If you thinking about PCI compliancy, you should take note of Section 6.6; at it widely considered to be one of the hardest (if not THE hardest) term for the compliancy.
The section calls for one of the following:
- Reviewing public-facing web applications via manual or automated
application vulnerability security assessment tools or methods, at
least annually and after any changes
- Installing a web-application firewall in front of public-facing web applications
(for more info on 6.6 read this : http://www.scmagazine.com/deconstructing-pci-66/article/110013/)
EvenStore by itself can not fill this requirement.
Having said that, I`ve yet to see one application/service to provide full PCI compliancy - this is just not possible.
What you need is to combine several solutions to answer several sets of requirements.
For 6.6 I would suggest Imperva Cloud WAF as, currently, it's the only one that comes with full PCI DDS compliancy.
(for more info visit: http://www.businesswire.com/news/home/20120216005411/en/Incapsula-Teams-PCI-Compliance-Security-Service-Providers)
Why choose Cloud?
Well, because this is a "plug-and-play" solution that can be added to any platform. More over, due to "economy of scale" effect made possible with Cloud technology, the price tag drops from several thousands (setup fees) to several dozen dollars a month.
As my first link explains, this not the only way to deal with 6.6 but I think it`s the best one.