A financial services company suffered a breach where an attacker compromised a single workstation in the general employee VLAN and then pivoted directly to database servers holding customer records. The SOC lead is tasked with recommending a network hardening control that would most effectively limit an attacker's ability to move laterally between individual workloads within the same data center, even when hosts reside in the same subnet. Which recommendation best meets this requirement?