The first thing to do is to encrypt all of your cardholder data so that when it's traversing poorly-secured open public networks, bad actors won't pounce on it. Any reluctance here, and you'll be on the wrong side of PCI DSS compliance.