PCI 3DS

PCI 3DS applies to organisations that operate a 3-D Secure function:

• 3DS Server (3DSS) providers that initiate authentication for a merchant or payment gateway.
• Directory Server (DS) operators that route the authentication request to the right issuer.
• Access Control Server (ACS) providers that challenge the cardholder and return the authentication result.

Merchants that only redirect a shopper into someone else's 3DS flow are usually in scope for PCI DSS, not for PCI 3DS. The standard follows the party that runs the authentication service.

PCI 3DS sets security requirements for the 3DS environment and for the 3DS data that moves through it. That includes how the environment is segmented, how access is controlled, how authentication messages are protected, and how the service is monitored and tested.

The assessment looks at the systems that generate, route, or decide a 3-D Secure authentication. A passing result is evidence an issuer, a payment brand, or a partner can rely on when they accept that service into the 3DS ecosystem.

Crossbow helps 3DS providers get ready for assessment without treating it as a paperwork exercise:

• Scope the 3DS Server, Directory Server, or Access Control Server and the systems connected to them.
• Compare current controls with the PCI 3DS security requirements and write the gaps in the order they should be fixed.
• Test the technical controls, including access, logging, and the protection of authentication messages.
• Prepare the evidence an assessor or a payment brand will ask to see.

Where you already run PCI DSS or PCI SSF, we reuse the controls that overlap so 3DS does not become a second, separate programme.