Business Solution: After extensive discussions and fixing 75 other PCI findings, the source code issue was a monumental task that had the client feeling they might as well stop accepting credit cards.  The client asked for a compensating control.  No known compensating control was available for so many PCI findings.  After careful research and design meetings, a Web Application Firewall (WAF) was introduced to see if this would resolve a portion of the PCI findings.  The first and second WAF that was installed caused additional problems and was not resolving many of the issues.  A third WAF attempt was made to get the WAF to filter internal and external network traffic.  The new WAF was showing promise of resolving many of the PCI issues.  Hired engineers from the WAF company to analyze some of the very difficult source code vulnerabilities and created special firewall rules that protected against the persistent common vulnerability.  Performed external vulnerability tests to validate WAF was properly filtering external network traffic.  Reconfigured internal connections to PCI environment to ensure system admins would have to go through the WAF and not bypass the WAF. Confirmed the compensating control was being addressed from an internal/external network perspective.  About 40 vulnerabilities could not be filtered by the WAF, but were fixed by some code attributes modifications to a module a few days ahead of the schedule.