The PCI 3DS v1.0 (2017) standard, published by the PCI SSC, establishes the security requirements and assessment procedures for the core components of the EMV® 3-D Secure ecosystem: ACS, DS, and 3DS Server. This framework defines both the physical and logical controls necessary to protect critical authentication functions, as well as the associated processes and data. The standard is structured into two blocks: base security requirements for the 3DS environment and specific requirements intended to safeguard the processes and information managed by participating entities.
PCI 3DS · EMV® 3-D Secure
PCI 3DS Audit
PCI 3DS v1.0: the standard that reinforces the security of the EMV® 3-D Secure ecosystem. It protects critical processes, sensitive data, and user authentication with robust controls designed for ACS, DS, and 3DS Server. An essential foundation for ensuring secure and trusted digital transactions.
Phase 1, Preparation and Startup
Planning and kickoff meeting
Phase 2, Audit
Documentary, procedural, and technical review
Phase 3, Compliance Documents
Preparation of RoC and AoC
Phase 4, Delivery of Results
Final compliance documentation
The standard
What is PCI 3DS?
Applicability
To whom does PCI 3DS apply?
The PCI 3DS standard applies to all entities that participate in the EMV® 3-D Secure ecosystem and manage critical authentication components. This includes operators of Access Control Server (ACS), Directory Server (DS), and 3DS Server.
Affected entities must comply with the security requirements defined to protect authentication functions, critical processes, and sensitive data associated with 3-D Secure transactions.
Our services
How we work
01Preparation and startup
Stage I: Audit Preparation
The objective of this phase is to plan all activities associated with the audit in a structured manner and to develop an initial audit plan, which must subsequently be reviewed and approved by the parties involved.
A preliminary audit schedule, as well as an example of a work agenda, will be presented below to serve as a reference for the organization and coordination of the planned tasks.
Once this initial audit plan has been defined and validated, a date will be proposed for the kickoff meeting, during which the start of the process will be formalized and the objectives, expectations, and responsibilities of all participants will be aligned.
Stage II: Kickoff Meeting
The date of this meeting will be considered the official start of the audit. Additionally, three fundamental objectives will be addressed during the session:
The objective of this phase is to plan all activities associated with the audit in a structured manner and to develop an initial audit plan, which must subsequently be reviewed and approved by the parties involved.
A preliminary audit schedule, as well as an example of a work agenda, will be presented below to serve as a reference for the organization and coordination of the planned tasks.
Once this initial audit plan has been defined and validated, a date will be proposed for the kickoff meeting, during which the start of the process will be formalized and the objectives, expectations, and responsibilities of all participants will be aligned.
Stage II: Kickoff Meeting
The date of this meeting will be considered the official start of the audit. Additionally, three fundamental objectives will be addressed during the session:
- Confirm the final scope of the audit, ensuring it matches what has been established and expected by all parties.
- Present and explain the phases of the audit process to all participants, ensuring a common understanding of the approach and planned activities.
- Finalize the audit plan and identify key stakeholders, defining responsibilities and points of contact for the proper execution of the work.
02Audit
Stage I: Document Review
This stage involves a comprehensive review of the regulatory body applicable to the 3DS environment, including policies, procedures, operational guides, reports, and any other relevant documentation.
To ensure the proper development of this phase, it will be essential to have all current regulatory documentation available from the start of the audit.
As a result of this phase, any potential non-conformities related to the PCI 3DS regulatory framework will be identified.
Stage II: Procedural Review
In this stage, the main objective will be to validate, through data-gathering meetings, that the procedures described in the documentation developed for compliance with applicable 3DS requirements are being executed appropriately and in accordance with what has been established.
The result of this stage will consist of the identification of potential non-conformities related to the execution of 3DS-associated procedures within the scope of the audit.
Stage III: Technical Reviews
The objective of this stage is to validate, through technical reviews, that the configurations described in the documentation developed for compliance with 3DS requirements, and which apply to the evaluated organizations, are correctly implemented.
As with the procedural review phase, the execution of the technical reviews must be carried out according to the established audit plan.
Stage IV: Follow-up and Remediation of Non-Conformities
At the end of each stage of the audit, a follow-up sheet with all identified non-conformities will be sent. Once the audit is concluded, and depending on the receipt of remediation evidence, the updated follow-up sheet will be sent periodically.
This stage involves a comprehensive review of the regulatory body applicable to the 3DS environment, including policies, procedures, operational guides, reports, and any other relevant documentation.
To ensure the proper development of this phase, it will be essential to have all current regulatory documentation available from the start of the audit.
As a result of this phase, any potential non-conformities related to the PCI 3DS regulatory framework will be identified.
Stage II: Procedural Review
In this stage, the main objective will be to validate, through data-gathering meetings, that the procedures described in the documentation developed for compliance with applicable 3DS requirements are being executed appropriately and in accordance with what has been established.
The result of this stage will consist of the identification of potential non-conformities related to the execution of 3DS-associated procedures within the scope of the audit.
Stage III: Technical Reviews
The objective of this stage is to validate, through technical reviews, that the configurations described in the documentation developed for compliance with 3DS requirements, and which apply to the evaluated organizations, are correctly implemented.
As with the procedural review phase, the execution of the technical reviews must be carried out according to the established audit plan.
Stage IV: Follow-up and Remediation of Non-Conformities
At the end of each stage of the audit, a follow-up sheet with all identified non-conformities will be sent. Once the audit is concluded, and depending on the receipt of remediation evidence, the updated follow-up sheet will be sent periodically.
03Preparation of Compliance Documents
Stage I: Preparation of Compliance Documents
This stage will begin once all non-conformities identified during the audit process have been closed. Its purpose is the completion of all documentation required to formally validate compliance, including:
Stage II: QA of Compliance Documents
Once the preparation of the documents related to compliance validation is complete, an independent review will be conducted to verify that said documents meet the established quality standards.
This stage will begin once all non-conformities identified during the audit process have been closed. Its purpose is the completion of all documentation required to formally validate compliance, including:
- Report on Compliance (RoC)
- Attestation of Compliance (AoC)
Stage II: QA of Compliance Documents
Once the preparation of the documents related to compliance validation is complete, an independent review will be conducted to verify that said documents meet the established quality standards.
04Delivery of Results
We will proceed with the submission of all documentation verifying compliance with the 3DS requirements within the scope defined for the audit.
Scope of service
What this service covers
Initial audit plan
Preparation of an initial audit plan that schedules all activities, for review and approval by the involved parties.
Preliminary schedule
Submission of a preliminary schedule and a work agenda as a reference for organizing and coordinating the planned tasks.
Document review
Comprehensive analysis of 3DS environment policies, procedures, operational guidelines, and reports.
Procedural review
Validation that 3DS compliance procedures are executed as established.
Technical inspections
Verification of technical configurations implemented for compliance with 3DS requirements.
Remediation of non-conformities
Follow-up and support in the remediation of all non-conformities identified during the audit.
Report on Compliance (RoC)
Preparation of the official PCI 3DS standard compliance report.
Attestation of Compliance (AoC)
Issuance of the formal declaration of compliance, validated and reviewed with independent quality control.
Testimonials
What our clients say
Working with Internet Security Auditors has been a highly satisfactory experience. Their support in the migration to the ISO/IEC 27001:2022 standard, the execution of internal audits, and the PCI DSS certification process has been fundamental in strengthening our information security management system.
The strategic support of Internet Security Auditors as CISOaaS has been fundamental in reinforcing our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance our cybersecurity maturity more quickly.
On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.
Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.
As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…
As CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented towards online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.
As CISO at Intaremit S.A., we place the utmost importance on logical security. This is not only due to the fact that the PCI-CPP standard requires us to perform four internal and external vulnerability scans and an annual internal and external pen-test, but also because of the security and peace of mind our company aims to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.
At Grupo Arbulu, we have collaborated closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.
As the CEO of Beruby, we worked with Internet Security Auditors when we urgently needed to carry out a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.
At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.
Frequently Asked Questions
We answer your questions
What is PCI 3DS and to whom does it apply?
PCI 3DS is a PCI SSC standard that establishes security requirements for the core components of the EMV® 3-D Secure ecosystem: Access Control Server (ACS), Directory Server (DS), and 3DS Server. It applies to all entities that operate these critical authentication components.
What is the difference between PCI 3DS and PCI DSS?
PCI DSS protects cardholder data across the entire payment ecosystem, while PCI 3DS focuses specifically on the authentication components of the EMV® 3-D Secure ecosystem (ACS, DS, and 3DS Server). Both standards are complementary and can coexist within the same organization.
What documents are obtained after the audit?
Upon completion of the PCI 3DS audit, two official documents are produced: the Report on Compliance (RoC), which details the fulfillment of each requirement, and the Attestation of Compliance (AoC), which is the formal declaration of compliance. Both undergo an independent quality assurance (QA) review process.
How long does the PCI 3DS audit process take?
The duration depends on the scope and complexity of the environment. The process includes four phases: preparation and kickoff, audit (documentary, procedural, and technical), preparation of compliance documents, and delivery of results. The date of the kickoff meeting marks the official start of the audit.
What happens if non-conformities are detected?
At the end of each audit phase, a tracking sheet with the identified non-conformities is sent. Internet Security Auditors provides support during the remediation process, updating the tracking sheet as evidence of correction is received, until all non-conformities are fully closed.
Contact
Do you need a PCI 3DS audit?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Global Presence
Our offices
Bogotá
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)
25
years of experience in cybersecurity
Contact us