Ignore PCI DSS. It's useless (also see: BlackPOS).
What's important is business process management and a deep understanding of your high-value output chains. The problem of information/data/app security is that low-value input chains can allow adversaries to wiggle their way into high-value output chains. Cover your chains by tracing the data flow through your organization.
Identify critical elements and build an apparatus to assure all of your appropriate input chains. Buy cyber insurance that equates to your BPM system. Appeal to your audit teams, regulatory counsels, district attorneys, and the FTC (or wherever your jurisdictions lie) for self assessment by way of alternate frameworks. If you want my suggestion on a framework, I'd recommend VisibleOpsSec over, say, ISO 27001/27002, PCI DSS, IT COBIT, FISAP, CIP, et al.
Appsec is dead simple. You integrate Microsoft TFS (or Atlassian JIRA/Confluence) with process templates that map to organization needs (roughly) and that work with existing process templates such as EssUP, Agile, Scrum, Waterfall, or whatever little process template tweaks your product management team coordinates with your business/org owners. If you have a third party doing any piece of your software product, you include them (obviously) and hold them to the same standards.
Then, you perform Simulation and Red Team Analysis, as well as some typical Delphi Method Analysis to gather opinions and understand results before they play out in real life. You integrate these concepts into your Application Lifecycle Management (ALM) through bdd-sec and bug hunts. Many bdd-sec and bug hunt toolage relies on Burp Suite Professional, so you make sure everyone has a copy, but also arm them with IronWASP and OWASP ZAP. If you run a JEE shop (probably Atlassian for ALM) then you'll want a good WebDriver (or O2) automated test harness combined with Contrast Security. If you have a Microsoft shop, check out a lot of the standard VisualStudio (or O2) tools -- perhaps adding Fortify or Checkmarx on spot projects that require intermediate or continuous mitigation. Other frameworks do require some unusual tweaks, but nothing too fancy or "out there". If you are running mobile projects then Appium harnesses combined with Clang asan (for iOS) or Coverity (for Android) plus an Appthority spot check will likely work fine.
It's important that this is backed by ENISA and US-CERT quality incident handling and response programs. Staffing or retaining talented DFIR personnel is always your biggest infosec problem. Adding process and tools to that program is your second biggest infosec problem. After that, appsec, datasec, "netsec" (haha, as if that even exists!), and risk management will be a walk in the park.