What a PCI 3DS Assessment Covers for ACS and 3DS Server Operators
An organisation running an Access Control Server (ACS) or a 3DS Server handles data and cryptographic material that, if compromised, would undermine authentication for every card it touches. The PCI Security Standards Council (PCI SSC) addresses this with the PCI 3DS Core Security Standard. It is often confused with the Payment Card Industry Data Security Standard (PCI DSS), but it is a separate standard with its own scope and its own assessment.
Who the standard applies to
The PCI 3DS Core Security Standard applies to environments where 3DS Server, ACS or Directory Server functions are performed. PCI SSC calls such an environment the 3DS data environment (3DE). In practice that means:
- acquirers, PSPs, gateways and merchants that operate a 3DS Server themselves
- issuers and issuer processors that operate an ACS
- card schemes operating Directory Servers
- providers that host any of these components for others
A merchant that uses a PSP’s 3DS Server does not perform the 3DS Server function itself, so the 3DE belongs to the provider. A merchant that runs its own 3DS Server brings the standard into its own scope, which is one of the trade-offs covered in using one 3DS Server across multiple acquirers.
What the two parts cover
| Part | What it covers | Relationship to PCI DSS |
|---|---|---|
| Part 1: Baseline Security Requirements | Technical and operational controls protecting the 3DE, such as network, system and physical security | Can be met using the results of a PCI DSS assessment, where that assessment is verified to cover the 3DE |
| Part 2: 3DS Security Requirements | Controls specific to 3DS data, technology and processes, starting with validating the scope of the 3DE | Specific to PCI 3DS; must be assessed in their own right |
A supporting document, the PCI 3DS Data Matrix, identifies EMV 3DS data elements that are subject to the standard’s requirements. It helps teams work out which data in their logs, databases and message stores needs protection under PCI 3DS.
How the assessment works
A PCI 3DS assessment is carried out by an assessor qualified by PCI SSC. The assessor validates scope, tests the controls through interviews, configuration sampling and document review, and records the result in a report and an Attestation of Compliance (AoC). The AoC template asks which 3DS functions the entity performs and records the EMVCo Letter of Approval reference for each component, which ties the secure operation of the environment back to the approved product (what an EMVCo Letter of Approval means).
Where the entity has a current PCI DSS assessment covering the 3DE, the AoC allows Part 1 requirements to be marked as in place under PCI DSS. Part 2 still has to be assessed.
How scope changes when the component is hosted
Many operators run their ACS or 3DS Server on a cloud platform or use a hosted service. Responsibility is then shared. Google Cloud’s published applicability paper is one example of a platform provider describing which PCI 3DS requirements it covers and which remain with its customers. The same question applies to any hosting arrangement: which requirements does the provider’s attestation cover, and which remain yours?
For a fully hosted ACS or 3DS Server, the provider normally holds the PCI 3DS attestation for the environment it operates. The customer should obtain the provider’s AoC, check that it covers the functions the customer relies on, and confirm what remains in its own scope, such as the systems that send data to or receive data from the hosted service.
Questions for a hosted provider
- Which 3DS functions does your PCI 3DS Attestation of Compliance cover?
- When was the assessment completed, and when is the next one due?
- Which EMVCo approval numbers are recorded against the components?
- Which requirements, if any, remain the customer’s responsibility?
Frequently asked questions
Is PCI 3DS the same as PCI DSS?
No. They are separate standards. PCI DSS protects cardholder data environments generally; PCI 3DS applies to environments performing 3DS Server, ACS or Directory Server functions. A PCI DSS assessment can be used to meet PCI 3DS Part 1 where it covers the 3DS environment.
Does a merchant using a PSP’s 3DS Server need PCI 3DS?
Normally not for the 3DS Server function, because the PSP performs it. The merchant’s own PCI DSS obligations still apply to its payment environment.
Does PCI 3DS cover the 3DS SDK?
No. The PCI 3DS SDK Security Standard is a separate standard for organisations that develop 3DS SDKs.
Is EMVCo approval enough without PCI 3DS?
No. EMVCo approval confirms the product conforms to the protocol. PCI 3DS confirms the environment running it is secure. Operators need both, alongside scheme testing.
Who decides when a PCI 3DS assessment is required?
The card schemes set compliance requirements for entities in their 3DS programmes. Confirm the current requirements and validation timing with each scheme or your acquiring or issuing partner.
Operating 3DS components securely
GPayments provides ActiveAccess, an Access Control Server for issuers and issuer processors, and ActiveServer, a 3DS Server for acquirers, gateways, PSPs and merchants. To discuss deployment and hosting options for either, speak with a GPayments 3DS specialist.
