PCI DSS isn't regulation. It's a standard promulgated by a private LLC (the Payment Card Industry Security Standards Council). HIPAA would be a much better exa

PCI DSS isn't regulation. It's a standard promulgated by a private LLC (the Payment Card Industry Security Standards Council). HIPAA would be a much better example of regulation that is material w/ respect to software development.