💡 A. Require a Service Organization Controls (SOC) report from the service provider → While requesting a SOC report can provide valuable insights into the controls of the service provider, it is more of a monitoring and assurance tool rather than a directive control. It helps assess the service provider’s controls but doesn’t directly enforce any action. B. Include a data protection clause in the contract with the service provider → Correct Answer. A data protection clause in the contract is a directive control that legally mandates the service provider to comply with specific data protection requirements, ensuring the protection of sensitive employee data. This establishes clear expectations and accountability for the handling of such data. C. Obtain a nondisclosure agreement from each employee at the service provider who will handle sensitive data → While obtaining nondisclosure agreements (NDAs) is a good practice for protecting confidential information, it is more of a preventive measure than a directive control. It focuses on the individuals involved, but it doesn't directly set organizational-level directives for protecting data. D. Encrypt the employees' data before transmitting it to the service provider → Encrypting data is a preventive control that helps protect data during transmission. While encryption is essential for security, it does not establish a formal directive for the service provider to follow in managing sensitive data as part of a broader contractual arrangement.