Skip to content

QSA · QPA · 3DS Assessor

SearchFrançais

Assessment

PCI 3DS Assessments

Authentication servers, the keys they protect and the environment around them, assessed by someone who has built them. Here is how an engagement goes.

QSAQPA3DS AssessorAuthorised to assess across Europe & CEMEA

Who comes to us for this

Companies that run a component of EMV 3-D Secure: access control servers for issuers, directory servers for the schemes, 3DS Servers for merchants and acquirers, and the issuers and processors who operate one of these themselves. Many arrive at their first 3DS assessment with a PCI DSS Report on Compliance in hand and the assumption that it covers them. It covers part of it. The 3DS Core Security Standard adds requirements of its own, on the protocol, on the HSMs and on the data the authentication produces.

What we do

  1. Scope on the 3DS environment.

    Which component you operate, the systems that create, process or store 3DS data, the HSMs that protect the keys, the connections to the schemes and to the other components, and the third parties with their responsibilities written down. The standard has two parts: a security baseline that a current PCI DSS assessment can largely answer, and the 3DS requirements proper. We map what your existing report already covers, so nothing is assessed twice.

  2. The protocol as deployed.

    Message flows, certificate handling, the cryptographic operations inside the HSM, the logging of authentication results: read in the configuration, then watched in test and in production. A 3DS assessment sits close to the implementation, and that is where we spend the time.

  3. HSMs and keys.

    The HSMs, their configuration, the key ceremonies and the custodians: the same discipline as a PIN assessment, applied to the keys that sign and verify authentication. Where the HSM is a cloud service, we assess the shared responsibility as the contract writes it, not as everyone hopes it works.

  4. Findings as they are confirmed.

    You hear about a finding when your assessor confirms it, with exactly what would close it, not in the report. Remediation rounds are agreed, with a cut-off. A concluded report with a clear plan is a better finish for both of us than another open round.

  5. Quality review, then signature.

    Before issuing, the report goes through our pre-issue review, which can and does change determinations. Then the 3DS Assessor who scoped the engagement signs the Report on Compliance and the Attestation of Compliance, the documents the schemes ask you for.

What you do

Bring the architecture as it is deployed, not as it was designed. Name one owner for the platform and one for the HSMs. Make a test environment available that behaves like production. Tell us which scheme programmes you are in and when their deadlines fall, so the report lands when you need it.

What you receive

A scope confirmation that names the component, the systems and the responsibilities. Findings with what closes each. The Report on Compliance and the Attestation of Compliance for PCI 3DS, and where you hold a PCI DSS report, a note on what each covers so that next year both are assessed once. A closing note with what to do before the next cycle.

What we will not do

  • Sign a report that is not true.
  • Treat a PCI DSS Report on Compliance as a 3DS assessment.
  • Assess a 3DS SDK: it has its own standard and its own laboratories, and we will tell you who they are.
  • Hand the engagement from the assessor who scoped it to someone who did not.

Keep reading

Related knowledge

Where it starts

Start with the component you run.

Access control server, directory server or 3DS Server; where it runs, which HSM, which schemes, whether a PCI DSS report already exists. Then a written proposal with the scope, the assessor who will lead, and a price that follows from the scope.

Talk to a QSA

Or reach us directly

QSAQPA3DS AssessorAuthorised to assess across Europe & CEMEA