PCI 3DS Core Security Standard
What is PCI 3DS Core Security Standard?
The PCI Security Standards Council's standard for the environments in which EMV 3-D Secure core components run: the Access Control Server (ACS), Directory Server (DS) and 3DS Server. Part 1 sets baseline security (policy, risk, awareness, screening, networks, secure development, configuration and change, malware and vulnerabilities, access, physical security, incident response and logging) and can be met by leveraging a recent PCI DSS assessment of the same environment; Part 2 sets 3DS-specific controls (scope, governance, third parties, ACS and DS boundaries, APIs and web configuration, availability, customer and remote access, 3DS data protection with TLS per EMVCo and storage per the PCI 3DS Data Matrix, transaction monitoring, key management with HSMs at the ACS and DS, and data-centre and CCTV controls). Version 1.0 of October 2017 is current, with Technical FAQs of September 2023 and Data Matrix v1.3 of September 2026. Built from the Council's ROC template, which restates every requirement. It comprises 143 controls organised across 14 domains, and applies in Global.
Map this against the frameworks you already hold
The compliance knowledge graph holds cross-framework control mappings for hundreds of standards, including the ones you are likely to be certified against already.
Browse the framework graph →Where PCI 3DS Core Security Standard overlaps with the standards you already hold
What PCI 3DS Core Security Standard means in your sector
What PCI 3DS Core Security Standard means for your job
Questions people ask about PCI 3DS Core Security Standard
What is PCI 3DS Core Security Standard?
How many controls does PCI 3DS Core Security Standard have?
Where does PCI 3DS Core Security Standard apply?
Which version of PCI 3DS Core Security Standard is covered here?
Query PCI 3DS Core Security Standard programmatically
PCI 3DS Core Security Standard, its 143 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
PCI 3DS Core Security Standard API reference and MCP config →How ready are you for PCI 3DS Core Security Standard?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.