Ryan's account is very accurate and very familiar! Trying to achieve and then maintain PCI compliance is a nightmare. In my previous job I wrote and maintained an on-line shop. Because I knew the codebase intimately, fixing problems there was easy, but (even though we were on a VPS) there was a great deal that the hosting company had to do as well, even as far as arguing about false positives and really trivial stuff.
I don't miss it! However, I did come across an interesting bit of reading on the subject, regarding taking a web business outside PCI scope, which may be relevant to this discussion.