Guide
PCI 3DS: the standard behind 3-D Secure, and who it covers
PCI 3DS refers to the PCI 3DS Core Security Standard. It protects the systems that run 3-D Secure authentication. So it mainly applies to providers, not to most merchants.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
What PCI 3DS covers
3-D Secure adds a cardholder authentication step to online payments. The PCI 3DS standard therefore protects the environments that perform those functions.
- 3DS Server functions
- Access Control Server functions
- Directory Server functions
Who must meet PCI 3DS
The standard applies to entities that perform or provide those functions. However, a merchant using a provider's 3-D Secure service is usually not assessed against it.
| Entity | Usually in scope? |
|---|---|
| 3DS Server provider | Yes |
| Issuer or ACS provider | Yes |
| Merchant using a provider | Usually not, but PCI DSS still applies |
PCI 3DS applicability check
Tick what describes your business.
Your result appears here as you tick, so you can see what is still open.
PCI 3DS compared with PCI DSS
PCI DSS protects account data wherever it is stored, processed or transmitted. In contrast, PCI 3DS focuses on 3-D Secure environments and the keys they use. Also, many 3DS providers must meet both.
How the assessment works
Assessments are carried out by assessors qualified for 3DS by PCI SSC. So the evidence approach resembles PCI DSS, but the requirements differ.
Where we help
We are not a QSA or a 3DS assessor. However, we help providers organise documentation and close gaps before assessment. Gap analysis runs $8,000 to $40,000. The standard is in the PCI SSC document library.
Also check contracts with your 3-D Secure provider. For example, confirm which party maintains which controls, and how evidence is shared. So responsibilities stay clear when the assessor asks. In addition, keep both standards in one calendar, because PCI DSS and PCI 3DS deadlines rarely line up on their own.
PCI 3DS questions
Do merchants need PCI 3DS compliance?
Usually not, when they use a provider. PCI DSS still applies to them.
Is PCI 3DS the same as 3-D Secure?
No. 3-D Secure is the protocol, while PCI 3DS is the security standard for its environments.
Who assesses PCI 3DS?
Assessors qualified by PCI SSC for the 3DS standard.
Does 3-D Secure reduce PCI DSS scope?
No. It adds authentication but does not change how account data is protected.
Related guides
Prepare for a PCI 3DS assessment
Tell us your role in 3-D Secure. We reply with a written estimate, usually inside one business day. Also include any parent company or hosting partner in the conversation early. Because shared infrastructure often supports the 3DS environment, their controls may need to be evidenced as well. So the scope stays accurate from the start.
Get my written estimate