Finally, some common sense is starting to prevail;
Detractors say that this is diluting the original intent of the directive, but as I have seen so many times in PCI, if you don’t make it achievable, you cannot enforce it fairly.
Risk based approach is always the way…