Who Must Validate PCI 3DS Core Compliance?
PCI 3DS Core applies to entities that perform, or provide environments for, ACS, DS or 3DS Server functions. Payment brands determine who must validate.
- Access Control Server (ACS) Operators
- Directory Server (DS) Operators
- 3DS Server Providers
- Issuers and Issuer Processors Hosting ACS Functions
- Payment Gateways and PSPs Offering 3DS Services
- Service Providers Hosting 3DS Environments
PCI 3DS Assessment Approach
Deliverables
Clear, evidence-based outputs aligned to your 3DS functions, environment and payment brand obligations.
3DE Scope and Applicability Summary
PCI 3DS ROC and AOC
Readiness and Gap Assessment Report
Prioritized Remediation Tracker
PCI DSS Overlap Mapping
Compliance Roadmap
Supporting Services
Technical and managed services that strengthen 3DS environment security.
Web Application Penetration Testing
Test ACS, 3DS Server and related web interfaces for exploitable weaknesses.
Learn More
Vulnerability Assessment
Identify network and system weaknesses across the 3DS environment.
Learn More
SOC Monitoring
24/7 monitoring to detect threats targeting authentication infrastructure.
Learn More
PCI Bundled Compliance Solutions
Choose a PCI pathway aligned to your 3DS role, designed to reduce duplicated evidence and improve assessment outcomes.
Core PCI 3DS Package
EssentialsFor ACS, DS and 3DS Server environments
-
3DE scoping and boundary validation
-
Gap assessment across Part 1 and Part 2
-
Remediation roadmap and evidence checklist
-
ROC and AOC reporting support
Integrated PCI Suite
BundledPCI 3DS + PCI DSS + PCI PIN (integrated assessment approach)
-
Unified scope across authentication and payment systems
-
Overlap mapping between PCI DSS and 3DS Part 1
-
Coordinated evidence strategy
-
Assessor-led readiness and reporting
Advanced PCI + Ecosystem Security
ProgramFor multi-entity or multi-region 3DS providers
-
PCI 3DS + PCI DSS + PCI PIN, with optional P2PE
-
Continuous compliance plan
-
Risk-based roadmap with a governance cadence
-
Assessment cycle planning and stakeholder reporting
Benefits of a PCI 3DS Core Assessment
Protect Authentication Data
Safeguard 3DS data and cryptographic keys used in card-not-present authentication.
Clarify 3DS Scope
Define the 3DE clearly so controls focus on the right systems.
Meet Payment Brand Obligations
Complete the ROC and AOC required by the payment brands you serve.
Reuse PCI DSS Effort
Apply fully implemented PCI DSS controls toward Part 1 baseline requirements.
Support Issuer and Partner Trust
Show issuers, schemes and merchants a structured 3DS security program.
Enable Continuous Compliance
Keep 3DS controls operating between assessment cycles.
Why 3DS Providers Choose QRC
Qualified assessors. Integrated payment-security expertise. Evidence-led reporting.
- PCI DSS QSA Company
- Qualified PIN Assessor (QPA) Company
- PCI 3DS Assessor Company
- P2PE Assessor and P2PE Application Assessor
- Secure Software and Secure SLC Assessor
- Evidence-first methodology
- Reduced assessment friction
- Defensible, well-documented findings
- Alignment to PCI SSC program requirements
- 3DE scoping and gap assessment
- Remediation advisory
- Formal assessment and reporting
- PCI DSS alignment and ongoing support
Member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2024-2026 and 2026-2028, staying aligned with evolving interpretations and practice.
- ROC and AOC aligned documentation
- Traceable control evidence
- Board and payment brand-ready reporting
PCI 3DS assessments serviced across Asia Pacific, CEMEA, Europe and the USA, as shown on QRC's PCI SSC listing.
PCI Case Studies
Explore how teams reduced PCI scope, closed control gaps, and improved audit readiness across different payment ecosystems.
PCI 3DS Certification For Payment Software Service
The PCI 3DS certification ensures that an organization has implemented the appropriate safeguards to protect their customers’ credit card data. It helps in reducing CNP…
Read full Case StudyPCI 3DS Resource Center
Guides and articles to support secure card-not-present authentication.
Overview of Various PCI SSC Security Standards
PCI SSC maintains various PCI security standards, supporting programs, and related documentation
Merchant’s guide for payment security requirements
Ecommerce, online payment transactions are advancing their path in this developing technology.
Web skimmer on the rise amidst the Covid-19 crisis
Consumers today have ramped up their online usage and with brick and mortar stores out of reach.
Delivery attacks the increasing of payment fraud
Ongoing Corona Crisis have led to a spike in the number of fraudulent transactions and cybercriminal
RBI issues new norms for digital payments
With rising cases of cyber fraud RBI published a Master Direction providing necessary guidelines.
Challenges and Solutions to enable compliance pci
The PA DSS was introduced to provide a guideline for the development of payment applications.
Frequently Asked Questions
PCI 3DS Core Security Standard v1.0 is the version in effect, used alongside the PCI 3DS Data Matrix. PCI SSC consulted on a draft v2.0, and QRC confirms the applicable version when scoping.
No. 3DS Core covers ACS, DS and 3DS Server environments. 3DS SDKs had a separate standard, assessed by PCI-recognized laboratories, with a sunset period from 1 May to 31 October 2026. Secure Software v2.0 now supports 3DS SDK assessments.
Where PCI DSS is fully implemented across the 3DS environment, additional controls may not be needed for Part 1 baseline requirements. PCI DSS results cannot be used to validate Part 2 3DS security requirements.
No. PCI SSC does not list entities assessed to PCI 3DS Core. The ROC and AOC go to the payment brands or other entities that request validation.
Timing depends on your 3DS functions, number of environments and locations, control maturity and evidence availability. QRC confirms a defensible timeline after the initial scoping and readiness discussion.
One 3DS Environment. The Right PCI Services. A Clear Path
to Compliance.
Bring 3DS assessment, PCI DSS alignment and security testing together in one
coordinated engagement.