PCI 3DS Core Security Standard

Self-Assess

Global (PCI Security Standards Council; applied through the payment brands' compliance programmes, e.g. listed in the Visa Core Rules of 18 April 2026 for all regions)

vv1.0 (October 2017), the only version; Technical FAQs September 2023; PCI 3DS Data Matrix v1.3 (September 2026)

14 domains

143 controls

The PCI Security Standards Council's standard for the environments in which EMV 3-D Secure core components run: the Access Control Server (ACS), Directory Server (DS) and 3DS Server. Part 1 sets baseline security (policy, risk, awareness, screening, networks, secure development, configuration and change, malware and vulnerabilities, access, physical security, incident response and logging) and can be met by leveraging a recent PCI DSS assessment of the same environment; Part 2 sets 3DS-specific controls (scope, governance, third parties, ACS and DS boundaries, APIs and web configuration, availability, customer and remote access, 3DS data protection with TLS per EMVCo and storage per the PCI 3DS Data Matrix, transaction monitoring, key management with HSMs at the ACS and DS, and data-centre and CCTV controls). Version 1.0 of October 2017 is current, with Technical FAQs of September 2023 and Data Matrix v1.3 of September 2026. Built from the Council's ROC template, which restates every requirement.

Verified

PCI 3DS Core Security Standard is a compliance framework from Global (PCI Security Standards Council; applied through the payment brands' compliance programmes, e.g. listed in the Visa Core Rules of 18 April 2026 for all regions) with 14 domains and 143 controls that map to 4 other frameworks. The largest domains are Part 1 Requirement P1-3: Develop and maintain secure systems – PCI 3DS Core Security Standard (17 controls), Part 2 Requirement P2-6: Cryptography and key management – PCI 3DS Core Security Standard (17 controls), Part 2 Requirement P2-3: Protect 3DS systems and applications – PCI 3DS Core Security Standard (14 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard Blokdyk

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (14)

Part 1 Requirement P1-1: Maintain security policies for all personnel – PCI 3DS Core Security Standard

12 controls

Controls in the Part 1 Requirement P1-1: Maintain security policies for all personnel – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 12 controls
Code	Title	Description
pci-3ds-core-security-standard::P1-1.1.1	P1-1.1.1 Organisation-wide security policy exists and reaches everyone concerned	The 3DS entity sets out its information security rules in one or more organisation-wide policies and makes sure every pe...
pci-3ds-core-security-standard::P1-1.1.2	P1-1.1.2 Policy revised when business aims or risks change	Security policies are revisited and amended whenever the organisation's business goals or its risk environment shift, so...
pci-3ds-core-security-standard::P1-1.1.3	P1-1.1.3 Policy changes communicated to the people affected	When a policy changes, the change is passed on to the personnel whose work it touches. The assessor checks the procedure...
pci-3ds-core-security-standard::P1-1.1.4	P1-1.1.4 Management approval of the security policy	The security policy carries the approval of management. The assessor looks for the approval in the documentation and con...
pci-3ds-core-security-standard::P1-1.1.5	P1-1.1.5 Personnel confirm they have read and understood the policy	Each person states in a record that the security policy has been read and its meaning grasped, and repeats that confirma...
pci-3ds-core-security-standard::P1-1.2.1	P1-1.2.1 Written risk-assessment process	The entity has written down how it assesses risk. The assessor reads the documented method and interviews those who run...
pci-3ds-core-security-standard::P1-1.2.2	P1-1.2.2 Risk assessment run yearly and after significant change	The documented risk-assessment process is carried out at least once a year and also whenever a significant change occurs...
pci-3ds-core-security-standard::P1-1.3.1	P1-1.3.1 Security awareness programme in operation	A security awareness programme is running that informs all relevant personnel about the security policy and the procedur...
pci-3ds-core-security-standard::P1-1.3.2	P1-1.3.2 Awareness training at set intervals, fitted to the role	Personnel take security awareness training at intervals the entity defines, with content appropriate to their job. Atten...
pci-3ds-core-security-standard::P1-1.3.3	P1-1.3.3 Staff know the policy and their own security duties	People understand the security policy and the security responsibilities that go with their particular job. The assessor...
pci-3ds-core-security-standard::P1-1.4.1	P1-1.4.1 Background screening before 3DE access	Personnel undergo background checks before they are given access to the 3DS environment. The assessor reads the screenin...
pci-3ds-core-security-standard::P1-1.4.2	P1-1.4.2 Screening criteria and decision process defined	Screening applies set criteria and a defined way of deciding what to do with background-check results. Evidence is the d...

Part 1 Requirement P1-2: Secure network connectivity – PCI 3DS Core Security Standard

7 controls

Controls in the Part 1 Requirement P1-2: Secure network connectivity – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 7 controls
Code	Title	Description
pci-3ds-core-security-standard::P1-2.1.1	P1-2.1.1 Boundary-protection policy and procedures for the 3DE	The entity keeps, and follows, a policy and procedures for protecting the boundaries of its 3DS environment. The assesso...
pci-3ds-core-security-standard::P1-2.1.2	P1-2.1.2 Current network and data-flow records for every 3DS path	Network and data-flow information is kept up to date for all communication paths that 3DS traffic uses. The assessor exa...
pci-3ds-core-security-standard::P1-2.1.3	P1-2.1.3 Physical or logical limits between trusted and untrusted zones	Physical controls, logical controls or both restrict what may pass from untrusted zones (networks, systems or applicatio...
pci-3ds-core-security-standard::P1-2.1.4	P1-2.1.4 Only necessary 3DS traffic permitted, rest denied	Traffic into and out of 3DS systems is limited to what is needed, and all other traffic is explicitly refused. The asses...
pci-3ds-core-security-standard::P1-2.1.5	P1-2.1.5 Network controls monitored or reviewed for effectiveness	Network connectivity controls are monitored, reviewed from time to time, or both, to confirm the configurations still wo...
pci-3ds-core-security-standard::P1-2.2.1	P1-2.2.1 Detection or blocking of known and unknown network attacks	Controls are in place that detect, block or both, network attacks of known types and of new or unknown types. The assess...
pci-3ds-core-security-standard::P1-2.2.2	P1-2.2.2 Suspicious traffic blocked or alerted and acted upon	Suspicious traffic is either blocked or produces an alert, and each alert is investigated and responded to. The assessor...

Part 1 Requirement P1-3: Develop and maintain secure systems – PCI 3DS Core Security Standard

17 controls

Controls in the Part 1 Requirement P1-3: Develop and maintain secure systems – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 17 controls
Code	Title	Description
pci-3ds-core-security-standard::P1-3.1.1	P1-3.1.1 Secure development lifecycle policy and procedures	The entity keeps, and follows, a policy and procedures for managing its software development lifecycle securely. The ass...
pci-3ds-core-security-standard::P1-3.1.2	P1-3.1.2 Developers trained in secure development	Everyone who takes part in software development is trained in secure development practice. Evidence is the training reco...
pci-3ds-core-security-standard::P1-3.1.3	P1-3.1.3 Development procedures address common coding weaknesses	Development procedures contain steps that deal with common coding vulnerabilities. The assessor reads the procedures and...
pci-3ds-core-security-standard::P1-3.1.4	P1-3.1.4 Security testing during development using documented methods	Software security testing takes place during the development lifecycle, using the methods the SDLC documentation describ...
pci-3ds-core-security-standard::P1-3.1.5	P1-3.1.5 Testing surfaces defects and vulnerabilities	The security testing process is capable of finding software defects and security weaknesses, and does so. The assessor l...
pci-3ds-core-security-standard::P1-3.1.6	P1-3.1.6 Defects and vulnerabilities fixed before release	Software defects and security weaknesses found in testing are dealt with before the software is released. The assessor c...
pci-3ds-core-security-standard::P1-3.1.7	P1-3.1.7 Management signs off test results before release	Management signs off the results of software security testing before software is released. Evidence is the sign-off reco...
pci-3ds-core-security-standard::P1-3.2.1	P1-3.2.1 Build and configuration management policy and procedures	The entity keeps, and follows, a policy and procedures for building systems and managing their configuration. The assess...
pci-3ds-core-security-standard::P1-3.2.2	P1-3.2.2 Current inventory of 3DS system components	An inventory of every 3DS system component is kept up to date. The assessor examines the inventory and asks how it is ma...
pci-3ds-core-security-standard::P1-3.2.3	P1-3.2.3 Configuration standards defined and applied to every 3DS system type	Configuration standards exist for each type of 3DS system and are implemented on the systems. The assessor reads the sta...
pci-3ds-core-security-standard::P1-3.2.4	P1-3.2.4 Standards cover known weaknesses and follow hardening benchmarks	Configuration standards deal with all known security vulnerabilities and rest on industry-accepted hardening guidance. T...
pci-3ds-core-security-standard::P1-3.2.5	P1-3.2.5 Build standards remove defaults, excess functions and mixed trust levels	Configuration standards and build procedures require three things: every vendor default account and system setting is ch...
pci-3ds-core-security-standard::P1-3.3.1	P1-3.3.1 Change-control procedures for all changes, including emergencies	Change-control procedures are defined and used for every change to system components, emergency changes included. The as...
pci-3ds-core-security-standard::P1-3.3.2	P1-3.3.2 Changes authorised with security impact understood first	Every change is authorised, and its security impact is understood, before it is implemented. Evidence is the change reco...
pci-3ds-core-security-standard::P1-3.3.3	P1-3.3.3 Changes tested outside production	Changes are tested in an environment that is not production before they are deployed. The assessor checks the procedure...
pci-3ds-core-security-standard::P1-3.3.4	P1-3.3.4 Rollback prepared for every change	A way of reversing each change is prepared before it is made. The assessor looks for back-out plans in change records an...
pci-3ds-core-security-standard::P1-3.3.5	P1-3.3.5 Unauthorised configuration changes prevented or detected and handled	Changes to system or application configurations that were not authorised are prevented, detected or both, and dealt with...

Part 1 Requirement P1-4: Vulnerability management – PCI 3DS Core Security Standard

9 controls

Controls in the Part 1 Requirement P1-4: Vulnerability management – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 9 controls
Code	Title	Description
pci-3ds-core-security-standard::P1-4.1.1	P1-4.1.1 Malware-protection policy and procedures	The entity keeps, and follows, a policy and procedures for protecting systems against malicious software. The assessor r...
pci-3ds-core-security-standard::P1-4.1.2	P1-4.1.2 Anti-malware controls active and maintained	Controls that prevent malicious software, or detect and remove it, are deployed, running and kept up to date. The assess...
pci-3ds-core-security-standard::P1-4.2.1	P1-4.2.1 Vulnerability-management policy and procedures	The entity keeps, and follows, a policy and procedures for finding vulnerabilities, ranking them and protecting against...
pci-3ds-core-security-standard::P1-4.2.2	P1-4.2.2 Quarterly internal and external vulnerability scans	Both internal and external vulnerability scans are run at least every quarter, and the vulnerabilities they reveal are d...
pci-3ds-core-security-standard::P1-4.2.3	P1-4.2.3 Scans run by qualified parties, external by an ASV	Scans are carried out by qualified people: the external ones by an Approved Scanning Vendor listed by PCI SSC, the inter...
pci-3ds-core-security-standard::P1-4.2.4	P1-4.2.4 Vulnerabilities ranked by criticality	Every vulnerability found is ranked so that its criticality is known. The assessor reads the ranking procedure and asks...
pci-3ds-core-security-standard::P1-4.2.5	P1-4.2.5 Annual penetration testing	A penetration test takes place every twelve months or more often. The assessor reviews the test reports and interviews s...
pci-3ds-core-security-standard::P1-4.2.6	P1-4.2.6 Penetration tests by qualified personnel	Penetration tests are carried out by qualified personnel. The assessor checks the reports and the testers' qualification...
pci-3ds-core-security-standard::P1-4.2.7	P1-4.2.7 High-risk findings fixed within a month, others promptly	Vulnerabilities and penetration-test findings rated high risk are fixed inside a month; every other weakness or security...

Part 1 Requirement P1-5: Manage access – PCI 3DS Core Security Standard

9 controls

Controls in the Part 1 Requirement P1-5: Manage access – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 9 controls
Code	Title	Description
pci-3ds-core-security-standard::P1-5.1.1	P1-5.1.1 Access-assignment policy and procedures	The entity keeps, and follows, a policy and procedures for assigning access. The assessor reads them and confirms their...
pci-3ds-core-security-standard::P1-5.1.2	P1-5.1.2 Roles and responsibilities defined for groups and accounts	Roles and responsibilities are defined for every group and account that can reach 3DS systems. The assessor examines the...
pci-3ds-core-security-standard::P1-5.1.3	P1-5.1.3 Least privilege by job function, reviewed periodically	Each individual receives only the privileges their job needs, and those privileges are reviewed from time to time. The a...
pci-3ds-core-security-standard::P1-5.2.1	P1-5.2.1 Account-management policy and procedures	The entity keeps, and follows, a policy and procedures for managing accounts. The assessor reads them and interviews sta...
pci-3ds-core-security-standard::P1-5.2.2	P1-5.2.2 Unique account ID per individual	Every individual is given their own account ID. The assessor reads the procedure and looks at account settings on 3DS sy...
pci-3ds-core-security-standard::P1-5.2.3	P1-5.2.3 Accounts and credentials kept confidential and intact	Controls protect accounts and their credentials from disclosure and from tampering. The assessor reads the procedures an...
pci-3ds-core-security-standard::P1-5.2.4	P1-5.2.4 Account misuse prevented	Controls prevent accounts from being misused. The assessor reads the procedures and observes the controls in operation.
pci-3ds-core-security-standard::P1-5.2.5	P1-5.2.5 Third-party access identified, controlled and monitored	Access held by third parties is known, controlled and watched. The assessor reads the procedures and observes the contro...
pci-3ds-core-security-standard::P1-5.3.1	P1-5.3.1 Strong authentication for all access to 3DS systems	Before anyone is let into a 3DS system, strong authentication must succeed. The assessor reads the procedures and observ...

Part 1 Requirement P1-6: Physical security – PCI 3DS Core Security Standard

5 controls

Controls in the Part 1 Requirement P1-6: Physical security – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 5 controls
Code	Title	Description
pci-3ds-core-security-standard::P1-6.1.1	P1-6.1.1 Physical-access policy and procedures for 3DS systems	The entity keeps, and follows, a policy and procedures that govern who may physically reach 3DS systems. The assessor re...
pci-3ds-core-security-standard::P1-6.1.2	P1-6.1.2 Entry controls limit and monitor physical access	Controls at the facility entrance limit who can physically reach 3DE systems and record or watch who enters. The assesso...
pci-3ds-core-security-standard::P1-6.1.3	P1-6.1.3 Physical access authorised by job function	Personnel physical access to the 3DE is authorised and based on each person's job. The assessor examines access permissi...
pci-3ds-core-security-standard::P1-6.1.4	P1-6.1.4 Physical access removed immediately on termination	When someone leaves, their access is revoked at once and all physical access means, such as keys and access cards, are r...
pci-3ds-core-security-standard::P1-6.2.1	P1-6.2.1 Strict control over media storage and access	Media are stored and made accessible only under strict control. The assessor observes the controls and interviews staff.

Part 1 Requirement P1-7: Incident response preparedness – PCI 3DS Core Security Standard

9 controls

Controls in the Part 1 Requirement P1-7: Incident response preparedness – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 9 controls
Code	Title	Description
pci-3ds-core-security-standard::P1-7.1.1	P1-7.1.1 Incident-management policy and procedures	The entity keeps, and follows, a policy and procedures for handling security incidents and reacting to them. The assesso...
pci-3ds-core-security-standard::P1-7.1.2	P1-7.1.2 Incident response plan with its required elements	The entity has a plan for responding to incidents that covers eight elements: who does what; how and whom to contact and...
pci-3ds-core-security-standard::P1-7.1.3	P1-7.1.3 Plan reviewed and tested every year	Every year, at a minimum, the response plan is both reviewed and exercised. Evidence is the documented procedure, record...
pci-3ds-core-security-standard::P1-7.2.1	P1-7.2.1 Audit-logging policy and procedures	The entity keeps, and follows, a policy and procedures for producing and managing audit logs. The assessor reads them an...
pci-3ds-core-security-standard::P1-7.2.2	P1-7.2.2 Logs tie access to individuals and record security events	Audit logs are set up so that every access to 3DS systems can be linked to an individual user and security events are re...
pci-3ds-core-security-standard::P1-7.2.3	P1-7.2.3 Clocks synchronised on 3DS systems	Time synchronisation is implemented so that the clocks of 3DS systems agree and show correct and consistent time. The as...
pci-3ds-core-security-standard::P1-7.2.4	P1-7.2.4 Logs and security events monitored or reviewed	Logs and security events from all 3DS systems are monitored, reviewed periodically or both, to find anomalies and suspic...
pci-3ds-core-security-standard::P1-7.2.5	P1-7.2.5 Audit logs protected from alteration	Audit logs are protected so nobody can alter them. The assessor examines controls and configurations and observes attemp...
pci-3ds-core-security-standard::P1-7.2.6	P1-7.2.6 Log retention of one year, three months at hand	Audit and monitoring logs are kept for at least one year, and the latest ninety days of them must be available for immed...

Part 2 Requirement P2-1: Validate scope – PCI 3DS Core Security Standard

3 controls

Controls in the Part 2 Requirement P2-1: Validate scope – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 3 controls
Code	Title	Description
pci-3ds-core-security-standard::P2-1.1.1	P2-1.1.1 In-scope networks and components identified	The entity identifies every network and system component that falls within scope of the PCI 3DS requirements. The assess...
pci-3ds-core-security-standard::P2-1.1.2	P2-1.1.2 Out-of-scope networks justified with their segmentation	Every network treated as out of scope is listed together with the reason it is excluded and a description of the segment...
pci-3ds-core-security-standard::P2-1.1.3	P2-1.1.3 Connected entities with 3DE access identified	Every connected entity that has access to the 3DS environments is identified. The assessor examines the documentation an...

Part 2 Requirement P2-2: Security governance – PCI 3DS Core Security Standard

12 controls

Controls in the Part 2 Requirement P2-2: Security governance – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 12 controls
Code	Title	Description
pci-3ds-core-security-standard::P2-2.1.1	P2-2.1.1 Security objectives aligned with business objectives	The entity's security objectives are consistent with its business objectives. The assessor examines documentation and in...
pci-3ds-core-security-standard::P2-2.1.2	P2-2.1.2 Security responsibility and accountability formally assigned	Responsibility and accountability for meeting the security objectives are formally given to named roles, and this includ...
pci-3ds-core-security-standard::P2-2.1.3	P2-2.1.3 Responsibility for evolving risks assigned	Someone is formally responsible for spotting and dealing with new and changing risks. The assessor examines documentatio...
pci-3ds-core-security-standard::P2-2.2.1	P2-2.2.1 Formal risk-management strategy defined	A formal strategy for managing risk is defined. The assessor examines documentation and interviews personnel.
pci-3ds-core-security-standard::P2-2.2.2	P2-2.2.2 Risk strategy approved and kept current	Someone with the authority to do so approves the risk-management strategy, and it is amended as the risk environment cha...
pci-3ds-core-security-standard::P2-2.3.1	P2-2.3.1 Periodic checks that staff follow security policies	Reviews, monitoring or both are carried out periodically to confirm personnel are following the security policies and pr...
pci-3ds-core-security-standard::P2-2.3.2	P2-2.3.2 Security control failures detected and responded to	Processes are defined and in use to detect failures of security controls and to respond to them. The assessor examines t...
pci-3ds-core-security-standard::P2-2.4.1	P2-2.4.1 Third-party relationship policies and procedures	The entity keeps, and follows, policies and procedures governing how it deals with its third parties. The assessor exami...
pci-3ds-core-security-standard::P2-2.4.2	P2-2.4.2 Due diligence before engaging a third party	Due diligence is performed before any engagement with a third party begins. The assessor examines the procedure, the res...
pci-3ds-core-security-standard::P2-2.4.3	P2-2.4.3 Security responsibilities defined per engagement	For each third-party engagement, the security responsibilities are clearly set out. The assessor examines documentation...
pci-3ds-core-security-standard::P2-2.4.4	P2-2.4.4 Third parties' agreed responsibilities verified periodically	The 3DS entity checks from time to time that the agreed responsibilities are actually being met. The assessor examines t...
pci-3ds-core-security-standard::P2-2.4.5	P2-2.4.5 Written agreements maintained	Written agreements with third parties are kept. The assessor examines documentation and interviews personnel.

Part 2 Requirement P2-3: Protect 3DS systems and applications – PCI 3DS Core Security Standard

14 controls

Controls in the Part 2 Requirement P2-3: Protect 3DS systems and applications – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 14 controls
Code	Title	Description
pci-3ds-core-security-standard::P2-3.1.1	P2-3.1.1 ACS and DS traffic limited to 3DS functions	Traffic to and from the ACS and the DS is limited to what is relevant to the 3DS functions. The assessor examines log fi...
pci-3ds-core-security-standard::P2-3.1.2	P2-3.1.2 ACS and DS reachable only through approved interfaces	Traffic to and from the ACS and the DS is allowed only through approved interfaces. The assessor examines log files and...
pci-3ds-core-security-standard::P2-3.2.1	P2-3.2.1 Configurations and security documentation protected	Controls keep system configurations, and the documents behind security settings, secret from those who should not see th...
pci-3ds-core-security-standard::P2-3.3.1	P2-3.3.1 Production applications protected from unauthorised change	Once applications and programs are in production, they are protected from changes that have not been authorised. The ass...
pci-3ds-core-security-standard::P2-3.3.2	P2-3.3.2 Application protection mechanisms monitored and maintained	The mechanisms that stop unauthorised change to applications and programs are themselves monitored and kept in working o...
pci-3ds-core-security-standard::P2-3.3.3	P2-3.3.3 APIs to the 3DE identified, defined and tested	Every API that interfaces with the 3DS environment is identified, has its definition documented and is tested to confirm...
pci-3ds-core-security-standard::P2-3.3.4	P2-3.3.4 APIs exposed to untrusted networks protected	Controls protect every API that is exposed to untrusted networks. The assessor examines diagrams, observes the controls,...
pci-3ds-core-security-standard::P2-3.4.1	P2-3.4.1 Only required HTTP methods accepted	Web components accept only the HTTP request methods the system needs to operate; every other method is explicitly blocke...
pci-3ds-core-security-standard::P2-3.4.2	P2-3.4.2 HTTPS enforced everywhere	HTTPS is required for every application page and resource, and nothing is allowed to travel over insecure channels such...
pci-3ds-core-security-standard::P2-3.4.3	P2-3.4.3 External content rejected by default	Applications, or the systems beneath them, are set to refuse content supplied by external sources unless an exception ha...
pci-3ds-core-security-standard::P2-3.4.4	P2-3.4.4 Framing by untrusted sites prevented	Applications are configured so their content cannot be embedded in untrusted third-party sites or applications, except w...
pci-3ds-core-security-standard::P2-3.4.5	P2-3.4.5 Native framework protections enabled	Security features built into the development framework or application platform are switched on wherever practical, as a...
pci-3ds-core-security-standard::P2-3.5.1	P2-3.5.1 Availability mechanisms against loss of 3DS processing	Mechanisms are in place to protect the 3DS infrastructure against loss of processing capability. The assessor examines d...
pci-3ds-core-security-standard::P2-3.5.2	P2-3.5.2 Availability mechanisms monitored and maintained	The availability mechanisms are monitored and maintained so that their effectiveness is confirmed. The assessor observes...

Part 2 Requirement P2-4: Secure logical access to 3DS systems – PCI 3DS Core Security Standard

8 controls

Controls in the Part 2 Requirement P2-4: Secure logical access to 3DS systems – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 8 controls
Code	Title	Description
pci-3ds-core-security-standard::P2-4.1.1	P2-4.1.1 Issuer and merchant user access to their own interfaces	Issuer and merchant users reaching their assigned interfaces (for example an API or web portal) to manage only their own...
pci-3ds-core-security-standard::P2-4.2.1	P2-4.2.1 Multi-factor for all non-console personnel access	Staff reaching the ACS, DS or 3DS Server by any route other than the console must pass more than one authentication fact...
pci-3ds-core-security-standard::P2-4.3.1	P2-4.3.1 Multi-factor for remote access into the 3DE	All remote access that starts outside the entity's network and leads into the 3DE requires multi-factor authentication....
pci-3ds-core-security-standard::P2-4.3.2	P2-4.3.2 Remote access controlled and documented	Remote connections into the 3DE are governed and written down, stating the system components remote access may reach, th...
pci-3ds-core-security-standard::P2-4.3.3	P2-4.3.3 Rules for personally owned devices used remotely	Where staff may connect remotely from their own devices, strict rules are set and applied: security controls on each dev...
pci-3ds-core-security-standard::P2-4.3.4	P2-4.3.4 Remote access privileges reviewed at least quarterly	An authorised individual monitors or reviews remote-access privileges at least every quarter to confirm the access is st...
pci-3ds-core-security-standard::P2-4.4.1	P2-4.4.1 No wireless use by 3DS components	The ACS, DS and 3DS Server are kept entirely off wireless networks, neither using them nor attached to them. The assesso...
pci-3ds-core-security-standard::P2-4.5.1	P2-4.5.1 VPNs into the 3DE securely configured	Every VPN that gives access to the 3DE is set up to provide strong security for communications and to resist eavesdroppi...

Part 2 Requirement P2-5: Protect 3DS data – PCI 3DS Core Security Standard

12 controls

Controls in the Part 2 Requirement P2-5: Protect 3DS data – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 12 controls
Code	Title	Description
pci-3ds-core-security-standard::P2-5.1.1	P2-5.1.1 3DS data lifecycle policies and procedures	The entity keeps, and follows, policies and procedures for how 3DS data is used, where it flows, how long it is kept and...
pci-3ds-core-security-standard::P2-5.1.2	P2-5.1.2 3DS data kept only as long as needed, then purged securely	3DS data is retained only for as long as necessary and is securely purged once it is no longer needed. The assessor exam...
pci-3ds-core-security-standard::P2-5.2.1	P2-5.2.1 Strong cryptography for 3DS sensitive data in transit	Strong cryptography and security protocols protect 3DS sensitive data while it is transmitted. The assessor examines doc...
pci-3ds-core-security-standard::P2-5.2.2	P2-5.2.2 No fallback to insecure protocols	Fallback to insecure cryptographic protocols or configurations is not allowed. The assessor examines documentation and c...
pci-3ds-core-security-standard::P2-5.3.1	P2-5.3.1 TLS between 3DS components uses only allowed cipher suites	All TLS communications for 3DS transmissions among the ACS, DS and 3DS Server use only the cipher suites that EMVCo's co...
pci-3ds-core-security-standard::P2-5.3.2	P2-5.3.2 No EMVCo-unsupported cipher suites offered	The ACS, DS and 3DS Server neither offer nor support any cipher suite the EMVCo specification marks as not supported. Th...
pci-3ds-core-security-standard::P2-5.3.3	P2-5.3.3 No rollback to unapproved algorithms or key sizes	TLS configurations do not allow a rollback to algorithms, key sizes or implementations that are not approved. The assess...
pci-3ds-core-security-standard::P2-5.3.4	P2-5.3.4 TLS configurations monitored for change	Controls monitor TLS configurations so that changes are spotted and a secure configuration is maintained. The assessor o...
pci-3ds-core-security-standard::P2-5.4.1	P2-5.4.1 Stored 3DS sensitive data limited to permitted elements	Only the 3DS sensitive data elements that are permitted may be stored. Which elements count, and which component may sto...
pci-3ds-core-security-standard::P2-5.4.2	P2-5.4.2 Strong cryptography for stored 3DS sensitive data	Wherever storage of 3DS sensitive data is permitted, it is protected with strong cryptography. Technical FAQ Q1 (April 2...
pci-3ds-core-security-standard::P2-5.5.1	P2-5.5.1 3DS transactions monitored for anomalies	3DS transactions are monitored so that anomalous activity is identified, logged and alerted on. The assessor examines do...
pci-3ds-core-security-standard::P2-5.5.2	P2-5.5.2 Anomalous transaction activity investigated promptly	Unusual or suspicious transaction behaviour is looked into and resolved promptly. The assessor examines documented proce...

Part 2 Requirement P2-6: Cryptography and key management – PCI 3DS Core Security Standard

17 controls

Controls in the Part 2 Requirement P2-6: Cryptography and key management – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 17 controls
Code	Title	Description
pci-3ds-core-security-standard::P2-6.1.1	P2-6.1.1 Cryptography and key-management policies and procedures	The entity keeps, and follows, policies and procedures for managing its cryptographic processes and keys. The assessor e...
pci-3ds-core-security-standard::P2-6.1.10	P2-6.1.10 Incident response covers key-related issues	Incident response procedures include steps for reporting and responding to suspected or confirmed key-related problems....
pci-3ds-core-security-standard::P2-6.1.2	P2-6.1.2 HSM for specified keys at ACS and DS	At the ACS and DS, all key-management activity for the cryptographic keys the PCI 3DS Data Matrix specifies (Table 2 in...
pci-3ds-core-security-standard::P2-6.1.3	P2-6.1.3 HSM deployed according to its security policy	At the ACS and DS, the HSM is deployed securely under its security policy: an HSM chosen for its FIPS validation must ru...
pci-3ds-core-security-standard::P2-6.1.4	P2-6.1.4 Documented cryptographic architecture	The entity has written down its cryptographic architecture, stating what each key is used for and which keys each HSM ho...
pci-3ds-core-security-standard::P2-6.1.5	P2-6.1.5 Keys managed securely through their whole lifecycle	Cryptographic keys are managed securely at every lifecycle stage: generation; distribution or conveyance; storage; set c...
pci-3ds-core-security-standard::P2-6.1.6	P2-6.1.6 Key management follows recognised standards	Key-management processes conform to recognised national or international key-management standards. The assessor examines...
pci-3ds-core-security-standard::P2-6.1.7	P2-6.1.7 Keys used only for their intended purpose	Each cryptographic key is used only for the purpose it was intended for, and no key serving 3DS is ever put to a non-3DS...
pci-3ds-core-security-standard::P2-6.1.8	P2-6.1.8 Trusted CA for all 3DS certificates	Every certificate the 3DS Server, ACS and DS present to one another comes from a certificate authority that can be trust...
pci-3ds-core-security-standard::P2-6.1.9	P2-6.1.9 Audit logs for key-management and clear-text component activity	Audit logs are kept for all key-management activity and for all activity involving clear-text key components, recording...
pci-3ds-core-security-standard::P2-6.2.1	P2-6.2.1 Logical HSM access at the console or through an evaluated solution	At the ACS and DS, personnel with logical access to HSMs either work at the HSM console or use a non-console access solu...
pci-3ds-core-security-standard::P2-6.2.2	P2-6.2.2 Non-console HSM access originates only from the 3DE	At the ACS and DS, all non-console access to HSMs starts from a 3DE network. (Under the Technical FAQ Q3 alternative, no...
pci-3ds-core-security-standard::P2-6.2.3	P2-6.2.3 Devices used for non-console HSM access secured	At the ACS and DS, devices that give personnel non-console access to HSMs are kept in a designated secure area watched a...
pci-3ds-core-security-standard::P2-6.2.4	P2-6.2.4 No clear-text key loading or export over non-console links	At the ACS and DS, no clear-text key, key component or key share ever enters or leaves the HSM through a non-console con...
pci-3ds-core-security-standard::P2-6.2.5	P2-6.2.5 Non-console activity meets all other HSM and key rules	At the ACS and DS, anything done through non-console access still complies with every other HSM and key-management requi...
pci-3ds-core-security-standard::P2-6.3.1	P2-6.3.1 HSMs kept in dedicated areas	At the ACS and DS, HSMs are housed in one or more dedicated areas. The assessor examines the 3DS device inventory and ob...
pci-3ds-core-security-standard::P2-6.3.2	P2-6.3.2 Physical HSM access restricted and under dual control	At the ACS and DS, physical access to HSMs is limited to authorised personnel and handled under dual control. The assess...

Part 2 Requirement P2-7: Physically secure 3DS systems – PCI 3DS Core Security Standard

9 controls

Controls in the Part 2 Requirement P2-7: Physically secure 3DS systems – PCI 3DS Core Security Standard domain of PCI 3DS Core Security Standard — 9 controls
Code	Title	Description
pci-3ds-core-security-standard::P2-7.1.1	P2-7.1.1 ACS and DS hosted in data centres	The ACS and DS run from proper data-centre facilities. The assessor observes where the ACS and DS are located.
pci-3ds-core-security-standard::P2-7.1.2	P2-7.1.2 Single-entry portal with positive authentication	Data centres supporting the ACS and DS have a positively controlled single-entry portal, such as a mantrap, that grants...
pci-3ds-core-security-standard::P2-7.1.3	P2-7.1.3 Electronic access control on internal doors to 3DS areas	Doors to areas inside the data centre that contain 3DS systems have an electronic access control system, such as card re...
pci-3ds-core-security-standard::P2-7.1.4	P2-7.1.4 Multi-factor entry to telecom rooms outside the data centre	Getting into a telecom room located outside a secure data centre needs more than one authentication factor. The assessor...
pci-3ds-core-security-standard::P2-7.1.5	P2-7.1.5 Anti-piggybacking entry controls	Entry controls stop piggybacking by admitting one person at a time, each of whom must be identified and authenticated fi...
pci-3ds-core-security-standard::P2-7.1.6	P2-7.1.6 Intrusion detection linked to the alarm system	Physical intrusion detection is installed and wired into the alarm system. The assessor interviews personnel and observe...
pci-3ds-core-security-standard::P2-7.1.7	P2-7.1.7 Physical connection points into the 3DE controlled at all times	Physical connection points that lead into the 3DE are under control at all times. The assessor observes the physical con...
pci-3ds-core-security-standard::P2-7.2.1	P2-7.2.1 CCTV at every entrance and emergency exit	Cameras watch every entrance and every emergency exit, around the clock, and record images good enough to identify peopl...
pci-3ds-core-security-standard::P2-7.2.2	P2-7.2.2 CCTV recordings time-stamped	CCTV recordings carry a time stamp. The assessor examines the CCTV records.

Your Compliance Coverage

If you comply with PCI 3DS Core Security Standard, you already cover:

PCI DSS 4.0

82%

117 controls mapped

Compare →

ISO 27002:2022

22%

31 controls mapped

Compare →

PCI PIN Security

10 controls mapped

Compare →

+ 1 more: EMV 3-D Secure (3DS) - Payment Authentication Protocol (4%)

See all 4 mapped frameworks ↓

Maps to 4 other frameworks

143 total controls

PCI DSS 4.0

117 source controls mapped|103 target controls covered

82%

ISO 27002:2022

31 source controls mapped|27 target controls covered

22%

PCI PIN Security

10 source controls mapped|9 target controls covered

EMV 3-D Secure (3DS) - Payment Authentication Protocol

6 source controls mapped|4 target controls covered

Compare PCI 3DS Core Security Standard with PCI DSS 4.0

Coverage is not the same as your position

This page shows what PCI 3DS Core Security Standard overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.

The Compliance Position Diagnostic, $5,000 fixed, ten business days

What is PCI 3DS Core Security Standard and who does it apply to?

PCI 3DS Core Security Standard is a compliance framework from Global (PCI Security Standards Council; applied through the payment brands' compliance programmes, e.g. listed in the Visa Core Rules of 18 April 2026 for all regions) with 14 domains and 143 controls. The PCI Security Standards Council's standard for the environments in which EMV 3-D Secure core components run: the Access Control Server (ACS), Directory Server (DS) and 3DS Server. Part 1 sets baseline security (policy, risk, awareness, screening, networks, secure development, configuration and change, malware and vulnerabilities, access, physical security, incident response and logging) and can be met by leveraging a recent PCI DSS assessment of the same environment; Part 2 sets 3DS-specific controls (scope, governance, third parties, ACS and DS boundaries, APIs and web configuration, availability, customer and remote access, 3DS data protection with TLS per EMVCo and storage per the PCI 3DS Data Matrix, transaction monitoring, key management with HSMs at the ACS and DS, and data-centre and CCTV controls). Version 1.0 of October 2017 is current, with Technical FAQs of September 2023 and Data Matrix v1.3 of September 2026. Built from the Council's ROC template, which restates every requirement. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does PCI 3DS Core Security Standard actually require?

PCI 3DS Core Security Standard has 143 controls organised across 14 domains. The largest domains are Part 1 Requirement P1-3: Develop and maintain secure systems – PCI 3DS Core Security Standard (17 controls), Part 2 Requirement P2-6: Cryptography and key management – PCI 3DS Core Security Standard (17 controls), Part 2 Requirement P2-3: Protect 3DS systems and applications – PCI 3DS Core Security Standard (14 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of PCI 3DS Core Security Standard do I already cover?

PCI 3DS Core Security Standard maps to 4 other compliance frameworks. The top mapping partners are PCI DSS 4.0 (82% coverage), ISO 27002:2022 (22% coverage), PCI PIN Security (7% coverage). Use our comparison tool to explore control-level mappings between frameworks.

How do I implement PCI 3DS Core Security Standard?

Start your PCI 3DS Core Security Standard compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about PCI 3DS Core Security Standard requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 143 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 727 frameworks.

Get Started Free →

Free forever — no credit card required