COMPLIANT then.

You *HAVE* to apply patches according to the "Standards"

NACHA Compliance is similar...

Any kind of MONEY transaction and you fail compliance if you don't apply all patches.

PCI is all about Windows "best" practices forced on all other OSes.

PCI Compliance means, in a nutshell, to the unwashed masses:

Anti-Malware, Anti-Virus running and updated all the time and ALL OS and ALL MACHINES (including Database servers that have NO LOGINS allowed from anyone except the DBA and ADMINS)
Patches deployed ASAP (Yeah even ones that break things)
Even a report of something possibly being bad, means its not allowed (MD5 based SSL Certs)
Encrypted Credit Card transactions logs
You *MUST* have a Web Application Firewall (check out mod_security and "gotroot.com" rulesets)
You Must have CHE (Card Holder Data Environment) firewalled
You must have a Firewall between the Internet and the rest of your network. (DUH)
You Must have the "INTERNET" VLAN on its own separate Switch/Router Hardware (If you don't use Spanning Tree, this means nothing but try and explain that to the auditors)
You must Justify your open "ports" period.
"priv'd" employees (like your support for customers) must use two factor authentication (and trying to get entrenched people to use it by turning off "password" auth for them hurts)

Nothing with CHD (Card Holder Data) can be logged
EVERYTHING MUST BE LOGGED to reconstruct "events"

Effectively you must be ISO9000 you entire software stack, response procedures, etc...

It sucks.