PCI 3DS Certification - Step-by-Step Process

What does PCI 3DS certification involve? PCI 3DS certification is an assessment of the environment running ACS, DS or 3DS Server components against the PCI 3DS Core Security Standard v1.0. The standard comprises a baseline part (Part 1) and 3DS-specific requirements (Part 2); a qualified 3DS assessor performs it, and the result is documented in a ROC and an AOC.

Canonical definition: PCI 3DS certification is a formal assessment of a 3DE (3DS Data Environment) against the requirements of the PCI 3DS Core Security Standard, performed by a qualified 3DS assessor and confirmed by a ROC and an AOC.

The path looks different for an organisation that already holds a certified PCI DSS environment and for one starting from scratch. This article describes both scenarios step by step, along with the most common problems.

PCI 3DS certification – key takeaways:

The PCI 3DS Core Security Standard v1.0 applies to entities performing ACS, DS or 3DS Server functions – not to ordinary merchants.
Part 1 (Baseline Security Requirements) protects the 3DE and resembles PCI DSS in structure; Part 2 (3DS Security Requirements) covers controls specific to 3DS data and processes.
A valid PCI DSS assessment can be used to satisfy Part 1 – the PCI 3DS AOC then marks “In Place per PCI DSS” for the baseline requirements.
The assessment is accompanied by the PCI 3DS Data Matrix, which identifies 3DS data elements, including sensitive data subject to specific protection.
PCI 3DS certification is separate from EMVCo product approval – it covers the environment and processes, not a component’s functional conformance with the protocol.
Patronusec, an accredited QSA, guides providers through the full PCI 3DS process – from setting the 3DE boundary to assessment and AOC.

What is PCI 3DS certification and who does it apply to?

PCI 3DS certification assesses the security of the environment where ACS, DS or 3DS Server functions are performed, and of the systems that impact them. The PCI 3DS Core Security Standard v1.0 sets out the requirements and assessment procedures for these three core EMV 3DS components – it does not apply to ordinary merchants using 3DS.

The assessed entity (the 3DS entity) is an organisation performing at least one core function: an ACS operator (usually on behalf of issuing banks), a DS operator (payment networks) or a 3DS Server operator (gateways, acquirers, specialist providers). The environment under assessment is the 3DE (3DS Data Environment) – systems performing 3DS functions and those connected to or impacting them.

The standard exists to support the EMV 3DS protocol requirements from an operational security angle. It is complemented by the PCI 3DS Data Matrix – a document identifying the data elements typical of 3DS transactions, including sensitive data (3DS sensitive data) subject to specific protection requirements.

PCI 3DS certification assesses the environment and processes of an entity performing ACS, DS or 3DS Server functions, whereas EMVCo approval assesses the product’s conformance with the protocol – two separate, complementary tracks.

The fix: an organisation entering the 3DS services market needs both confirmations – EMVCo for the product and PCI 3DS for the environment – plus registration in each payment network’s programmes.

What does the standard consist of – Part 1 and Part 2?

The PCI 3DS standard splits into two parts: Part 1 is the baseline security requirements protecting the 3DE, and Part 2 is the requirements specific to 3DS data, technologies and processes. A 3DS assessor evaluates both parts, but they differ in character and source.

Part 1 – Baseline Security Requirements
Technical and operational requirements protecting the 3DE, based on general information security principles common to many standards. In structure and character they resemble a PCI DSS assessment: access control, vulnerability management, segmentation, monitoring, policies. This is the “security hygiene” layer of the environment.

Part 2 – 3DS Security Requirements
Controls designed specifically to protect 3DS data and processes: securing the sensitive data defined in the Data Matrix, protecting the protocol’s cryptographic keys in HSMs, controls specific to authentication flows and component interworking. This is the layer that cannot be copied from other standards – the essence of PCI 3DS certification.

The assessment methodology is classic PCI: the assessor examines evidence (documents, screenshots, configuration files, logs), observes actions in the environment and verifies the actual state. Each requirement is marked “in place”, “not in place” or “not applicable” with justification.

Part 1 of the PCI 3DS standard answers “is the environment secure at all”, and Part 2 answers “are 3DS data and processes protected in a protocol-specific way” – and it is Part 2 that forms the core no other standard can cover.

What does certification look like when you already have a PCI DSS environment?

When the 3DE sits within a certified PCI DSS environment (the CDE), a valid PCI DSS assessment can serve to satisfy Part 1 of the PCI 3DS standard. The PCI 3DS AOC then marks the Part 1 requirements “In Place per PCI DSS”, and the assessment proper focuses on Part 2.

The step-by-step path for an organisation with a valid PCI DSS:

Set the 3DE boundary and check whether it sits entirely within the certified CDE – the condition for using the PCI DSS assessment for Part 1.
Verify the PCI DSS currency and scope – the assessment must be valid and cover the systems making up the 3DE.
Map Part 1 onto the PCI DSS results – the assessor confirms that the PCI DSS assessment covers the baseline requirements; where gaps exist (for example a 3DE-specific requirement not within the DSS scope), it supplements the assessment.
The Part 2 assessment proper – full examination of the 3DS-specific requirements: sensitive data from the Data Matrix, protocol keys in HSMs, authentication flows.
ROC and AOC documentation – the assessment report and attestation per the PCI 3DS v1.0 templates, marking which Part 1 requirements were met via PCI DSS.

The benefit is measurable: the organisation avoids repeating the full baseline assessment and concentrates effort on Part 2. The condition, however, is hard – the 3DE must genuinely sit within the PCI DSS scope, not merely sit next to it.

Patronusec Insight: In our project experience, using PCI DSS for Part 1 most often stumbles not on compliance itself but on scope boundaries. It happens that the 3DE shares infrastructure with the CDE only partly – some 3DS systems lie outside the scope of the last DSS assessment. The “saving” on Part 1 then proves illusory, because the assessor must assess the non-DSS systems anyway. Before you assume PCI DSS will cover Part 1, verify that EVERY 3DE system was in scope of the last PCI DSS ROC – a few days’ question that saves weeks.

Hold a PCI DSS certificate and want to know whether it will cover Part 1 of PCI 3DS certification?

Patronusec performs a 3DE vs CDE scope mapping: we compare your 3DS environment boundary against the scope of your last PCI DSS assessment and flag the systems needing separate Part 1 assessment. Within 10 working days you receive a written coverage map and a gap list.

Order a 3DE vs CDE scope mapping

What does certification look like without a PCI DSS environment?

Without a valid PCI DSS assessment, the organisation undergoes a full assessment of both parts of the standard: Part 1 and Part 2 are assessed from scratch by a 3DS assessor. The path is longer, because it covers the full baseline layer, but it requires no prior compliance with any other standard.

The step-by-step path for an organisation without PCI DSS:

Role classification and 3DE boundary – establishing which function (ACS, DS, 3DS Server) the organisation performs and which systems make up the assessment environment.
Gap analysis against the full standard – Part 1 and Part 2 together; this stage surfaces gaps such as incomplete segmentation, unstructured protocol key management or monitoring gaps.
Remediation – implementing the missing baseline controls (access, vulnerabilities, logging) and 3DS-specific controls (sensitive data protection, keys in HSMs).
The Part 1 and Part 2 assessment proper – full examination of every requirement of both parts, with evidence examination, observation and verification of the actual state.
ROC and AOC documentation – the report and attestation covering the full set of the standard’s requirements.

The choice between paths is not always obvious. An organisation without PCI DSS that processes card data anyway often considers a parallel PCI DSS certification – not just for Part 1, but because processing card data is subject to that standard under payment network rules regardless. The decision is best made on a dependency map, not on the cost of a single assessment.

Decision tree – which path to take:

Do you hold a valid, current PCI DSS assessment?
- NO → go to question 3.
- YES → go to question 2.
Does the entire 3DE sit within the scope of that PCI DSS assessment?
- YES → the path using PCI DSS for Part 1; focus the assessment on Part 2.
- NO → a mixed path: PCI DSS covers part of Part 1, the rest and Part 2 are assessed separately.
Does your environment process card data subject to PCI DSS?
- YES → consider a parallel PCI DSS certification (required anyway), then PCI 3DS using it for Part 1.
- NO → a full PCI 3DS assessment (Part 1 + Part 2) without PCI DSS.

What are the most common problems and challenges in PCI 3DS certification?

The most common problems fall into three areas: mis-setting the 3DE boundary, incompletely using PCI DSS for Part 1, and underestimating the protocol key protection requirements in Part 2. Each can extend the project or block the assessment.

What practitioners usually get wrong:

❌ Setting the 3DE boundary too narrowly – omitting supporting systems (admin panels, HSM management, monitoring) that the assessor will include in scope anyway, because they impact 3DS functions.

❌ Assuming PCI DSS automatically covers all of Part 1 – without verifying that every 3DE system was in the scope of the last PCI DSS ROC; coverage gaps surface only at the assessment.

❌ Underestimating protocol key protection – DS keys and other 3DS cryptographic material require HSM-based management and procedures at the level Part 2 expects; improvised key management is a frequent non-compliance.

❌ Confusing environment certification with product approval – the organisation obtains an EMVCo Letter of Approval and assumes it “has 3DS”, skipping the separate PCI 3DS environment assessment.

❌ Overlooking sensitive data from the Data Matrix – failing to recognise which processed data elements are classified as 3DS sensitive data and subject to specific protection.

❌ Treating PCI 3DS as a one-off project – without planning maintained compliance and the reassessment cycle required by payment networks.

The single biggest risk in PCI 3DS certification is a badly set 3DE boundary – an error at this stage propagates through the whole project, because it determines which systems fall under assessment at all.

How long does a PCI 3DS certification project take and how should you plan it?

The duration depends above all on the starting point and on whether the organisation uses PCI DSS for Part 1. A project with a valid, well-mapped PCI DSS is shorter, because the assessment concentrates on Part 2; a project from scratch covers the full baseline layer and remediation.

The typical project phases, whichever path applies:

Scoping – setting the 3DE boundary, classifying the role, deciding whether and how to use PCI DSS for Part 1.
Gap analysis – comparing the current state against the applicable requirements; the earlier, the fewer surprises at assessment.
Remediation – closing the gaps; usually the longest and least predictable phase, especially around keys and segmentation.
The assessment proper – evidence examination, observation, verification by the 3DS assessor.
Documentation and AOC – the ROC and attestation; reporting and submission per each payment network’s procedures.

A practical recommendation: do not start by commissioning the assessment, but by scoping and gap analysis. Commissioning an assessment on an unverified scope is the most common cause of a situation where the assessment discovers gaps instead of confirming their absence, and the project returns to remediation behind schedule.

Patronusec guides organisations through all phases within its PCI 3DS certification service, and where a parallel PCI DSS is involved, it combines the two processes to exploit the synergy between Part 1 and the DSS assessment.

Planning a PCI 3DS certification and unsure which path to take?

Patronusec runs a PCI 3DS scope-assessment: in a free 30-minute call we classify your role (ACS, DS, 3DS Server), establish whether and how to use PCI DSS for Part 1, and estimate the remediation scope. After the call you receive a written summary with a recommended path and a realistic timeline.

Book a free scope-assessment

FAQ

Does PCI 3DS certification replace EMVCo approval?

No. They are two separate, complementary tracks. EMVCo approval confirms a product’s (ACS, DS, 3DS Server, SDK) conformance with the protocol and ends with a Letter of Approval. PCI 3DS certification assesses the security of the environment and processes and ends with a ROC and an AOC. A 3DS service operator needs both.

Does every 3DS Server operator need PCI 3DS?

Yes, if it performs core 3DS functions. The PCI 3DS standard applies to entities performing ACS, DS or 3DS Server functions. The specific expectations on scope and compliance timelines are additionally set by each payment network’s programme, so it is worth verifying them with your settlement partners.

Can I use one PCI DSS audit for multiple 3DEs?

Only for the 3DE systems that were genuinely in scope of that PCI DSS assessment. If part of the 3DS environment lies outside the scope of the last PCI DSS ROC, those systems require a separate Part 1 assessment. Precisely mapping the 3DE boundary against the PCI DSS scope before the assessment is key.

Who can perform a PCI 3DS assessment?

A qualified 3DS assessor – a company and individuals qualified by PCI SSC for PCI 3DS assessments. It is a separate qualification, though linked to the QSA ecosystem. The result is documented in a ROC and an AOC per the PCI 3DS v1.0 templates. Patronusec, an accredited QSA, runs PCI 3DS projects together with environment readiness.

How long does PCI 3DS certification take?

The duration depends on the starting point, the role (ACS, DS, 3DS Server) and whether you use PCI DSS for Part 1. A project with a well-mapped, valid PCI DSS is shorter, because it focuses on Part 2; a project from scratch covers the full baseline layer and remediation. We set a realistic timeline after the scope-assessment.

How much does PCI 3DS certification cost with Patronusec?

The price depends on the role, the size and state of the 3DE, and whether you use PCI DSS for Part 1. After a free scope-assessment call we present a fixed-price quote covering scoping, gap analysis, remediation support and the assessment. For clients certifying PCI DSS with us in parallel, we offer packages combining the two processes.

How do we start working with Patronusec on PCI 3DS?

The first step is a free 30-minute scope-assessment call: we classify the role, set the initial 3DE boundary and determine the path relative to PCI DSS. We then propose a plan – scoping, gap analysis, remediation, assessment. You will find the contact form on the PCI 3DS certification service page.

Blog space

PCI 3DS Certification Step by Step – The Process With and Without a PCI DSS Environment

In this article you will learn:

Table of Contents