Comment by falcolas

PCI is a voluntary certification which is more or less toothless. You can pass a PCI, and still be terribly vulnerable in a myriad of ways.

Also, PCI certification of the environment doesn't make you, the end user, PCI certified.