A great question that gets asked often these days.
It is also the title of a great article in the November 2010 issue of Digital Transactions that documents the dilemma faced by QSAs and merchants regarding PCI compliance. Give it a read and take a walk in a QSA’s shoes.
PCI Guru 