What is not a PCI compliance recommendation?

Limiting access to cardholder data on a need-to-know basis is explicitly required by PCI DSS Requirement 7 - Restrict access to system components and cardholder data by business need to know.

PCI DSS Requirement 4.2.1 mandates strong cryptography to protect cardholder data transmitted over open, public networks as a binding compliance requirement with specific technical standards - not an optional recommendation. The broad phrasing in this choice does not reflect any single standalone PCI recommendation, whereas the other choices correspond precisely to enumerated PCI requirements.

Rotating employees handling card transactions aligns with PCI DSS Requirement 12 personnel management controls, which address separation of duties, background checks, and role-based oversight of staff with cardholder data access.

Placing a firewall between the public network and payment card data is explicitly mandated by PCI DSS Requirement 1, which requires installation and maintenance of network security controls to protect the cardholder data environment.