PCI compliance 12.3.8 and 12.3.9