PCI DSS Control challenges