Oh, that old chestnut. Actually have exactly that at a client, guy used to run physical security at their stores and is now head of infosec but he's a lovely b

Oh, that old chestnut. Actually have exactly that at a client, guy used to run physical security at their stores and is now head of infosec but he's a lovely bloke and knows he's out of his depth, and has chosen good expert outside advice - we actually met the QSA we like through them. Thing is in some regards PCI is quite analogous to physical security, as a lot of it is about documented process and auditability. Hell, a chunk of it is physical security. So that progression isn't so bad, and as usual, you just get people who are willing to acknowledge their own shortcomings and work with others to resolve or mitigate against them, and those who don't.