This is profoundly annoying and frustrating. Minimal to no detail from Intuit, but a spammy email that turned out to be legit (ish?) from Security Metrics, and now it's costing me a minimum of $85 a year to be compliant with something over which I have minimal control or accesss. Any credit card fraud or failure is going to be fully due to a failure on Intuit's part, not mine.

I get that I agreed to use their credit card processing service and as such I need to agree to compliance on their terms. Fine. What I think I'm the most peeved about is the poor communication, having already used the service for years without the additional cost and headache, and the sketchy implementation. 

The full explanation to us could have been much, much more timely and much more comprehensive. If business got grades on communication like on grad school theses, most would fail. And faily badly. I feel like this was a shakedown, but at the same time I understand the need for it. Sadly, knowing that does not improve my feeling about it!