Skip to main content
—
Framework library
Framework module · pci-3ds-core-1-0

PCI 3DS Core Security Standard

PCI SSC's security requirements for 3-D Secure environments (issuer/ACS, 3DS Server, and DS components) that support cardholder authentication.

v1.0 · PCI Security Standards Council — 3DS Core · published 2017-10-01

Standing today
Directory entry

00Answer

from the registry record
What is PCI 3DS Core Security Standard?
PCI SSC's security requirements for 3-D Secure environments (issuer/ACS, 3DS Server, and DS components) that support cardholder authentication.
Who does PCI 3DS Core Security Standard apply to?
PCI 3DS Core Security Standard applies to payments, global, per PCI Security Standards Council — 3DS Core.
What is the current version of PCI 3DS Core Security Standard?
The current edition is v1.0, issued by PCI Security Standards Council — 3DS Core and published 2017-10-01. Source: https://www.pcisecuritystandards.org/standards/pci-3ds-core/.
What does an assessment under PCI 3DS Core Security Standard require?
No control catalog has been ingested for PCI 3DS Core Security Standard yet — the registry tracks it as planned (Tracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented), so an assessment under this framework currently requires the authority's own catalog rather than a ControlFrame-parsed one.

01Standing

Directory entry

Authority and version facts, with a parsed public catalog when available; no tenant blueprint or executable evidence method is activated.

PCI 3DS Core Security Standard is tracked in the registry — authority, version ledger, verification — and nothing else is modelled for it yet. Import its catalog to begin.

Freely downloadable from PCI SSC; PCI SSC's terms permit identifiers and structure, not verbatim requirement text, without a separate license.

Request this frameworkAuthority source (opens in a new tab)

02Registry record

checked 2026-09-06
Registry status
Planned · namedTracked metadata: we name the regime and monitor its issuing authority. No control or requirement model is implemented.
Control units
Not on record — no catalog ingested and no authority-published count cited.
Control families
3DS environment security · Cryptography and key management · Access control · Physical security
Applies to
payments · global
Verification
Secondary — corroborated across independent sources; the authority blocks automated fetch or does not state it plainly. checked 2026-09-06
Pending change
A v2.0 revision has been under discussion for years with no publication date announced; v1.0 remains the current, effective standard.Expected: Unannounced

03Version ledger

1 edition
v1.0Current edition2017-10-01

06Related frameworks

scored from registry facts
  1. PCI DSSv4.0.1

    Also applies to payments · The cardholder-data standard every merchant and service provider that touches payment card data is measured against. v4.0 retired 2024-12-31; the 51 future-dated v4.x requirements became mandatory 2025-03-31.

  2. PCI Card Production and Provisioningv3.0

    Also applies to payments · PCI SSC's physical- and logical-security requirements for card production and provisioning facilities (two companion documents under one program).

  3. PCI Point-to-Point Encryptionv3.2

    Also applies to payments · PCI SSC's standard for validated point-to-point encryption solutions that can reduce a merchant's PCI DSS scope. Part of the payments family beyond bare PCI DSS.

  4. PCI Contactless Payments on COTS (CPoC)v1.0

    Also applies to payments · PCI SSC's standard for accepting contactless card payments on a commercial off-the-shelf mobile device without a separate secure card reader. In its formal sunset window now, with MPoC as the designated successor.

See control-level overlap in the Control Atlas
PCI 3DS Core Security Standard | ControlFrame