Passing a PCI assessment does not mean you have a functioning PCI program. Security, engineering, compliance, operations, legal, vendors, and leadership may each own part of PCI, but somebody still needs to own the whole program between assessments.