Customer must have software firewalls on all servers and workstations enabled and blocking all unnecessary traffic between local workstations.  PCI DSS 1, NIST 3.13.1, 3.13.5, 3.13.2