What is not a PCI compliance recommendation?

What is not a PCI compliance recommendation?
A . Use a firewall between the public network and the payment card data.
B . Use encryption to protect all transmission of card holder data over any public network.
C . Rotate employees handling credit card transactions on a yearly basis to different departments.
D . Limit access to card holder data to as few individuals as possible.

Answer: C