Although the current version of the PCI DSS integrated security controls framework incorporates the requirement for entities to implement an annual risk assessment process, where critical assets, threats, and vulnerabilities are identified and the results analyzed and formally documented, this is often seen as a one of tick box control within their compliance program.
By restricting this to only risk assessing your PCI DSS environment, you reduce your options for better safeguarding your payment card processes and operations.
Think of it like the analogy of trying to cross ...
