The two critical initial steps in achieving PCI DSS compliance are to identify and classify cardholder data throughout the IT environment. The increased use of cloud solutions can make it more challenging to determine where regulated data resides. An organization cannot effectively protect sensitive data resources without an accurate inventory.