What should I include in a PCI compliance checklist