Large merchants subject to PCI DSS rules are often blindsided by DSS changes, arrival of new payment technologies as well as newly emerging business context. On top of this, many organizations still narrowly focus on annual PCI assessment and not on running an ongoing compliance program.