PCI 3DS Explained: The 3DS Core Security Standard and Who Needs It

PCI 3DS is the PCI Security Standards Council’s 3DS Core Security Standard. It protects the systems that run EMV 3-D Secure authentication: 3DS Servers, Directory Servers and Access Control Servers. It applies to the organisations that operate those components, not to merchants that simply use a 3DS service, and compliance is validated by a PCI SSC-qualified 3DS Assessor.

3-D Secure is the protocol behind the extra authentication step many online card payments now go through. When it works well, most customers never notice it. This guide explains what the PCI 3DS standard is, how the protocol works, who needs PCI 3DS, how the standard is structured, how it relates to PCI DSS and how to prepare.

Sovereign Secure is a PCI SSC-listed 3DS Assessor. If you run a 3DS Server, Directory Server or Access Control Server and need to be assessed, our PCI 3DS assessments page explains how the assessment works and what you receive.

Key takeaways

• The PCI 3DS Core Security Standard applies to entities running 3DS Servers, Directory Servers and Access Control Servers.
• It has two parts: baseline security (Part 1) and 3DS-specific controls (Part 2).
• A current PCI DSS validation that covers the whole 3DS environment can be used for Part 1, if your acquirer or the brands agree.
• Assessments are carried out by PCI SSC-qualified 3DS Assessors and reported to the payment brands.
• Using 3-D Secure does not reduce a merchant’s PCI DSS scope.

What is PCI 3DS?

Two organisations share responsibility for 3-D Secure. EMVCo writes the protocol specification that defines how 3DS messages flow. The PCI Security Standards Council publishes the security standard for the systems that run it. First published in 2017, the PCI 3DS Core Security Standard sets out how those systems and the sensitive data they handle must be protected.

“PCI 3DS compliance” therefore means an entity operating a 3DS component has met the Core Security Standard, confirmed by a qualified 3DS Assessor and reported in line with the payment brands’ programmes. The published standard is v1.0, and the Council consulted on a draft v2.0 from December 2023 to January 2024. The current standard, reporting templates and FAQs are in the PCI SSC document library. Unlike P2PE, the PCI SSC does not list 3DS entities that have been assessed; the Attestation of Compliance is the evidence.

How does EMV 3-D Secure work?

The protocol lets the card issuer authenticate the cardholder during an online payment, using data exchanged between three domains:

Version 2 of the protocol, EMV 3DS (often called 3DS2), shares far more transaction and device data than the original version. That lets issuers approve most low-risk payments without a challenge while still meeting Strong Customer Authentication (SCA) rules in the UK and EEA. 3DS exists to reduce card-not-present fraud, and successful authentication generally shifts liability for fraud-related chargebacks from the merchant to the issuer.

All of this depends on the integrity of the 3DS components. A compromised ACS or 3DS Server could approve fraudulent transactions or expose sensitive authentication data, which is why a dedicated standard exists.

Who needs to comply with PCI 3DS?

The Core Security Standard applies to entities that perform or provide 3DS Server, Directory Server or Access Control Server functions. In practice that means:

• 3DS Server providers, often payment gateways or specialist authentication vendors serving merchants
• ACS providers that run authentication on behalf of card issuers
• Directory Server operators, typically the payment brands themselves

Whether and how often validation is required is set by the payment brands through their own 3DS programmes, so confirm the requirement with the relevant brand. Merchants that use a third-party 3DS service do not usually need their own assessment, but they should check that their provider is validated.

What does the 3DS Core Security Standard require?

The standard is split into two parts.

Part 1: Baseline security requirements cover the fundamentals: security policies, network connectivity, secure systems, vulnerability management, access management, physical security and incident response preparedness. These closely mirror PCI DSS. If the 3DS and cardholder data environments are combined and your current PCI DSS validation covers every 3DS system component, it may be used to meet Part 1, subject to your acquirer or the payment brands. If not, Part 1 is assessed directly.

Part 2: 3DS security requirements are specific to 3DS and always have to be assessed. They cover areas including:

Key management is where 3DS environments most often need work. Organisations familiar with PCI PIN compliance will recognise many of the same principles, including dual control and split knowledge.

What is the 3DS data environment?

The standard applies to the 3DS data environment (3DE): every system component that stores, processes or transmits 3DS sensitive data, plus the systems that can affect its security, such as firewalls, authentication servers, logging systems and HSMs. Scoping the 3DE accurately is the first and most important step, because it drives both the cost and the outcome of the assessment. Segmentation can reduce it, but only if it is documented and tested.

What is the difference between PCI 3DS and PCI DSS?

A 3DS Server usually handles PANs too, so most 3DS providers need both. A PCI DSS assessment alone is not enough for 3DS functions, and a 3DS assessment does not replace PCI DSS for the wider cardholder data environment. Planning the two together, with aligned scope, shared evidence and coordinated timing, reduces effort considerably. Our guide to PCI DSS requirements sets out the other half of the picture.

Does using 3-D Secure reduce PCI DSS scope?

No. 3-D Secure authenticates the cardholder; it does not change where card data is entered, stored or transmitted. A merchant’s PCI DSS scope depends on how its payment page and systems handle card data, which is why e-commerce merchants still need to manage payment page scripts under PCI DSS for e-commerce, whether or not they use 3DS. Our free PCI compliance check shows which SAQ your checkout points to.

How do you prepare for PCI 3DS validation?

1. Scope the 3DE. Draw a data flow diagram showing where 3DS messages and sensitive data enter, move through and leave your environment, and identify every connected system.
2. Run a gap analysis. Compare your controls with both parts of the standard. If you plan to rely on PCI DSS for Part 1, confirm that your current PCI DSS scope includes the 3DE and that the validation will still be current at the time of the 3DS assessment.
3. Review key management. Document every cryptographic key used in 3DS operations: its purpose, where it is generated and stored, who has access and how it is rotated. Confirm HSM configuration and dual control procedures.
4. Test the exposed services. 3DS Servers and ACSs expose APIs and web interfaces to the internet, so independent API penetration testing is a sensible part of preparation.
5. Collect evidence. Assessors look for evidence that controls operated throughout the period: configurations, logs, change records, access reviews and key ceremony records.
6. Formal assessment. A qualified 3DS Assessor reviews evidence, interviews staff and examines systems, then produces a 3DS Report on Compliance and Attestation of Compliance for the payment brands. Our PCI 3DS assessments page sets out how we run this stage.

How Sovereign Secure can help

Formal PCI 3DS validation must be carried out by a qualified 3DS Assessor. Sovereign Secure appears on the PCI SSC list of 3DS Assessors for Europe, the USA, Canada, CEMEA and Asia Pacific, and our PCI 3DS assessments cover operators of 3DS Servers, Directory Servers and Access Control Servers. Because we are also a QSA company, we can carry out the PCI compliance audit whose scope supports Part 1 and plan both assessments together.

Our PCI DSS consultancy and PCI DSS penetration testing help you prepare the wider environment. Our overview of PCI compliance services covers every standard we assess: PCI DSS, PCI PIN, card production, P2PE and 3DS.