[tyingq]

PCI also doesn't necessarily mandate some common sense things either, like monitoring for unexpected changes on the cart page.