Which one of the following statements is not true about compensating controls under PCI DSS$?$

$q,$

Encrypt transmission of cardholder data across open public networks.

Use and regularly update antivirus software or programs.

Do not use vendor$-$supplied defaults for system passwords and other security parameters.

Allow physical access to cardholder data.