AFAIK, PCI is an unfunny joke. This is why my pentester friends have told me about it: > Release v1.0 of super cool app. > v1.0 gets PCI certified > Someone

AFAIK, PCI is an unfunny joke. This is why my pentester friends have told me about it: > Release v1.0 of super cool app. > v1.0 gets PCI certified > Someone discloses a vuln in v1.0 > Release v1.1 > Companies are stuck with v1.0 for at least 90 days until v1.1 can be certified