@MRMaguire as does knowing the scope of the PCI assessment (ie don't forget about the server full of SSNs that wasn't in PCI scope) SecuObs - L'observatoire de la sécurite internet - Site d'informations professionnelles francophone sur la sécurité informatique