Section 1.2 Normative References reads in part:

*****
PCI SSC Data Security Standards

https://www.pcisecuritystandards.org/security_standards/
*****

This appears to be a citation of an organization and not something to which conformance could be mandated by the MQTT specification.

I checked the occurrences of PCIDSS and unless I missed a reference, all references to it occur in non-normative statements. Pointers to additional information essentially.

Suggest moving this reference into 1.3 Non-normative references (I will cover the non-normative statements in a separate issue.)

BTW, this reference already occurs in Non-Normative references as well. So just delete here.