A short, practical discussion of considerations for any sized merchant as you prepare for implementing practices to comply with PCI DSS requirement 9.9.