Many years ago, I went through a PCI-DSS compliance "audit" at a previous company. The audit was carried out by some third party whose job it is to sign off on

Many years ago, I went through a PCI-DSS compliance "audit" at a previous company. The audit was carried out by some third party whose job it is to sign off on those things. We had to deliberately downgrade certain software to "approved" older versions and temporarily close some ports while they ran their scanning utility on our servers. After they rubber-stamped it, we re-upgraded and enabled whatever we needed to run again. They certainly would not have been able to detect if data center technicians (this was pre-cloud) were accessing our data behind our back. Maybe some companies take the PCI certification process more seriously than my previous employer did.