CSQ CERTIFICATION
The CSQ Certification Program and applicable standards were built around ISO/IEC 17067
Pennsylvania Medical Marijuana Act (Act 16 of 2016) · PA Department of Health · 28 Pa. Code Part IXa
Pennsylvania GMP for Medical Marijuana
Pennsylvania licenses and inspects every medical marijuana grower/processor, dispensary, and approved laboratory through the Department of Health, and a grower/processor must process in a safe and sanitary manner under the state's GMP-style rules (28 Pa. Code §§1151a.27, 1151a.33). Pennsylvania does not require a third-party GMP certificate — but CSQ is an accredited, independent way to prove the extraction and processing GMP the state already requires.
Pennsylvania's Medical Marijuana GMP Rules and Why CSQ Certification Is Worth It
Pennsylvania legalized medical marijuana in 2016, and dispensaries now serve certified patients statewide under the Department of Health's Office of Medical Marijuana (28 Pa. Code Part IXa). It is a medical-only program — there is no adult-use market — and licensed operators may not make edibles; permitted forms are a closed list of pills, oils, tinctures, topicals, liquids, and dry leaf for vaporization. For a grower/processor, Pennsylvania makes food-safety GMP practices the law — safe-and-sanitary processing on food-grade surfaces, sanitation and pest control, storage controls, a written recall plan, and state-tracked inventory — but it requires no third-party GMP certificate and names no private standard. CSQ is an accredited, independent way to prove the extraction and processing GMP Pennsylvania's rules already require. This page explains what Pennsylvania actually requires, which CSQ standard fits your permit, and where certification with Kiwa ASI adds value.
START HERE
Does Pennsylvania Require Medical Marijuana Operators to Be GMP Certified?
No — Pennsylvania requires no accredited third-party GMP certificate. But GMP is far from optional for a grower/processor: the Department of Health's rules make safe-and-sanitary processing, sanitation and pest control, storage controls, and a written recall plan mandatory. Here is the short version, and why CSQ still matters.
WHO REGULATES WHAT
One regulator: the Department of Health
Pennsylvania's medical marijuana program is run by the Department of Health's Office of Medical Marijuana under 28 Pa. Code Part IXa — a health department, not a standalone cannabis commission. Grower/processors (Chapter 1151a), dispensaries (Chapter 1161a), and approved laboratories (Chapter 1171a) are all DOH-permitted.
THE REQUIREMENT
GMP practices + DOH inspection, not a certificate
Grower/processors must process in a safe and sanitary manner on food-grade surfaces (§1151a.27), meet sanitation and pest-control rules (§1151a.33), keep a written recall plan (§1151a.42), and have every product lab-tested (Chapter 1171a). No accredited third-party GMP certificate is required, and Pennsylvania names no private GMP standard.
WHERE CSQ FITS
Voluntary — accredited proof of what PA expects
CSQ is an accredited (ISO/IEC 17065) cannabis-specific GMP certification. Pennsylvania doesn't require it, but it gives independent, audit-ready proof of the extraction and processing GMP Pennsylvania's rules already require — valuable for DOH inspection readiness, diligence, and multi-state operators.
What Pennsylvania actually requires
Pennsylvania runs a medical-only program under the Medical Marijuana Act (Act 16 of 2016, 35 P.S. §10231.101 et seq.) — there is no adult-use market. The program is administered by the Pennsylvania Department of Health (DOH) through its Office of Medical Marijuana — a health department, not a standalone cannabis commission — under the final-form regulations at 28 Pa. Code Part IXa (effective March 4, 2023).
For a grower/processor — Pennsylvania combines cultivation and processing under one permit (28 Pa. Code Chapter 1151a) — food-safety GMP is the law. Processing must be done “in a safe and sanitary manner” on food-grade stainless-steel surfaces (§1151a.27), with sanitation and integrated pest management using EPA-registered sanitizers and food-handler hygiene rules (§1151a.33; 28 Pa. Code §27.153), controlled storage (§1151a.31), a written recall plan (§1151a.42), and seed-to-sale tracking in the Commonwealth's designated system (§1151a.39). Pennsylvania permits only a closed list of product forms — pills, oils, tinctures, topicals, liquids, and dry leaf for vaporization — and prohibits edible/food products at the licensed level (35 P.S. §10231.304(b); permitted forms at §1151a.28). Every product is tested by a DOH-approved laboratory (Chapter 1171a). What Pennsylvania does not do is require an accredited third-party GMP certificate — its rules name no private standard (no SQF, BRCGS, FSSC, ISO, or CSQ), and the GMP duties are Pennsylvania's own, not tied to 21 CFR Part 111 or 117. GMP is verified by DOH permitting and inspection. So in Pennsylvania CSQ is voluntary: accredited, independent proof of the extraction and processing GMP Pennsylvania's rules already require.
FIND YOUR PATH
Match Your Pennsylvania Permit to the Right CSQ Standard
CSQ is voluntary in Pennsylvania, so this is about which scope fits if you pursue certification. A grower/processor holds one combined permit that covers both cultivation and processing; those activities can be combined into one coordinated audit with Kiwa ASI.
Grower/Processor — Cultivation
28 Pa. Code Ch. 1151a · DOHSTANDARD
CSQ Cultivation v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
The cultivation side of Pennsylvania's combined grower/processor permit. Foundation: cGACP (good agricultural and collection practices) plus cGMP, with the safe-and-sanitary and sanitation rules of 28 Pa. Code §1151a.27 and §1151a.33 and mandatory DOH-approved lab testing (Chapter 1171a).
Grower/Processor — Extraction & Processing
28 Pa. Code §1151a.27 · DOHSTANDARD
CSQ Extraction / Manufacturing v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
The processing side — extraction and formulation of Pennsylvania's permitted forms (pills, oils, tinctures, topicals, liquids, and dry leaf for vaporization). This is where the state's GMP-analog rules bite hardest: safe-and-sanitary processing on food-grade surfaces (§1151a.27), sanitation and pest control (§1151a.33), and prior DOH approval of any product (§1151a.28(b)). CSQ items to watch: beverage-grade CO₂ (99.5%) and food-grade non-denatured ethanol for extraction, ingredient controls, and route-of-administration risk assessments. (Pennsylvania permits no edibles, so there is no edible-serving rule to meet.)
Dispensary
28 Pa. Code Ch. 1161a · DOHSTANDARD
CSQ Retail v1.0.0
MINIMUM LEVEL
Level 1
PREP TIME
4–6 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Dispensaries permitted by the DOH to serve certified patients and caregivers. Built on cGHP (good handling practices) — storage, handling, inventory, seed-to-sale tracking in the Commonwealth's designated system, and complaint/recall handling (dispensary duties are set out in 28 Pa. Code Chapter 1161a; complaints and recall specifically at §1161a.38).
Approved Laboratory
28 Pa. Code Ch. 1171a · ISO/IEC 17025STANDARD
ISO/IEC 17025
MINIMUM LEVEL
N/A
PREP TIME
Varies
AUDIT LENGTH
Per accreditation body
Pennsylvania requires product testing by a DOH-approved laboratory; a lab's accreditation is evidenced by a certificate of ISO/IEC 17025 (or other relevant standards) under 28 Pa. Code §1141a.21. CSQ does not certify testing labs; it requires them to be ISO/IEC 17025 accredited.
PENNSYLVANIA REQUIRES VS. CSQ GOES FURTHER
What's a State Rule, and What's a CSQ Best Practice?
Pennsylvania's regulations are the legal floor, enforced by DOH permitting and inspection and mandatory lab testing. CSQ is a voluntary published standard that documents GMP beyond that floor — and gives independent proof of the extraction and processing practices Pennsylvania's rules already require. Knowing which is which keeps you from over-buying or under-preparing.
What Pennsylvania requires (the legal floor)
- A DOH permit for each operator — Medical Marijuana Act, Act 16 of 2016 (35 P.S. §10231.101 et seq.); regulations at 28 Pa. Code Part IXa
- Safe-and-sanitary processing on food-grade surfaces — 28 Pa. Code §1151a.27
- Sanitation, pest control, and employee hygiene — §1151a.33 (EPA-registered sanitizers; 28 Pa. Code §27.153)
- Controlled storage and equipment maintenance — §1151a.31, §1151a.32
- Only a closed list of permitted forms — pills, oils, tinctures, topicals, liquids, dry leaf for vaporization; edibles prohibited at the licensed level — 35 P.S. §10231.304(b); §1151a.28
- Packaging and labeling with prior DOH approval; child-resistant, tamper-evident, opaque (except dry leaf) — §1151a.34
- Product testing by a DOH-approved laboratory — 28 Pa. Code Chapter 1171a
- A written recall plan (DOH may order a mandatory recall) and seed-to-sale tracking — §1151a.42, §1151a.39
- No accredited third-party GMP certificate is required — Pennsylvania names no private GMP standard
What CSQ adds (voluntary best practice)
- An accredited (ISO/IEC 17065) cannabis GMP certification — independent, audit-ready proof beyond DOH inspection
- Built to meet the safe-and-sanitary processing and sanitation rules Pennsylvania requires of a grower/processor (28 Pa. Code §1151a.27, §1151a.33)
- A documented internal audit program (Section 1.5) and CAPA system (Section 1.6)
- An annual mock recall (Section 1.8) and verified traceability test — supporting the written recall plan Pennsylvania requires (§1151a.42) and seed-to-sale tracking (§1151a.39)
- Cannabinoid and non-cannabinoid waste streams kept completely separated (Section 2A.4 / 2B.4)
- Beverage-grade CO₂ (99.5%) for extraction — medical-grade is not acceptable
- Inhalation-grade ingredients for vaporization products (food-grade/GRAS is not sufficient)
- DOH inspection readiness, investor/lender/M&A diligence, multi-state standardization, and buyer assurance
- A HACCP team and certified lead (Level 2 only — not a Pennsylvania requirement)
- What CSQ does not replace: DOH permitting and inspection, its prior approval of products and packaging (§1151a.28(b), §1151a.34), and mandatory lab testing remain the operator's duty
Quick glossary — the terms that show up in a Pennsylvania CSQ audit
Medical Marijuana Act (Act 16 of 2016)
Pennsylvania's medical marijuana statute (35 P.S. §10231.101 et seq.), enacted 2016. Pennsylvania is medical-only — there is no adult-use program.
PA Department of Health (DOH)
The regulator — its Office of Medical Marijuana administers the program under 28 Pa. Code Part IXa. A health department, not a standalone cannabis commission; the Medical Marijuana Advisory Board is advisory only.
28 Pa. Code Part IXa
The Department of Health's final-form medical marijuana regulations (effective March 4, 2023) — Chapter 1141a (general), 1151a (growers/processors), 1161a (dispensaries), and 1171a (laboratories). The “-a” chapters are operative; the plain chapters are reserved.
Grower/Processor
Pennsylvania's combined cultivation-and-processing permit (28 Pa. Code Chapter 1151a) — the permit where the state's GMP-analog processing and sanitation rules apply most directly. Grower/processors sell to dispensaries and other licensees, not to patients.
Permitted forms
Pennsylvania permits a closed list of medical marijuana forms — pills, oils, tinctures, topicals (gels/creams/ointments), liquids, and dry leaf/plant for vaporization (28 Pa. Code §1151a.28). Edibles are prohibited at the licensed level, and dry leaf is for vaporization only — smoking is unlawful.
ISO/IEC 17025
The competence standard for testing laboratories. Pennsylvania evidences a lab's accreditation by a certificate of ISO/IEC 17025 (or other relevant standards) under §1141a.21. CSQ requires the labs it relies on to hold the same — it is not the same as ISO/IEC 17065.
ISO/IEC 17065
The accreditation standard for bodies that certify products and processes. CSQ is delivered by ASI Food Safety as an ISO/IEC 17065-accredited certification body — the basis for an independent, accredited GMP certificate.
THE AUDIT
What a CSQ Audit Actually Looks Like
A Pennsylvania CSQ audit is an onsite review of your quality management system against the standard that fits each activity you perform. Here is how scoring, findings, and timing work — followed by the technical mapping table for the people who want it.
Scoring (100-point scale)
How CSQ scores you and what it means for your certificate
| Score | Outcome | Surveillance Cycle |
|---|---|---|
| 80–100 | Certificate issued | Annual surveillance audit |
| 70–79 | Certificate issued | 6-month surveillance audit |
| Below 70 | No certificate | 6-month wait before re-audit |
Findings categories
CRITICAL · –100 POINTS
Auto-fail finding
Regulatory non-compliance, product safety risk, or foundational QMS breakdown. A single Critical finding fails the audit regardless of other scores.
MAJOR · –10 POINTS
Significant gap
Systemic failures or significant deviations from CSQ requirements — not an immediate safety risk but requires corrective action.
MINOR · –1 POINT
Isolated finding
Documentation gap, single-occurrence lapse, or correctable deviation that is not systemic.
Audit timing & certificate validity
What to expect onsite and on the calendar
| Item | Detail |
|---|---|
| Level 1 audit | 1 day onsite + 0.5 day report time |
| Level 2 audit | 1.5 days onsite + 1 day report time |
| Level 3 audit | 2 days onsite + 1 day report time (unannounced window) |
| Initial audit add-on | +1 day for offsite documentation evaluation (all levels) |
| Corrective action window | 30 days to close nonconformities |
| Certificate validity | 1 year + 45 days from audit date |
| Provisional certificate | Available for new operations (valid 6 months) |
| Dietary Supplement Addendum | 4-hour minimum · Pass/Fail · separate report within 72 hours |
For consultants, internal compliance leads, and operators who want the section-by-section map between Pennsylvania's regulations and CSQ 2.0:
Pennsylvania medical marijuana rules and corresponding CSQ 2.0 sections
| Requirement | Citation | CSQ Coverage |
|---|---|---|
| DOH permitting (grower/processor, dispensary, lab) | Act 16 of 2016 (35 P.S. §10231.101 et seq.); 28 Pa. Code Part IXa | Module 1 (CSQMS) + Section 1.3 (Regulatory Compliance) |
| Safe-and-sanitary processing on food-grade surfaces | 28 Pa. Code §1151a.27 | Module 2A (cGMP) + Section 2A.1 (Facility and Facility Infrastructure) |
| Sanitation, pest control, employee hygiene | 28 Pa. Code §1151a.33 (+ §27.153) | Module 2A (cGMP) + Section 2A.3 (Cleaning and Sanitation) + Section 2A.13 (Personnel Requirements) |
| Permitted product forms (no edibles); DOH product approval | 28 Pa. Code §1151a.28 | Section 3C (formulated / ingestible product controls) |
| Packaging & labeling (prior DOH approval) | 28 Pa. Code §1151a.34 | Section 2A.12.8 / 2B.11.6 (Product Labeling and Packaging) |
| DOH-approved laboratory testing | 28 Pa. Code Ch. 1171a (ISO/IEC 17025) | Section 2A.12.9 / 2B.11.7 (Product Sampling and Testing) — CSQ requires ISO/IEC 17025 labs |
| Written recall plan (DOH may order a recall) | 28 Pa. Code §1151a.42 | Section 1.8 (Product Recalls and Withdrawals) + Section 1.6 (CAPA) |
| Seed-to-sale tracking (Commonwealth's designated system) | 28 Pa. Code §1151a.39 (+ §1151a.24) | Section 2A.10.1 / 2B.9.1 (Identification and Traceability) |
How to Prepare | A Realistic Path to CSQ Certification
Because CSQ is voluntary in Pennsylvania, step one is deciding whether it earns its place for you. If it does, most operators need 4 to 9 months, depending on permit type and scope, to be ready for an initial audit. Here is a sequence that works.
01
Decide whether CSQ is right for you
Pennsylvania doesn't require it, so weigh the value: DOH inspection readiness, investor / lender / M&A diligence, multi-state standardization, and buyer assurance. Because Pennsylvania already makes safe-and-sanitary processing and sanitation the law for a grower/processor, CSQ mostly certifies what you are already doing. If those matter, CSQ is worth pursuing.
02
Confirm your CSQ standard and level
Match your permit — the cultivation and the extraction/processing sides of your grower/processor permit, or a dispensary — to its CSQ standard, and decide whether Level 1 is enough or you want Level 2/3. Write the answer down; it drives every other step.
03
Run a gap analysis
Compare your current state to the CSQ standard, mapped against Pennsylvania's rules (the safe-and-sanitary processing of 28 Pa. Code §1151a.27 and the sanitation and pest-control rules of §1151a.33). ASI Training and Consulting, LLC can deliver a structured gap analysis as a separate engagement from the certification body.
04
Build the QMS documentation
Extend the controls Pennsylvania already requires — sanitation, storage, employee hygiene, and your recall plan — into a full CSQ quality management system with SOPs, CAPA, internal audit, document control, and recall/traceability (supporting the written recall plan Pennsylvania requires under §1151a.42 and seed-to-sale tracking under §1151a.39).
05
Address the cannabis-specific Critical items
The findings most likely to fail a first audit: CO₂ purity, ethanol grade, inhalation-grade ingredients for vaporization products, waste-stream separation, and route-of-administration risk assessments. Confirm your extraction and formulation controls are documented before the auditor arrives.
06
Train your team and run internal audits
Deliver competency-based, role-specific training on GMP, hygiene, PPE, allergen handling, and traceability. Then conduct a documented internal audit and an annual mock recall, and close nonconformities through CAPA.
07
Schedule your CSQ audit with Kiwa ASI
Schedule through Kiwa ASI in the CSQ Database. Allow time for the offsite documentation evaluation (1 day) plus the onsite audit (1–2 days depending on level). Request a quote to start.
Why Pennsylvania Operators Choose Kiwa ASI
Kiwa ASI brings nearly a century of food safety expertise and the global Kiwa network's footprint in 30+ countries to Pennsylvania — one of the largest U.S. medical-marijuana programs, where grower/processors and dispensaries operate under Department of Health GMP-analog rules.
Accredited
ISO/IEC 17065 + CSQ-Licensed
Audits and certificates are issued by ASI Food Safety, LLC — an ISO/IEC 17065-accredited certification body licensed by CSQ.
Expertise
Food-grade rigor for cannabis
Our auditors are credentialed food safety, GMP, and HACCP professionals with cannabis-specific qualifications. Cannabis is being regulated like food. We've been doing food for decades.
Efficiency
Direct scheduling, no surprises
Pre-audit scoping clarifies level, scope, and Module 3 requirements before you're onsite. Audit reports are turned around inside the standard CSQ timeline.
Comprehensive
Training and consulting available
Pre-assessments and gap analyses are delivered by ASI Training and Consulting, LLC, a separate legal entity, kept structurally separate from the certification body to safeguard impartiality under ISO/IEC 17065.
Continuity
Surveillance, recertification, transfer
If you're already CSQ-certified through another body and the relationship isn't working, we accept transfer audits. Continuity matters as much as the initial certificate.
Partnership
Global Kiwa network
Operations in 30+ countries. Useful when a Pennsylvania operator expands into other state markets or builds an international supply chain.
Frequently Asked Questions About Pennsylvania Medical Marijuana GMP & CSQ Certification
No. Pennsylvania does not mandate an accredited third-party GMP certificate, and it names no private GMP standard. But GMP practices are required of a grower/processor: safe-and-sanitary processing on food-grade surfaces (28 Pa. Code §1151a.27), sanitation and pest control (§1151a.33), controlled storage, a written recall plan (§1151a.42), and DOH-approved lab testing (Chapter 1171a). CSQ certification is voluntary: accredited, independent proof of that program.
Medical only. Pennsylvania legalized medical marijuana under the Medical Marijuana Act (Act 16 of 2016, 35 P.S. §10231.101 et seq.); there is no operational adult-use / recreational program. Legalization has been debated in the legislature but has not become law.
The Pennsylvania Department of Health (DOH), through its Office of Medical Marijuana, under the final-form regulations at 28 Pa. Code Part IXa — a health department, not a standalone cannabis commission. The Medical Marijuana Advisory Board is advisory only.
No. Pennsylvania prohibits incorporating medical marijuana into edible form at the licensed level (35 P.S. §10231.304(b)); a patient or caregiver may add it to food at home, but dispensaries cannot sell edibles. Permitted forms are a closed list: pills, oils, tinctures, topicals, liquids, and dry leaf for vaporization (28 Pa. Code §1151a.28). Dry leaf is for vaporization only — smoking is unlawful.
Yes — as practices, not a certificate. A grower/processor must process in a safe and sanitary manner on food-grade surfaces (§1151a.27), meet sanitation and pest-control rules (§1151a.33), and get prior DOH approval for any product (§1151a.28(b)). Pennsylvania verifies this through DOH permitting, inspection, and lab testing — it does not require a third-party GMP certificate, and its rules are its own, not tied to 21 CFR Part 111 or 117.
No. GMP compliance is verified through DOH permitting, inspection, and mandatory lab testing — not by a required outside auditor. The DOH-approved laboratory tests the product; it does not certify the grower/processor's GMP program. A CSQ certificate is voluntary and does not replace DOH inspection or lab testing.
No. The DOH regulations name no private food-safety or GMP standard for grower/processors — not CSQ, SQF, BRCGS, FSSC, or ISO 22000/22716. The one ISO standard Pennsylvania references (ISO/IEC 17025) applies only to testing laboratories. CSQ is a voluntary, accredited option delivered by ASI Food Safety; it is built to meet — not to satisfy or replace — Pennsylvania's rules.
A grower/processor uses CSQ Cultivation v2.0.0 for the growing side and CSQ Extraction or Manufacturing v2.0.0 for the extraction/processing side; dispensaries use CSQ Retail v1.0.0. Testing laboratories follow ISO/IEC 17025 (CSQ does not certify labs but requires ISO/IEC 17025). Kiwa ASI can combine scopes into one coordinated audit.
Packaging must be child-resistant, tamper-evident, opaque (except dry leaf), and resealable, with ingredients and an allergen warning; all packaging and label content needs prior DOH approval (28 Pa. Code §1151a.34). Pennsylvania does not mandate a state THC symbol and actually prohibits government-endorsement insignia. Potency is reported on the label, not capped; patient quantity is limited at dispensing (a 90-day supply / 192 medical marijuana units, §1161a.24).
Because it turns the extraction and processing GMP Pennsylvania already requires into accredited, independent proof. The highest-value cases: DOH inspection readiness, investor / lender / M&A due diligence, multi-state standardization (including a harder-posture state like New York, which mandates a third-party GMP audit for processors), and buyer assurance — plus audit-ready records that support the written recall plan and seed-to-sale tracking Pennsylvania requires. You are largely certifying work you already have to do.
Yes — but as separate legal entities to safeguard certification-body independence. CSQ certification audits are delivered by ASI Food Safety, LLC (the accredited certification body, ISO/IEC 17065 accredited and CSQ-licensed). Pre-assessments, gap analyses, training, and consulting are delivered by ASI Training and Consulting, LLC. The two operate independently to comply with ISO/IEC 17065 impartiality rules.