What is not a PCI compliance recommendation?

What is not a PCI compliance recommendation?
A . Use a firewall between the public network and the payment card data.
B. Use encryption to protect all transmission of card holder data over any public network.
C. Rotate employees handling credit card transactions on a yearly basis to different departments.
D. Limit access to card holder data to as few individuals as possible.

Answer: C

Explanation:

https://www.pcisecuritystandards.org/pci_security/maintaining_payment_security Build and Maintain a Secure Network