Which of the following is a 'Complementary User Entity Control' (CUEC) likely to be found in a payroll service provider's SOC 1® report?

The service provider backs up the payroll database nightly.

The user entity must notify the service provider of terminated employees within 24 hours.

The service provider encrypts data in transit.

The service provider performs background checks on its employees.