We just got the budget approved to bring in a PCI DSS compliance consultant to help us prep for our assessment. What factors should we consider when evaluating PCI consultants?