The short answer
A PCI 3DS assessment checks that an organisation running a 3DS Server, Directory Server or Access Control Server meets the PCI 3DS Core Security Standard. A PCI SSC-qualified 3DS Assessor tests the baseline controls (Part 1) and the 3DS-specific controls (Part 2), then records the results in a 3DS Report on Compliance and Attestation of Compliance.
On this page
A PCI 3DS assessment is how an organisation that runs part of the 3-D Secure infrastructure proves PCI 3DS compliance. A 3DS Assessor qualified by the PCI Security Standards Council (PCI SSC) tests your 3DS environment against the PCI 3DS Core Security Standard, then documents the results in a 3DS Report on Compliance (ROC) and Attestation of Compliance (AOC) for the payment brands, acquirers and issuers that rely on your service.
Sovereign Secure is listed by the PCI SSC as a 3DS Assessor for Europe, the USA, Canada, CEMEA (Central Europe, Middle East and Africa) and Asia Pacific. We are also a Qualified Security Assessor (QSA) company, so the PCI DSS assessment that most 3DS providers also need can be planned alongside the 3DS work, by the same team.
Who needs a PCI 3DS assessment?
The standard applies to organisations that perform or provide the three core 3-D Secure functions defined in EMVCo’s 3DS specification. Whether you must validate, and how often, is set by the payment brands’ compliance programmes, so the trigger is usually a brand, an issuer or an acquirer asking for your AOC.
| 3DS component | Usually operated by | What it does |
|---|---|---|
| 3DS Server (3DSS) | Payment gateways, payment service providers and specialist 3DS providers, on behalf of merchants | Starts each authentication request with transaction and device data |
| Directory Server (DS) | The payment brands, or operators acting for them | Routes messages between 3DS Servers and the right issuer |
| Access Control Server (ACS) | Issuers, or ACS providers acting for them | Decides whether to approve without friction or challenge the cardholder |
| Third-party services | Hosting, HSM, managed security and other providers to the above | May need to meet the requirements that apply to the service they provide |
Merchants that use 3-D Secure through their gateway to cut card-not-present fraud do not normally need a 3DS assessment of their own. Our guide to what PCI 3DS is and how 3-D Secure works explains the protocol and the merchant’s position.
What does a PCI 3DS assessment cover?
It covers your 3DS data environment (3DE): every system component that stores, processes or transmits 3DS sensitive data, plus the systems that can affect its security. The PCI 3DS Core Security Standard splits the requirements into two parts, and the PCI 3DS Data Matrix identifies which 3DS data elements count as sensitive and which key types need HSM protection.
| Part | What we test | Can PCI DSS results be used? |
|---|---|---|
| Part 1: Baseline Security Requirements | General security controls common to many standards: security policies, network security, secure systems, vulnerability management, access management, physical security and incident response | Yes, where the 3DE and cardholder data environment are combined, PCI DSS has been validated for every 3DS component, and your acquirer or the brands agree |
| Part 2: 3DS Security Requirements | Controls specific to 3DS: validating the scope of the 3DE, security governance, protecting 3DS systems, applications and data, logical access, cryptography and key management, and physically securing 3DS systems | No: Part 2 is always assessed directly |
Not every requirement applies to every component. The PCI SSC’s FAQs, for example, make the data centre and CCTV requirements in P2-7 mandatory for Directory Server and ACS systems but only recommended where a location hosts a 3DS Server alone, so scoping by function matters.
The published standard is v1.0, released in 2017 and supported by technical FAQs, which the PCI SSC treats as a mandatory part of the standard, and the Data Matrix. The PCI SSC consulted on a draft v2.0 from December 2023 to January 2024. We confirm the version in force when we scope, and you can check the PCI SSC 3DS Core page yourself.
What do you receive as proof of PCI 3DS compliance?
You receive two documents, both in the PCI SSC’s templates:
- A 3DS Report on Compliance. The detailed record of how each applicable requirement was tested and what was found. Where Part 1 relies on your PCI DSS validation, the report documents that coverage.
- A 3DS Attestation of Compliance. The summary you give to the payment brands, acquirers or issuers that ask for evidence of PCI 3DS compliance.
Unlike P2PE, there is no public PCI SSC list of 3DS-compliant entities, so the AOC is your proof. Validating PCI 3DS Part 1 does not replace your PCI DSS obligations, and a 3DS assessment cannot be used for PCI DSS validation.
How does a PCI 3DS audit run?
Each PCI 3DS audit follows the same five stages:
- Scoping. We confirm which 3DS functions you perform, map the 3DE with you, identify HSMs, sites and third parties, and agree whether Part 1 will rely on PCI DSS or be assessed directly.
- Readiness review (optional). A gap assessment against both parts of the standard, often focused on key management and HSM procedures, where 3DS environments most often need work. Advisory and assessment work are kept separate.
- Fieldwork. We review documents and records, interview staff, examine configurations and logs, sample systems and observe processes such as key management and access reviews. Sites are visited where the testing procedures call for observation.
- Reporting. We write the 3DS ROC and AOC, put them through our internal quality review and agree the findings with you before they are signed.
- The next cycle. The brands set how often you revalidate. We can line up your next 3DS and PCI DSS assessments so evidence is collected once.
How long it takes depends on your environment and readiness, so we give you a plan with dates after scoping rather than a standard timescale.
How does PCI 3DS relate to PCI DSS, PCI PIN and P2PE?
PCI 3DS and PCI DSS are separate, independent PCI security standards, but most 3DS providers need both, because a 3DS Server or ACS usually handles card numbers too.
| Standard | Assessor programme | Where it meets PCI 3DS |
|---|---|---|
| PCI DSS | QSA | Applies wherever account data is stored, processed or transmitted. It can support Part 1 if the 3DE was in scope, but never Part 2. An entity handling only payment tokens for 3DS may fall outside PCI DSS |
| PCI PIN Security Requirements | QPA | No formal link, but the same key management disciplines, such as dual control, split knowledge and HSM management, run through Part 2 |
| PCI P2PE | P2PE Assessor | Covers card-present encryption rather than online authentication; relevant to providers that offer both channels |
| EMVCo 3DS approval | Lab testing, not a PCI programme | Confirms your 3DS product works to EMVCo’s specification; it does not assess the security of your environment |
Planning the PCI DSS assessment and the 3DS assessment together, with aligned scope and timing, reduces duplicated evidence. Most 3DS providers are also PCI DSS service providers, which our page on PCI DSS for service providers covers.
3DS Servers and Access Control Servers expose APIs and web interfaces to the internet, so independent API penetration testing and PCI penetration testing are a sensible part of preparing for both assessments.
Why Sovereign Secure for PCI 3DS assessments?
- A listed 3DS Assessor. Sovereign Secure Ltd is on the PCI SSC 3DS Assessor list for Europe, the USA, Canada, CEMEA and Asia Pacific. We checked the listing on 13 October 2026, and you should check it yourself.
- QSA and 3DS Assessor in one company. If Part 1 is to rely on your PCI DSS validation, one team can make sure the PCI DSS scope covers the 3DE and the timing works.
- Key management depth. As a Qualified PIN Assessor and P2PE Assessor we already assess HSMs, key ceremonies and cryptographic key management, which is where Part 2 is most demanding.
- Five PCI SSC approvals. QSA, QPA, CPSA, P2PE Assessor and 3DS Assessor, and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.
- International reach. Headquarters at 16 Whalley Road, Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.
- Fixed quotes. You get a fixed price after a short scoping call, so you know the cost before work starts.
Talk to a 3DS Assessor
Tell us which 3DS functions you run, where your environment is hosted, whether you already validate PCI DSS and who is asking for your AOC. We will confirm the scope and send a fixed quote. Contact our PCI team or call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
