All of these are US companies, in which case the GDPR explicitly states that I need to have additional contractual clauses to transfer the data to the US, which

All of these are US companies, in which case the GDPR explicitly states that I need to have additional contractual clauses to transfer the data to the US, which would be nice to avoid. Furthermore, recent court decisions have stated that I, as the data controller, need to take additional technical measures to protect the data being transfered... which I'm supposed to do how exactly with e-mail?