... thoroughly documented and that measurable success criteria are contemplated in current and multi-year budgets ... responsibilities, employees may have access to covered information, cardholder data, or other confidential customer ...