PCI 3DS
The PCI SSC security standard for whoever runs the infrastructure behind 3-D Secure, rather than for the merchants who use it.
The PCI 3DS Core Security Standard was published in October 2017, roughly as EMV 3DS 2 began rolling out. It covers the protocol's three server roles: the issuer's Access Control Server, the card network's Directory Server and the 3DS Server on the merchant side. The card networks require providers of those roles to be certified, and the assessment is carried out by a specifically qualified 3DS assessor.
The standard has a baseline part on general security, close to PCI DSS, and a part specific to 3DS. The latter is mostly about keys. An ACS that leaks the key it uses to generate CAVVs lets anyone vouch for authentications that never happened, shifting fraud liability onto the issuer in the process. The requirements for HSMs and key management are accordingly stricter than those for the card data itself.