This is quite an unfortunate turn of events.  We just found out today that the product was discontinued.  When I went to the forum and realized it wasn't there I searched their site for answers only to find none.  I decided to try the DNN forums and ended up on this thread.  I'm trying to temper my frustration at the whole situation and how it was all handled.

The question for us now is what to do?  There were indeed a ton of bugs in the aspdnsf product and we have made quite a few customizations to get it to work the way we needed it to.  But we don't want to remain married to an old version. 

Can anyone suggest a good store as a replacement?  Something that's stable and legal (we don't want anything to do with Ali-Commerce after recent developments about it being pirated).  We are on the hunt and are open to suggestions ...

Adherence to PCI standards are a consequence of (indirect) contractual arrangements between a merchant and a payment card company (e.g. Visa).  In the United States, it is very typical (likely without exception) for a merchant contract to require adherence, with penalties ranging from termination to (significant) fines for non-compliance.  So yes, it would be reasonable to say that PCI compliance is always in-scope for a merchant in the United States.

The application and enforcement of the PCI standards outside of the United States is a much more nuanced picture, with some areas not addressing compliance in the PCI domain, and others requiring it but not actively enforcing it (this is common throughout much of Europe).

Hope this helps!

Brandon