This cannot be real, but sadly it appears as though it is. A "professional" security auditor request plain text passwords? A security auditor that thinks PCI is something you install onto your server? Wow. I am literally speechless.

Can we please get the name of this company somehow? This company should not be allowed to give anyone security advice whatsoever, they quite clearly do not know what they are talking about. I'd hate to think how many businesses have been affected and or are vulnerable as a result of their auditing practices and guidelines.