DCR mandates Metrc password resets to strengthen system security

The Division of Cannabis Regulation will require all licensed facility agents using Metrc to reset their passwords every 60 days beginning this summer, according to new guidance issued by the agency this week.

The policy is set to take effect on June 1, 2025, with the first round of mandatory resets scheduled for July 31. The guidance is part of an effort by DCR to bolster data security and reduce the risk of unauthorized access to Metrc, Missouri’s statewide seed-to-sale tracking system.

According to the update, agents will be prompted to change their password every 60 days. Starting 10 days before each required reset, Metrc will display a daily login banner notifying users how many days remain before their password must be changed.

New passwords must follow a strict set of criteria. They must contain at least one uppercase letter, one lowercase letter, one number, one special character, and be a minimum of eight characters in total. Additionally, previously used passwords from the last 24 reset cycles cannot be reused.

Agents who do not reset their password before the expiration date will lose access to the system and must contact Metrc support to regain entry.

For further details, licensees can review bulletin MO IB 0038 via the Metrc Bulletin Database or contact DCR at CannabisDevelopment@health.mo.gov.