Start with the pci audit process https://www.verygoodsecurity.com/compliance-solutions/pci-audit - this will be the easiest way for you to figure out your future activities. The fact is that when your work meets safety standards, you will no longer be distracted by extraneous processes and will completely devote yourself to business, which is very important. The worst of all is when the modern leader tries to be torn among several questions at once. Very Good Security will help you cope with one of these tasks.