During a security controls assessment, an analyst finds that an enterprise deploys next-gen firewalls at the perimeter, EDR on all endpoints, and full inbound URL filtering. However, review of firewall logs shows that internal hosts can establish outbound HTTPS sessions directly to any external IP address without inspection. Two recent malware incidents used encrypted outbound channels to reach command-and-control servers undetected. Which control gap should the analyst prioritize recommending to close this weakness?