>Keep in mind that you don't need to necessarily "prove" things that can be checked later. The insurance company is happy to take your word that there's no PCI

>Keep in mind that you don't need to necessarily "prove" things that can be checked later. The insurance company is happy to take your word that there's no PCI card data on your network and cash your premiums. If there is and it gets stolen in a hack they simply won't pay out. Yep, this is exactly what I expect, similar to the original car theft example: "Ahh, you left the car unlocked, sorry, you cannot be reimbursed as you didn't exercise the expected diligence"