There is a large part of the PCI standards which relate to securing systems and infrastructure but there are a lot of other policies and processes related to human resources which will need to be engaged in a PCI way if they are handling credit card data, Lewis said.