This is awesome. Being a payment company, how does this influence your ISO 27001 / PCI DSS compliance efforts?

I encourage lists at work but the first objection is often around our "need to know" security policy, thanks to ISO.