Audit — PCI Specialty Assessment

PCI 3DS
Assessment

Validate the security of your 3-D Secure environment with assessments conducted by PCI-qualified 3DS Assessors — ensuring your ACS, DS, or 3DSS meets the PCI 3DS Core Security Standard.

As EMV 3-D Secure adoption accelerates globally, payment brands require operators of 3DS components to demonstrate compliance with the PCI 3DS standard. We help issuers, acquirers, and 3DS service providers scope, prepare for, and pass their 3DS assessment efficiently.

3DS Components

What is PCI 3DS?

The PCI 3-D Secure (3DS) Core Security Standard defines security requirements for environments that perform or provide 3DS functions. EMV 3-D Secure is the authentication protocol used during card-not-present transactions to verify the cardholder's identity with the issuing bank — the technology behind Visa Secure, Mastercard Identity Check, and similar programs.

The standard applies specifically to the three core 3DS components: the Access Control Server (ACS) operated by issuers, the Directory Server (DS) operated by payment brands, and the 3DS Server (3DSS) operated by acquirers or their service providers. Each component has specific security requirements that must be validated through a formal assessment.

PCI 3DS assessments are conducted by PCI-qualified 3DS Assessors and result in a 3DS Assessment Report and Attestation of Compliance — required by payment brands for organizations operating these components.

What We Deliver

PCI 3DS Assessment Report
3DS Attestation of Compliance (AOC)
Gap analysis & readiness assessment
3DE scoping & boundary definition
Remediation support & implementation guidance

3DS Components We Assess

The PCI 3DS standard applies to three core components in the EMV 3-D Secure ecosystem

ACS

Access Control Server

Operated by or on behalf of card issuers. The ACS authenticates the cardholder during a 3DS transaction, determines whether the transaction should be challenged or frictionless, and generates the authentication response.

Operated by: Issuers, issuer processors
Key function: Cardholder authentication
DS

Directory Server

Operated by or on behalf of payment brands. The DS routes authentication messages between the 3DSS and ACS, maintains the card range data, and serves as the central routing hub of the 3DS ecosystem.

Operated by: Payment brands, brand processors
Key function: Message routing & card range management
3DSS

3DS Server

Operated by or on behalf of acquirers and merchants. The 3DSS initiates the authentication request, collects transaction and device data, communicates with the DS, and processes the authentication result.

Operated by: Acquirers, payment gateways, PSPs
Key function: Authentication initiation & data collection

Our PCI 3DS Services

End-to-end support from scoping through assessment and ongoing compliance

3DE Scoping & Gap Analysis

Define the 3-D Secure Environment (3DE) boundary, identify all in-scope components and connected systems, and assess your current posture against every PCI 3DS requirement to produce a prioritized remediation roadmap.

Formal 3DS Assessment

Our qualified 3DS Assessors conduct the formal on-site and remote assessment — evaluating your 3DE against all applicable requirements and producing the PCI 3DS Assessment Report and Attestation of Compliance.

Remediation Support

We work with your engineering teams to close identified gaps — from cryptographic key management and network segmentation to access controls, monitoring, and secure software development practices specific to 3DS environments.

Policy & Documentation

Develop the 3DS-specific policies, procedures, and operational documentation required by the standard — covering change management, incident response, key management, and personnel security for the 3DE.

PCI DSS Coordination

PCI 3DS requires baseline PCI DSS compliance for the 3DE. We coordinate both assessments — ensuring your PCI DSS and PCI 3DS scoping, evidence, and timelines are aligned to minimize duplication and effort.

Annual Re-assessment

Ongoing support for annual PCI 3DS re-assessments, change-impact analysis when your 3DS environment evolves, and monitoring of PCI SSC updates to the 3DS standard.

The Assessment Process

A structured approach from scoping through certification

01

3DE Scoping

Define the 3-D Secure Environment boundary — identifying all 3DS components, connected systems, network segments, and supporting infrastructure that fall within scope.

02

Gap Analysis & Remediation

Assess current state against PCI 3DS requirements, identify gaps, and work with your teams to implement remediation — closing findings before the formal assessment begins.

03

Formal Assessment

Our 3DS Assessors conduct the formal evaluation — interviews, documentation review, configuration examination, and testing — to validate compliance with all applicable requirements.

04

Report & AOC

We deliver the PCI 3DS Assessment Report and Attestation of Compliance — ready for submission to the payment brand that requires your 3DS compliance validation.

Why PCI 3DS Compliance Matters

Securing the authentication layer of card-not-present transactions.

Payment Brand Requirement

Visa, Mastercard, and other payment brands require 3DS component operators to validate compliance with the PCI 3DS standard. Non-compliance can result in restrictions on your ability to operate 3DS services.

Protect Authentication Integrity

3DS authentication is a critical fraud prevention mechanism. Ensuring the security of your ACS, DS, or 3DSS protects the integrity of the authentication process and reduces transaction fraud.

Reduce CNP Fraud Liability

Strong 3DS implementation with validated security shifts fraud liability appropriately and reduces the financial impact of card-not-present fraud across the payment ecosystem.

Regulatory Alignment

PCI 3DS compliance supports regulatory requirements for strong customer authentication (SCA) in jurisdictions like the EU (PSD2) and other markets adopting similar authentication mandates.

Market Differentiation

For 3DS service providers and processors, validated PCI 3DS compliance differentiates your offering and demonstrates security maturity to issuers, acquirers, and payment brands evaluating partners.

Secure Key Management

PCI 3DS includes rigorous cryptographic key management requirements that ensure the confidentiality and integrity of authentication data as it flows through the 3DS ecosystem.

Why Choose Gravity Innovision?

Qualified 3DS Assessors

Our 3DS assessments are conducted by PCI-qualified assessors with deep understanding of the EMV 3-D Secure protocol, the 3DS Core Security Standard, and the specific security challenges of ACS, DS, and 3DSS environments.

PCI DSS + 3DS Coordination

Since PCI 3DS requires baseline PCI DSS compliance, we coordinate both assessments under one engagement — aligning scoping, evidence collection, and timelines to avoid duplication and reduce your total compliance burden.

Payment Ecosystem Expertise

We understand the broader payment ecosystem — issuing, acquiring, processing, and the interplay between PCI DSS, PCI 3DS, PCI PIN, and other PCI standards. This context ensures your 3DS assessment is scoped correctly.

Implementation + Assessment

We don't just assess — we help you build. From 3DE architecture design and cryptographic key management through to the formal assessment, we cover the full lifecycle.

Ready for Your 3DS Assessment?

Whether you're an issuer, acquirer, or 3DS service provider, we'll scope the right assessment and get you to compliance efficiently.

Secure Your 3-D Secure Environment

Contact us today to discuss your PCI 3DS assessment needs — whether you operate an ACS, DS, 3DSS, or a combination of components.