Organizations need to create a risk assessment methodology that works for their specific business environment, according to a new report by the Payment Card Industry Security Standards Council (PCI SSC).