CM3 certification is a third-party prequalification system that checks a contractor's workplace health and safety systems before a client will engage them. For anyone hiring a security company, it answers one question: has this provider proven its safety and compliance credentials, or are you taking their word for it?
Metro Guards holds CM3 certification alongside ISO and ASIAL Gold accreditation, and is licensed by the Licensing & Regulation Division (LRD), Victoria Police.
What Is CM3 Certification, Exactly?
CM3 certification is run by Cm3, Australia's leading contractor prequalification, compliance, and safety management system, which gives client organisations access to a database of more than 20,000 assessed contractors.
A qualified assessor reviews a company's safety management system, insurance records, licences, and incident history, then verifies the findings independently instead of accepting a contractor's self-declaration.
For a security contractor, this matters because the work sits inside someone else's premises. A hospital, construction site, or shopping centre bringing in outside personnel needs proof that those personnel operate under a proper safety management system, not just a sales pitch. CM3 certification gives them that proof in one document instead of a stack of unverified paperwork.
How CM3 Prequalification Works for a Security Contractor
CM3 prequalification starts with a detailed questionnaire covering WHS policies, risk assessments, training records, and insurance. Once submitted, Greencap's assessors review the evidence and issue a compliance rating, which client companies can view directly on the CM3 platform before they sign a contract.
For a CM3-certified security company, the process does not stop at approval. Certification runs on a 12-month cycle, so contractors resubmit updated insurance certificates, incident logs, and safety documentation annually to keep their status current.
That ongoing cycle is what separates contractor prequalification from a one-off compliance check. A provider cannot get certified once and coast on it.
Why CM3 Certification Matters When Hiring a Security Company
Security contractor compliance is not a paperwork exercise. Security officers work night shifts, patrol construction sites, respond to alarms, and manage crowds, all environments with real injury risk.
Safe Work Australia's 2025 national data recorded more than 400 serious workplace injury claims lodged across the country every day, and 188 worker deaths from traumatic workplace injuries in 2024. A security company without a documented safety management system is a liability risk for every site it operates on, not just for its own staff.
There's also an accountability angle. If a contractor's officer is injured or causes an incident on your site and that contractor has never had its WHS compliance verified, the client's own duty of care comes into question.
ASIAL, the peak national body for the security industry, represents approximately 85% of Australian security providers, but ASIAL membership alone does not confirm a company's day-to-day safety practices the way CM3 certification does. The two credentials answer different questions, and a serious provider carries both.
Here's what that looks like in practice. A shopping centre engaging overnight security guards may require CM3 certification before allowing officers on site, because it demonstrates the contractor has documented safety procedures, current insurance, and verified training records.
Without that certification, the centre's facilities manager would need to chase down each of those documents separately and take the contractor's word that they're current.
CM3 Certification in Australia: How It Sits Alongside Other Security Company Certifications
CM3 certification Australia-wide is not the only credential worth checking, but it fills a gap that the others don't. ISO certification confirms a company runs a documented quality management system. ASIAL membership confirms industry standing and access to codes of conduct.
Being licensed by the Licensing & Regulation Division (LRD), Victoria Police confirms that individual officers and the business are legally permitted to operate. CM3 certification confirms something different again: that an independent assessor has reviewed the company's actual safety management system and found it compliant.
CM3 vs ISO: What Each One Actually Checks
People searching "ISO or CM3" are usually trying to work out which one their contractor needs, or whether one covers the other. It doesn't.
ISO 9001 certification, the standard most security companies hold, verifies that a business runs a consistent, documented quality management system across its operations, from how it onboards clients to how it handles complaints. It's an operational standard, not a safety-specific one.
CM3 certification, on the other hand, is built entirely around WHS compliance. It looks at safety management plans, incident history, insurance coverage, and training records, then has those specifically assessed by a qualified safety professional rather than a quality auditor.
The difference between ISO and CM3 comes down to what each one is designed to catch: ISO checks how consistently a business operates, CM3 checks how safely it operates. A security company holding both has covered two separate risks, not the same one twice.
Security company certifications work best stacked together, not viewed as interchangeable. A licensed security provider with only an LRD licence has cleared the legal minimum. One with CM3 certification, ISO, and ASIAL membership on top has been checked from several angles: legal, operational, and safety.
Certification | What it verifies |
|---|---|
LRD Licensed (Victoria) | Legal right to operate as a security provider and an individual officer |
ISO | Documented quality management system |
ASIAL membership | Industry standing and code of conduct compliance |
CM3 certification | Independently verified WHS compliance and risk management |
What to Check Beyond CM3 Certification
Certifications narrow the field, but they don't answer every question a client needs before signing a contract. Response times, site-specific experience, and communication during an incident matter just as much day to day.
Due diligence on a security contractor should also cover how they manage their own subcontractors, if any, and whether their safety management system extends to casual and part-time staff or only permanent officers. A contractor management system is only as strong as its weakest link.
Metro Guards: CM3 Certified and Backed by 17+ Years in Melbourne
The Metro Guards team has operated as a licensed security provider in Melbourne for 17+ years. Our CM3 certification sits alongside ISO certification, ASIAL Gold membership, and our LRD Licence, and we maintain all four.
Our compliance and accreditation page sets out our full certification history for clients who need it in writing before a contract is signed. Regulatory compliance isn't a marketing line for us. It's checked, renewed, and verified every year.
Ready to Work with a CM3 Certified Security Company?
If you're comparing security contractor compliance before a tender or contract renewal, ask to see the certificate first. Get a quote from Metro Guards, and we'll send our current CM3, ISO, and ASIAL Gold documentation along with it.
Frequently Asked Questions
What does CM3 certification mean for a security company?
It means an independent Greencap assessor has reviewed the company's WHS policies, insurance, training records, and incident history, and confirmed they meet recognised safety standards. It's renewed annually, not a one-time badge.
Is CM3 certification mandatory for security contractors in Australia?
No single law requires it, but many government agencies, hospitals, and large corporations only engage contractors who hold CM3 certification as part of their own risk management obligations.
How long does CM3 certification last?
Certification runs on a 12-month cycle. Contractors resubmit updated documentation, including insurance and safety records, each year to stay certified.
Is CM3 certification the same as ISO certification?
No. ISO certification verifies a company's quality management system, covering how consistently it operates day to day. CM3 certification verifies WHS compliance, specifically, including safety management systems, insurance, and training records.
What's the difference between CM3 certification and ASIAL membership?
ASIAL membership confirms a company's standing in the security industry and its commitment to an industry code of conduct. CM3 certification independently verifies the company's actual WHS compliance and safety management system.
How do I check if a security company is actually CM3 certified?
Ask for their CM3 certificate directly, or check the CM3 platform if the client organisation already has a login. A legitimate CM3-certified security company will have no issue producing current documentation on request.
Does CM3 certification cover casual and part-time security staff?
It should. When checking a contractor's certification, ask specifically whether their safety management system and training records extend to casual and part-time officers, not just permanent staff.
