CSQ CERTIFICATION
The CSQ Certification Program and applicable standards were built around ISO/IEC 17067
9 NYCRR 123.6 Processor GMP Requirements
New York Cannabis GMP for Processors
Adult-use cannabis processors and medical registered organizations must establish GMP compliance by passing a qualified third-party GMP audit against 21 CFR Part 111 or 117, conducted by an accredited third-party certification body, within one year of commencing licensed operations; cannabinoid-hemp processors must show a third-party GMP audit or certification as a condition of final licensure.
New York's Cannabis GMP Audit Requirement and How CSQ Helps You Meet It
If you hold a New York cannabis or cannabinoid-hemp processor license, state law requires you to pass a qualified third-party GMP audit against 21 CFR Part 111 or 117, by an accredited certification body. Adult-use processors and medical registered organizations must do so within a year of commencing operations; cannabinoid-hemp processors must show it as a condition of final licensure. This page explains what OCM requires, which processors it covers, and how CSQ certification with Kiwa ASI is built to meet it confirm CSQ's acceptance for your license with Kiwa ASI, since OCM determines which third-party GMP auditors qualify.
START HERE
Does New York's Third-Party GMP Audit Requirement Apply to Me?
If you process cannabis or cannabinoid hemp in New York, almost certainly yes. The third-party GMP audit mandate falls on processors, not cultivators, distributors, or retailers. Here is the short version.
WHO IT APPLIES TO
Cannabis & hemp processors
The mandate is on processors: adult-use processors, medical registered organizations, and cannabinoid-hemp processors. In New York's two-tier market, cultivators, distributors, and retail dispensaries are not subject to the third-party GMP audit, which 9 NYCRR 123.6, 113.12, and 114.7 place only on processors.
YOUR DEADLINE
Within one year — or before licensure
Adult-use processors and medical ROs must show a passed audit within one year of commencing operations (9 NYCRR 123.6(a)(2); 113.12(d)(2)). For cannabinoid-hemp processors it is a licensing prerequisite — evidence or a plan within six months of temporary approval, and no final license without it (9 NYCRR 114.7).
THE STANDARD
21 CFR Part 111 or 117
New York names the GMP standard: cGMP under 21 CFR Part 111 or Part 117, by product type — audited by an accredited third-party certification body that OCM deems qualified. A narrow conditional exemption (with prior written OCM approval) may apply to some Type 3 processor and microbusiness packaging/labeling activity with no grinding on site — those operations still must follow GMP.
What New York actually requires
New York is unusually direct about GMP. An adult-use processor authorized for certain processing activities must establish GMP compliance by submitting proof of a qualified third-party GMP audit of its extraction and/or manufacturing processes within one year of commencing licensed operations (9 NYCRR 123.6(a)(2)), keep current GMP certification for the license term, and submit an updated audit at each renewal (123.6(a)(3)). Medical cannabis registered organizations carry the same one-year duty (9 NYCRR 113.12(d)(2)), and cannabinoid-hemp processors must show a third-party GMP audit or certification as a condition of final licensure (9 NYCRR 114.7).
Two things to know. First, the audit is measured against a named federal standard: cGMP under 21 CFR Part 111 (dietary-supplement-type products) or Part 117 (human food), depending on the product — and OCM guidance says there are no exceptions to processing cannabis under GMP. Second, the audit must be performed by an accredited third-party certification body, and OCM decides which auditors are authorized and qualified. New York names no private scheme (no CSQ, GFSI, or ISO). CSQ is an accredited, cannabis-specific GMP certification aligned to those 21 CFR standards — built to meet exactly this kind of requirement.
FIND YOUR PATH
Match Your New York License to the Right CSQ Standard
The GMP audit mandate lands on processors, so start there. Match what you actually do to the CSQ standard that fits; if you hold more than one authorization (a microbusiness or a registered organization), Kiwa ASI can combine the applicable scopes into one coordinated audit.
Adult-Use Processor — Extraction
9 NYCRR 123.6STANDARD
CSQ Extraction v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~2 days onsite (initial)
Solvent-based and solvent-free extraction (CO₂, ethanol, hydrocarbon, mechanical). This is squarely inside the third-party GMP audit mandate. CSQ items to watch: beverage-grade CO₂ (99.5%), food-grade non-denatured ethanol where required, and residual-solvent controls.
Adult-Use Processor — Manufacturing
9 NYCRR 123.6 · 21 CFR 111/117STANDARD
CSQ Manufacturing v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~2 days onsite (initial)
Edibles, beverages, vape cartridges, topicals, and infused products — the products New York measures against 21 CFR Part 111 or 117. Your one-year GMP audit clock starts when you commence operations.
Medical Registered Organization
9 NYCRR 113.12(d)(2)STANDARD
CSQ Manufacturing v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~2 days onsite (initial)
Vertically integrated medical operators (Article 3). ROs conducting extraction or manufacturing carry the same qualified third-party GMP audit duty within one year of commencing operations.
Cannabinoid Hemp Processor
9 NYCRR 114.7STANDARD
CSQ Manufacturing v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~2 days onsite (initial)
Hemp-derived (CBD and other cannabinoid) extraction and manufacturing under Article 5. Here the third-party GMP audit or certification is a licensing prerequisite — final licensure is not issued without it.
Cultivator
Cannabis Law § 68STANDARD
CSQ Cultivation v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~2 days onsite (initial)
Cultivation is not subject to the third-party GMP audit mandate — but CSQ Cultivation (built on cGACP plus cGMP) is a strong voluntary differentiator and prepares you if you add processing.
Testing
OCM testing rulesSTANDARD
External lab — ISO/IEC 17025
MINIMUM LEVEL
N/A
PREP TIME
Varies
AUDIT LENGTH
Per accreditation body
New York separately requires products to pass laboratory testing by a permitted lab before sale. CSQ does not certify testing labs; it requires them to be ISO/IEC 17025 accredited.
NEW YORK REQUIRES VS. CSQ GOES FURTHER
What's a State Rule, and What's a CSQ Best Practice?
New York's regulations are the legal floor. CSQ is a published standard that satisfies GMP and adds requirements that are not in state law. Knowing which is which keeps you from over-buying or under-preparing.
What New York requires (the legal floor)
- Process all cannabis under GMP — 21 CFR Part 111 or 117, no exceptions — 9 NYCRR 123.6(a)(1)
- Adult-use processors: a qualified third-party GMP audit by an accredited body, within 1 year of operations; maintain + renew — 9 NYCRR 123.6(a)(2)–(3)
- Medical registered organizations: the same qualified third-party GMP audit within 1 year — 9 NYCRR 113.12(d)(2)
- Cannabinoid-hemp processors: a third-party GMP audit/certification as a condition of final licensure — 9 NYCRR 114.7
- Only relief: a narrow conditional exemption (prior OCM approval) for some packaging/labeling activity with no grinding — 9 NYCRR 123.6(a)(2)
- Independent laboratory testing by a permitted lab before sale — under OCM's testing rules
- Compliant packaging and labeling — under OCM's packaging and labeling rules
What CSQ adds (best practice on top)
- An accredited (ISO/IEC 17065) third-party cannabis GMP certification aligned to 21 CFR Part 111/117 — the standard New York references
- A documented internal audit program (Module 1.5)
- A corrective and preventive action (CAPA) system (Module 1.6)
- An annual mock recall (Module 1.8) and verified traceability test
- Cannabinoid and non-cannabinoid waste streams kept completely separated (Module 2A.4 / 2B.4)
- Beverage-grade CO₂ (99.5%) for extraction — medical-grade is not acceptable
- Inhalation-grade ingredients for inhalable products (food-grade/GRAS is not sufficient)
- Route-of-administration risk assessments for formulated, inhalable, and topical products
- Because OCM decides which auditors are qualified, confirm CSQ's acceptance for your license type with Kiwa ASI before you rely on it
- A HACCP team and certified lead (Level 2 only — not a New York state requirement)
Quick glossary — the terms that show up in a New York CSQ audit
OCM / CCB
The Office of Cannabis Management, governed by the Cannabis Control Board — New York's single regulator for adult-use, medical, and cannabinoid-hemp cannabis (Cannabis Law §§ 7, 8, 10).
Cannabis Law / 9 NYCRR
New York's cannabis statute (enacted by the MRTA, 2021) and the OCM regulations in 9 NYCRR — adult-use across Parts 118–125 (the GMP audit in Part 123), medical in Part 113, cannabinoid hemp in Part 114.
Qualified third-party GMP audit
The audit New York requires of processors: an evaluation of extraction/manufacturing against GMP by an accredited third-party certification body that OCM deems qualified (9 NYCRR 123.6).
21 CFR Part 111 / 117
The federal cGMP standards New York names — Part 111 for dietary-supplement-type products, Part 117 for human food — applied by product type.
Processor
A licensee that extracts or manufactures cannabis or cannabinoid-hemp products (Cannabis Law § 69; Article 5 for hemp). Processors carry the GMP audit mandate; cultivators, distributors, and retailers do not.
Registered Organization (RO)
A vertically integrated medical cannabis operator under Article 3; ROs conducting extraction/manufacturing carry the same third-party GMP audit duty.
cGMP / cGHP / cGDP
Current Good Manufacturing / Handling / Distribution Practices — the CSQ foundations for facilities that make product, dispense, and distribute.
Accredited certifying body
An accredited third party like ASI Food Safety, LLC (ISO/IEC 17065-accredited) that issues CSQ certification.
THE AUDIT
What a CSQ Audit Actually Looks Like
A New York CSQ audit is an onsite review of your quality management system against the standard that fits each activity you perform. Here is how scoring, findings, and timing work — followed by the technical mapping table for the people who want it.
Scoring (100-point scale)
How CSQ scores you and what it means for your certificate
| Score | Outcome | Surveillance Cycle |
|---|---|---|
| 80–100 | Certificate issued | Annual surveillance audit |
| 70–79 | Certificate issued | 6-month surveillance audit |
| Below 70 | No certificate | 6-month wait before re-audit |
Findings categories
CRITICAL · –100 POINTS
Auto-fail finding
Regulatory non-compliance, product safety risk, or foundational QMS breakdown. A single Critical finding fails the audit regardless of other scores.
MAJOR · –10 POINTS
Significant gap
Systemic failures or significant deviations from CSQ requirements — not an immediate safety risk but requires corrective action.
MINOR · –1 POINT
Isolated finding
Documentation gap, single-occurrence lapse, or correctable deviation that is not systemic.
Audit timing & certificate validity
What to expect onsite and on the calendar
| Item | Detail |
|---|---|
| Level 1 audit | 1 day onsite + 0.5 day report time |
| Level 2 audit | 1.5 days onsite + 1 day report time |
| Level 3 audit | 2 days onsite + 1 day report time (unannounced window) |
| Initial audit add-on | +1 day for offsite documentation evaluation (all levels) |
| Corrective action window | 30 days to close nonconformities |
| Certificate validity | 1 year + 45 days from audit date |
| Initial certification blackout | No initial certifications scheduled in November or December |
| Provisional certificate | Available for new operations (valid 6 months) |
| Dietary Supplement Addendum | 4-hour minimum · Pass/Fail · separate report within 72 hours |
For consultants, internal compliance leads, and operators who want the section-by-section map between New York's regulations and CSQ 2.0:
New York cannabis rules and corresponding CSQ 2.0 sections
| Missouri Requirement | Citation | CSQ Coverage |
|---|---|---|
| Process cannabis under GMP (21 CFR Part 111/117) | 123.6(a)(1) | Module 2A (cGMP) + Section 3C (formulated / ingestible product controls) |
| Adult-use processor: qualified third-party GMP audit within 1 year | 123.6(a)(2) | CSQ Level 1 (Modules 1–3) issued by an ISO/IEC 17065-accredited body — confirm OCM acceptance |
| Maintain current GMP certification; update at each renewal | 123.6(a)(3) | Annual surveillance + recertification cycle (Module 1) |
| Medical registered organization: third-party GMP audit within 1 year | 113.12(d)(2) | CSQ Manufacturing / Extraction (Modules 2A, 3B/3C) |
| Cannabinoid-hemp processor: GMP audit as a licensing prerequisite | 114.7 | CSQ Manufacturing (Module 2A cGMP) aligned to 21 CFR Part 111/117 by product type |
| Independent laboratory testing before sale | OCM testing rules | Section 2A.12.9 / 2B.11.7 (Product Sampling and Testing) |
| Packaging & labeling (child-resistant, THC limits, warnings) | OCM packaging rules | Section 2A.12.8 / 2B.11.6 (Product Labeling and Packaging) |
| Sanitation, waste, and contamination controls | 123.6(a)(1) | Section 2A.3 (Cleaning & Sanitation) + Module 2A.4 (Waste) + Section 1.6 (CAPA) |
How to Prepare | A Realistic Path to Your GMP Audit
New York gives adult-use processors and medical ROs one year from commencing operations, and makes it a licensing prerequisite for hemp processors — so start early. Most operators need 6 to 9 months to be ready for an initial audit. Here is a sequence that works.
01
Confirm which mandate applies to you
Adult-use processor, medical registered organization, or cannabinoid-hemp processor? Each has its own citation and timeline (9 NYCRR 123.6 / 113.12 / 114.7). Confirm your product type maps to 21 CFR Part 111 or 117, and whether the narrow packaging-only exemption could apply.
02
Confirm CSQ acceptance with Kiwa ASI
Because OCM determines which third-party GMP auditors are authorized and qualified, confirm with Kiwa ASI that CSQ certification fits your license type and OCM's expectations before you build your whole program around it.
03
Run a gap analysis
Compare your current state to the CSQ standard (aligned to 21 CFR Part 111/117). ASI Training and Consulting, LLC can deliver a structured gap analysis as a separate engagement from the certification body.
04
Build the QMS documentation
Author or update SOPs for sanitation, process flow, cross-contamination, allergens, environmental monitoring, waste, traceability, and product release. Stand up your CAPA, internal audit, and document-control systems.
05
Address the cannabis-specific Critical items
The findings most likely to fail a first audit: CO₂ purity, ethanol grade, inhalation-grade ingredients, waste-stream separation, and route-of-administration risk assessments. Verify these before the auditor arrives.
06
Train your team and run internal audits
Deliver competency-based, role-specific training on GMP, hygiene, PPE, allergen handling, and traceability. Then conduct a documented internal audit and an annual mock recall, and close nonconformities through CAPA.
07
Schedule your CSQ audit inside your window
Schedule through Kiwa ASI in the CSQ Database, leaving time for the offsite documentation evaluation (1 day) plus the onsite audit (1–2 days), so your certificate lands inside the one-year window. Request a quote to start.
Why New York Operators Choose Kiwa ASI
Kiwa ASI brings nearly a century of food safety expertise and the global Kiwa network's footprint in 30+ countries to New York's cannabis and cannabinoid-hemp market — and New York measures processing against federal food and supplement GMP.
Accredited
ISO/IEC 17065 + CSQ-Licensed
Audits and certificates are issued by ASI Food Safety, LLC — an ISO/IEC 17065-accredited certification body licensed by CSQ.
Expertise
Food-grade rigor for cannabis
Our auditors are credentialed food safety, GMP, and HACCP professionals with cannabis-specific qualifications. Cannabis is being regulated like food. We've been doing food for decades.
Efficiency
Direct scheduling, no surprises
Pre-audit scoping clarifies level, scope, and Module 3 requirements before you're onsite. Audit reports are turned around inside the standard CSQ timeline.
Comprehensive
Training and consulting available
Pre-assessments and gap analyses are delivered by ASI Training and Consulting, LLC, a separate legal entity, kept structurally separate from the certification body to safeguard impartiality under ISO/IEC 17065.
Continuity
Surveillance, recertification, transfer
If you're already CSQ-certified through another body and the relationship isn't working, we accept transfer audits. Continuity matters as much as the initial certificate.
Partnership
Global Kiwa network
Operations in 30+ countries. Useful when a New York operator expands into other state markets or builds an international supply chain.
Frequently Asked Questions About New York Cannabis GMP & CSQ Certification
Yes — for processors. An adult-use cannabis processor must submit proof of a qualified third-party GMP audit of its extraction and/or manufacturing within one year of commencing operations, maintain current certification, and renew it (9 NYCRR 123.6(a)(2)–(3)). Medical registered organizations carry the same one-year duty (9 NYCRR 113.12(d)(2)), and cannabinoid-hemp processors must show a third-party GMP audit or certification as a condition of final licensure (9 NYCRR 114.7).
No. It applies to processors — adult-use processors, medical registered organizations, and cannabinoid-hemp processors. In New York's two-tier market, cultivators, distributors, and retail dispensaries are not subject to the third-party GMP audit. A narrow conditional exemption (prior OCM approval) exists for some Type 3 processor and microbusiness activity limited to packaging, labeling, or branding with no grinding on site.
Adult-use processors and medical registered organizations must show a passed audit within one year of commencing licensed operations (9 NYCRR 123.6(a)(2); 113.12(d)(2)). For cannabinoid-hemp processors the audit is a licensing prerequisite — applicants provide evidence or a plan to obtain it within six months of temporary license approval, and final licensure is not issued without proof (9 NYCRR 114.7).
New York names the federal cGMP standards: 21 CFR Part 111 for dietary-supplement-type products and 21 CFR Part 117 for human food, applied by product type (9 NYCRR 123.6(a)(1)). The audit must be performed by an accredited third-party certification body, and OCM guidance states there are no exceptions to processing cannabis under GMP.
No. New York names 21 CFR Part 111/117 and requires an accredited third-party GMP audit, but it does not name CSQ, GFSI, ISO, or any private scheme. CSQ is one accredited, cannabis-specific option aligned to those 21 CFR standards. Because OCM determines which auditors are authorized and qualified, confirm CSQ's fit for your license type with Kiwa ASI.
CSQ is an ISO/IEC 17065-accredited, cannabis-specific GMP certification aligned to the 21 CFR Part 111/117 standards New York references — built to meet exactly this kind of third-party GMP audit requirement. Whether a CSQ certificate is accepted for your specific license depends on OCM's determination of qualified auditors, so confirm acceptance with Kiwa ASI before relying on it. We will not overstate that.
Extraction processors use CSQ Extraction v2.0.0; manufacturing processors (edibles, vapes, topicals) use CSQ Manufacturing v2.0.0; medical registered organizations use the standard matching their activity; cannabinoid-hemp processors use CSQ Manufacturing; and cultivators (not subject to the mandate) use CSQ Cultivation v2.0.0. Kiwa ASI can combine scopes into one coordinated audit.
Cannabinoid-hemp processors are licensed by OCM under Article 5 (9 NYCRR Part 114). For them the third-party GMP audit or certification is a licensing prerequisite — you must provide evidence or a plan to obtain it within six months of temporary approval, and no final license is issued without proof, audited by an accredited third-party certification body to OCM's satisfaction.
There is no single published price: cost depends on which CSQ standards apply, which level you pursue, facility size and complexity, whether it is your initial audit (which adds an offsite documentation day), and whether you combine multiple facility scopes. Most operations need 6 to 9 months to prepare; a Level 1 audit is roughly 1–2 onsite days plus report time. Request a quote for a New York-specific scope.
Yes — but as separate legal entities to safeguard certification-body independence. CSQ certification audits are delivered by ASI Food Safety, LLC (the accredited certification body, ISO/IEC 17065 accredited and CSQ-licensed). Pre-assessments, gap analyses, training, and consulting are delivered by ASI Training and Consulting, LLC. The two operate independently to comply with ISO/IEC 17065 impartiality rules.