I agree with that.  Folks are forced to create little isolated environments that are less likely to be patched or monitored, for fear of bringing more systems into PCI scope.<p>That is slowly starting to change however.  PCI DSS 3.0 gets a bit more specific and starts to go down some technical rabbit holes.  PCI DSS 4.0 will be even more specific and have more technical requirements (vs. checkboxes)