PCI PIN Security · PCI 3DS Core Security · PCI Software Security Framework
PCI PIN, 3DS and Secure Software compliance for payment operations an assessor can verify.
Three PCI Security Standards Council standards protect the parts of the payment chain PCI DSS does not describe in detail: PIN processing and key management, 3-D Secure authentication, and the payment software itself. Sterling's expert and experienced consultants scope the right standard with you, close the gaps, build the evidence and prepare your team for the Council-qualified assessor, in 60+ countries. We ensure successful validation for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced payment security consultants, with governance, risk and compliance programmes delivered across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not assess or validate; a PCI SSC-qualified assessor assesses
8,100+ client engagements in 60+ countries.
Client letters on file
What it is
What are PCI PIN Security, PCI 3DS Core and the PCI Software Security Framework?
All three are owned and maintained by the PCI Security Standards Council (PCI SSC), the body behind PCI DSS. PCI PIN Security sets requirements for managing, processing and transmitting PIN data in online and offline transactions at ATMs and at attended and unattended point-of-sale terminals. PCI 3DS Core Security protects the environments where 3-D Secure functions run, so that shoppers can be authenticated securely in e-commerce and m-commerce. The PCI Software Security Framework brings together two standards for software makers: the Secure Software Standard, which applies to the payment software itself, and the Secure Software Lifecycle (Secure SLC) Standard, which applies to the way a vendor builds and maintains software.
PCI DSS covers cardholder data across an environment. These three go deeper into keys, authentication servers and code. PCI DSS has its own hub.
Current versions. The Council published version 3.1 of the PIN Security Requirements and Testing Procedures in March 2021; confirm the version in force with your assessor before scoping. PCI 3DS Core is written in two parts. Secure Software v2.0, the first major revision, was published on 15 January 2026, and Secure SLC v2.0 followed on 28 September 2026. Each allows 12 months to move from the earlier version, counted from when training becomes available. The Council shows no retirement notice for the Software Security Framework; the standard it did retire is PA-DSS. Is the Software Security Framework being retired?
Who it is for
Who needs PCI PIN, 3DS or Secure Software compliance?
Each standard has its own audience. PIN Security is for acquiring institutions and the agents that process PIN transactions for them. 3DS Core applies to organisations running the Access Control Server (ACS), Directory Server (DS) or 3DS Server (3DSS) functions. The Software Security Framework applies to vendors that develop payment software. Organisations usually come to Sterling from one of four starting points:
- A customer or partner asks for it. A processor, issuer or merchant wants proof before it connects, integrates or renews. Confirm the standard and version first.
- A tender or onboarding pack names it. Payment and fintech tenders can list specialised PCI standards next to PCI DSS.
- A regulator or scheme reviews your controls. Supervisors of payment and banking activity may look at key management, authentication and software security.
- A group company or a new product changes the scope. A new ATM estate, a new 3DS service or a new SDK brings a new standard into play.
Requirements
What are the main PCI PIN, 3DS and Secure Software requirements?
Each standard is organised around the function it protects. The list gives the areas in plain language; we check your implementation against the full testing procedures of the version your assessor will use.
- PIN Security, cryptographic keys: manage keys securely through their whole lifecycle, from creation and conveyance to loading, usage and administration.
- PIN Security, PIN processing: use secure methods for processing PINs in online and offline transactions.
- PIN Security, secure equipment: manage and use secure devices, including hardware security modules and terminals, under control.
- 3DS Core Part 1, Baseline Security Requirements: technical and operational security for the environment in which the 3DS functions run.
- 3DS Core Part 2, 3DS Security Requirements: controls designed specifically to protect 3DS data in ACS, DS and 3DSS environments.
- Secure Software Standard: design and manage payment software so that transaction integrity and payment data confidentiality are protected. Version 2.0 focuses on sensitive assets, documented in a Sensitive Asset Identification Document, and extends assessment to software development kits.
- Secure SLC Standard: build security into every stage of the vendor's software lifecycle so that products are secure by design. Version 2.0 aligns with Secure Software v2.0 and adds requirements for the digital tools used in development.
What does useful evidence look like for these standards?
For PIN, this means key inventories, key ceremony records, custody and split-knowledge logs, and device and HSM registers. For 3DS, it means diagrams of the ACS, DS or 3DSS environment, hardening and access records, and data protection controls that can be traced to 3DS data. For software, it means threat models, sensitive asset records, secure coding and testing results, and change and release records. We keep only the records each requirement needs, in Effivity from the start.
Validation process
How do you get assessed against PCI PIN, 3DS or Secure Software?
Implement the controls first; then an assessor qualified by the Council for that programme tests them. Sterling prepares you, and the outcome belongs to the assessor.
- 01Confirm the standard, the version and the scope.Identify your role (PIN acquirer or agent, 3DS function operator, or software vendor), the environments or products in scope, and what the party asking for it expects to receive.
- 02Gap analysis against the requirements and testing procedures.Compare current controls with the standard, keep what works, and agree actions, owners and dates.
- 03Remediate and build the evidence.Put controls into operation, train the people who run them and keep the records the testing procedures call for.
- 04Internal assessment and closure of findings.We test your controls the way the assessor will, raise findings before the assessor does, and close each one with evidence.
- 05Independent assessment by the qualified assessor.A Qualified PIN Assessor, a 3DS Assessor, or a Secure Software or Secure SLC Assessor carries out the assessment and reports in the programme's format. Validated payment software appears on the Council's Validated Payment Software listing. The PIN standard has no product listings.
Check the route before you sign. Ask the assessor company to show that it currently holds the Council qualification for the programme you need, confirm this with the PCI Security Standards Council, and ask which version of the standard it will assess against. Be wary of anything sold as a "PCI certificate". The documents that count are the ones the Council's programme produces, issued by a qualified assessor.
Cost
How much does PCI PIN, 3DS or Secure Software compliance cost?
No single price is meaningful: a vendor with one SDK and an acquirer with an ATM estate have very different scopes. Our proposal shows every component and states everything that is included.
| Cost component | What affects it |
|---|---|
| Consulting and remediation | Which standard applies, the environments or products in scope, current maturity, and whether you choose Design™ or Drive™ |
| Independent assessment | The qualified assessor's fees, the number of facilities, products or versions to assess, and any travel involved |
| Internal resources | Time from key custodians, security engineers, developers and operations, plus any equipment or tooling changes |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with the details confirmed in the proposal |
| Continued support | Change reviews, version transitions and preparation for later assessments under Sustain™ |
What moves the price
- How many of the three standards, and which parts of each, are in scope
- The number of sites, key facilities, 3DS environments or software products
- Whether HSMs, key ceremonies or secure development practices already exist
- A version transition, such as moving to Secure Software v2.0
- The launch or contract date, and how much your team can take on
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Assessor fees identified separately, so you can compare total programme costs
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones linked to deliverables
- One all-inclusive proposal. No surprises, ever
Timeline
How long does PCI PIN, 3DS or Secure Software compliance take?
The timeline depends on the standard, where you are starting from, how much must change and when the assessor is available. As an estimate, readiness typically takes 4 to 9 months. New key ceremonies, devices and development practices take longest, because controls must run long enough to produce evidence.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to key custodians, architects, developers and existing documentation |
| Remediation | Procurement of equipment or tools, key ceremony scheduling and code or process changes |
| Evidence and internal assessment | Controls running long enough to be tested, and findings closed |
| Independent assessment | The qualified assessor's availability, the fieldwork and the time needed to address its findings |
If a launch or contract date drives the work, tell us at the start and we will say plainly what is achievable.
Your engagement
What your PCI PIN, 3DS or Secure Software engagement includes
Your engagement follows Sterling OS™. You choose Design™, where we guide your team as it does the work, or Drive™, where we manage and deliver the work with your people. These are two alternative levels of support, not consecutive stages. Sustain™ continues after validation, and Automate™ is Effivity, which runs the programme throughout.
Scope, gap analysis and plan
The standard, version and scope confirmed, with owners, dates and decisions agreed before work begins.
Policies, procedures and technical controls
Key management, 3DS environment or secure development controls designed with the people who operate them.
Effivity ISO & GRC software
The programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your assessment team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal assessment
Controls tested against the testing procedures, with findings closed and evidence kept before the assessor arrives.
Assessor readiness and support
Preparation for fieldwork and support until the assessor completes its report.
Sterling does not assess or validate; the PCI SSC-qualified assessor carries out the assessment and reaches its conclusion.
Often combined with
Standards organisations pair with PCI PIN, PCI 3DS and PCI SSF
- AML / CFT programme (FATF)AML/CFT compliance programme built on the FATF Recommendations: risk assessment, due diligence, monitoring, reporting, records and training, in one all-inclusive proposal.
- APRA CPS 234 and CPS 230APRA CPS 234 and CPS 230 compliance for banks, insurers and super funds: information security, operational risk, continuity and service providers, all-inclusive proposal.
- Basel and UK operational resilienceOperational resilience compliance for PRA and FCA firms: important business services, impact tolerances, mapping, scenario testing and the Basel principles.
- BSP circulars (Philippines)BSP circulars compliance for Philippine banks and BSFIs: IT risk management, information security, business continuity and outsourcing, in one all-inclusive proposal.
- CBUAE regulationsCBUAE compliance and requirements for licensed institutions: operational risk, cybersecurity, continuity, outsourcing and consumer protection, in practice.
- COSO Internal ControlCOSO internal control implementation and requirements: the five components and 17 principles of the 2013 framework, no certificate, route, cost and timeline.
Effivity · ISO and GRC software, included in every engagement
How Effivity helps you fulfil, automate and simplify PCI PIN, 3DS and Secure Software requirements.
Every Sterling engagement for these standards includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant sets up the workspace within the agreed scope, so documents, risks, audits, nonconformities and training records are kept in one place, and the assessor reviews a live programme rather than a folder. Sterling consulting clients receive their Effivity subscription included with the engagement, at no additional cost.
Context, scope and interested parties
The environments, products, parties asking for proof and assessor programmes, recorded and reviewed as the business changes.
Policy, roles and objectives
Security policy, key custodian and developer responsibilities, and objectives with owners and dates.
Risks and opportunities
Threats to keys, 3DS data and sensitive software assets, each with treatments tracked through to closure.
Competence, awareness and documented information
Training records linked to Sterling Academy, and controlled procedures kept at the current version.
Suppliers and delivery
Supplier and device evaluations, maintenance records and change controls, each recorded as the work happens.
Monitoring, internal audit and management review
Internal assessment programmes, findings and follow-up, with management review decisions recorded.
Nonconformity and corrective action
Findings investigated and closed with their root cause and evidence that the fix has worked.
Your own processes, forms and reports
Forms and workflows for key ceremonies, releases or 3DS changes, adapted without code.
What this means at the assessment
When the assessor asks for key custody logs, change records, training evidence or last quarter's findings, each one is a screen in Effivity with its dates, owners and evidence attached. After validation, Sustain™ continues in the same workspace, so the next assessment finds a programme that has kept running.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your documents, records and registers migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, QMS and more when you add other standards
Sterling Academy · payment security e-learning
Train the people who handle keys, 3DS systems and payment code.
Sterling Academy provides e-learning for the whole workforce and for the specialists who run the controls. Courses combine video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner that can be verified online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Security awareness for everyone who works near payment functions
- Learning for key custodians, security engineers and developers
- Internal auditor training, as applicable to your standard, as part of the engagement
- Learner progress reports that serve as training evidence for the assessor
- New starters trained as they join, so the records stay current
- A Sterling consultant available when a learner needs one
Keep exploring
Explore more about PCI PIN, PCI 3DS and PCI SSF
PCI PIN, 3DS and SSF resources
Services for PCI PIN, PCI 3DS and PCI SSF
Why Sterling
Want successful PCI PIN, 3DS or Secure Software validation? Come to Sterling.
Specialised PCI standards reward precision: the right standard, the right version and evidence that reflects how the function actually runs. We align the programme with PCI DSS, ISO/IEC 27001 or SOC 2 where you already hold them.
GRC programmes in 60+ countries since 2003
One engagement team accountable across all your sites and products, supported by offices in 21 countries.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with assessor fees shown separately. No surprises, ever.
Controls your people can run
Procedures and records built around real key ceremonies, releases and operations, so they are still followed after the assessor leaves.
Expert and experienced consultants
Expert and experienced consultants in payment security and information security, who get the evidence right first time so the assessment confirms what already works.
The Sterling Promise
What our PCI PIN, 3DS and Secure Software success guarantee means
We stay with you until your agreed PCI PIN, PCI 3DS or PCI Secure Software validation outcome is achieved, supporting implementation, preparation and the resolution of assessment findings. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability rather than a report on a shelf.
The engagement identifies the standard, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. The PCI SSC-qualified assessor assesses the controls and retains its conclusion. Our commitment concerns the agreed validation support, not a promise of every future contract award or error-free operation.
FAQs
Frequently asked questions about PCI PIN, 3DS and Secure Software
Is the PCI Software Security Framework being retired?
No. As of September 2026 the Council shows no retirement notice for it. In 2026 the Council published version 2.0 of both of its standards, Secure Software in January and Secure SLC in September, and described both as part of the framework. PA-DSS is the standard that was retired. The Council also says Secure Software v2.0 provides an alternative route for assessing 3DS SDKs and is expected to replace the separate 3DS SDK standard over time.
Does PCI DSS compliance cover PCI PIN or PCI 3DS?
No. PCI PIN and PCI 3DS Core are separate standards, each with its own requirements and its own assessor programme. Evidence you already hold for PCI DSS can often help, but ask your assessor how much of it they will accept before you plan to reuse it.
Who can assess us against the PCI PIN Security Standard?
Only a Qualified PIN Assessor (QPA), whom the PCI Security Standards Council qualifies and trains to assess environments where PINs are processed.
Do software vendors need both Secure Software and Secure SLC?
Not necessarily. The Council describes the two as complementary and says that neither requires assessment against the other. Secure Software assesses a payment product, while Secure SLC assesses how the vendor builds and maintains its software.
Does Sterling issue the assessment report or list our software?
No. Sterling provides consulting and readiness support. A PCI SSC-qualified assessor carries out the assessment and reports on it within the Council's programme, and the Council maintains its listings.
Keep exploring
More on PCI PIN, PCI 3DS and PCI SSF and related standards
More in Financial services, payments & AML
Talk to a consultant
Plan your PCI PIN, 3DS or Secure Software validation with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice