This is also NIST’s guidance. The problem is that PCI requires it pretty explicitly, so if your company requires PCI compliance then you have to convince your auditor to give you an exception.