How hard is it to obtain PCI compliance?
A great explanation of PCI compliance and things an organization should consider relating to PCI compliance is available from this CiviCon Denver 2015 talk: CiviCon Denver Data Security and Payment.  See my answer here for other relevant info: https://civicrm.stackexchange.com/a/10453/105

We also use Drupal 7 and Civi 4.6, but are hosted on MediaTemple and use iATS for our payment processor.  The biggest issue will be whether you take payment directly onsite or offsite (I'm not familiar with Authorize.net).  In and of itself, a MediaTemple VPS is not PCI compliant.  We had to take steps ourselves to make sure our server met the PCI criteria.  iATS has their clients enroll in PCI Smart which is a PCI compliance testing and reporting program through TrustWave. We used those scans as guidance for what we needed to adjust technically on the server to meet PCI guidelines and the self-report to determine in-house processes to meet the PCI criteria.