinet regardless of the setting.
Access Controls That Attach to Every Cabinet and Vault
The container is only half the requirement. Storage areas for controlled substances must be accessible only to an absolute minimum number of specifically authorized employees.2eCFR. 21 CFR 1301.72 – Physical Security Controls for Non-Practitioners “Absolute minimum” is strong language. If only two people need daily access, three is too many.
Key locks require a key-control system that limits access to a small number of employees. Combination locks must restrict knowledge of the combination to as few employees as possible, and the combination must be changed whenever someone who knew it leaves employment or loses authorization.2eCFR. 21 CFR 1301.72 – Physical Security Controls for Non-Practitioners Keys should never sit in an unlocked desk or hang on a hook near the cabinet. If they must be stored on-site, they belong in a secure location known only to authorized users.
Maintenance workers, contractors, visitors, and anyone else without controlled substance authorization need to be watched when they enter or pass through a storage area. The registrant must provide adequate observation by an authorized employee who has been specifically designated in writing.2eCFR. 21 CFR 1301.72 – Physical Security Controls for Non-Practitioners Leaving a plumber alone in a room with an unlocked Schedule II cabinet is the kind of lapse that shows up in DEA inspections.
What Else Attaches to Your Storage
A few obligations sit outside the storage rules themselves but hit registrants who focus only on the cabinet.
Practitioners cannot employ anyone with access to controlled substances who has been convicted of a felony related to controlled substances, has had a DEA registration denied or revoked, or has surrendered a registration in connection with a federal or state investigation.6eCFR. 21 CFR 1301.76 – Other Security Controls for Practitioners Non-practitioners such as manufacturers and distributors are directed to run a more detailed screening program under 21 CFR 1301.90.7eCFR. 21 CFR 1301.90 – Employee Screening Procedures
Every registrant must also take a physical inventory of all controlled substances on hand at least once every two years, on any date within two years of the previous count.8eCFR. 21 CFR 1304.11 – Inventory Requirements6eCFR. 21 CFR 1301.76 – Other Security Controls for Practitioners9Diversion Control Division. Theft/Loss Reporting
Penalties for Storage Violations
Security violations are prohibited acts under 21 U.S.C. § 842. The civil penalty for most infractions, including failures of storage, recordkeeping, or security controls, is up to $25,000 per violation. Certain reporting and control failures carry a cap of $10,000 per violation, and that ceiling rises to $100,000 per violation for opioid manufacturers and distributors. Knowing violations prosecuted criminally escalate beyond the civil tier.10Office of the Law Revision Counsel. 21 USC 842 – Prohibited Acts B
Fines are not the worst outcome. The DEA can revoke or suspend a registration entirely under 21 U.S.C. § 824. The standard process begins with a show-cause order giving the registrant at least 30 days to respond and the chance to submit a corrective action plan. If the DEA finds an imminent danger to public health or safety, it can suspend the registration immediately while proceedings are pending. The statute defines that phrase to include situations where a registrant’s failure to maintain effective diversion controls creates a substantial likelihood of death, serious bodily harm, or drug abuse.11Office of the Law Revision Counsel. 21 USC 824 – Denial, Revocation, or Suspension of Registration Losing a DEA registration ends the ability to prescribe, dispense, or handle controlled substances, which for most practitioners ends the practice itself.