We are currently working on implementing the PCI-DSS ruleset in our IT environment, where all of the inhouse software we use is Perl. We have a Perl dev team of about 10 people (inlcuding me) and running large applications, mostly legacy.
Now the advisor we pay to help us implement the PCI stuff is not very well versed in Perl and deems the CPAN a risk. The prebundled packages containing CPAN stuff that are available as rpms in the openSuse repository on the other hand are safe to use, according to this guy. He thinks that we should have someone from the outside audit all the code from CPAN we want to install. This person would need to have strong security background and deep knowledge of Perl. Unfortunately, they don't know anyone like that.
Addition: After the CPAN code for each individual module was security-checked, we would create our own rpm package from it (one for each CPAN module) and use these to install on our servers.
My main question is not for some-one who can be that auditor for us (although I'd happily take hints on that front), but rather how other companies working with Perl are handling this issue. As a Perl dev I feel the CPAN is one of the very reasons Perl is still around for larger projects. Not being able to use the stuff people built, documented and thoroughly tested for me feels like having my legs chopped of.
I would be very much obliged about war stories within the same context, personal experience or references to other companies that are using CPAN and are PCI compliant and might be willing to talk about this on a professional level.