How to outsource software development.

The three shapes are staff augmentation, fixed-scope project, and managed team. Staff augmentation puts named engineers inside your process. Your standup, your ticketing, your PM. You are buying capacity. Fixed-scope buys an outcome with acceptance criteria. You are buying a shipped thing. Managed team buys a small pod against a roadmap you approve. You are buying velocity against a direction. Almost every failed offshore engagement started with a buyer who wanted managed team and wrote an SOW for fixed scope, or wanted fixed scope and hired staff augmentation.

Pick the shape before you talk to a vendor. Write it in one sentence at the top of your scope document. The vendor's pitch has to fit that shape. If the vendor tries to sell you a different shape, note that and interview two more.

A scope document is not a requirements list. It is a two- to three-page document that names the smallest valuable thing this engagement will ship in 90 days, the one person on your side who owns acceptance, the budget envelope you will not exceed without a board conversation, and the two or three constraints that would make this engagement wrong for a given vendor. If you cannot write it in three pages, you have not thought about the engagement enough to hire anyone.

Send the scope to the vendors before the first call. The good ones will push back on it in ways that improve it. The weak ones will read it back to you.

Nine out of ten offshore vendors clear a basic technical bar. That is not where engagements fail. Engagements fail on ops discipline the buyer did not check because they were too busy comparing tech stacks. Disqualify first on: registered legal entity with a physical address, written security policy dated inside 12 months, MFA enforced on source control and cloud consoles, a stated background-check policy for staff who touch customer systems, a subprocessor list including freelancers, and a tested backup restore date newer than six months.

If a vendor cannot produce evidence of any of those inside 48 hours of a request, they are not a candidate for a project bigger than a two-week trial. This is not a talent question. It is an ops-maturity question, and ops maturity is what carries the engagement past the first crisis.

Case studies are marketing. Reference calls are evidence. Insist on two current-client reference calls within 48 hours of shortlisting a vendor. On the call, ask two questions and let the reference answer at length: how did the team behave when something went wrong, and would you hire them again for a different problem. Everything else is secondary.

If a vendor cannot line up two references who will pick up the phone inside 48 hours, that is signal. Either the references do not exist in the shape claimed, or the vendor's relationship discipline is thin. Both matter.

For anything bigger than a two-week trial, sign an MSA plus a SOW. The MSA covers IP assignment (all deliverables assigned on payment, with a background-IP carve-out for the vendor's reusable frameworks), confidentiality with a specified duration, liability cap at 12 months of fees, a defined governing law that is not the vendor's home jurisdiction, and a subprocessor notification clause with 30-day objection rights.

The SOW covers milestone gates every two to four weeks, acceptance criteria written in plain English (not story points), a named US or EU escalation contact with a business-hours SLA, a workstation clause covering non-EEA staff if the buyer has residency requirements, and a paid two-week transition window at existing rates for graceful exit. The gates go in before signature, not after the first crisis.

The buyer's job in week one is to close the trust deficit before it hardens. That means: a written kickoff document produced jointly with the vendor covering communication cadence, decision rights, and escalation triggers; a first-week deliverable that both sides can point at (a stood-up dev environment, a first ticket landed, a technical spike written); and a scheduled 30-minute retro at the end of week two where both sides raise one thing that is not working. Engagements that skip week-one discipline spend the next three months paying interest on that gap.

Pre-decide the three triggers that move the engagement from green to yellow on your side. Common ones: two consecutive missed acceptance gates, an unplanned change in the named engineers on the account, or a security incident regardless of severity. Pre-decide who you call on the vendor's side and what the response SLA is in writing. Pre-decide what graceful exit looks like and what it costs. Every offshore engagement crosses a moment where the buyer wonders if it is in trouble. Pre-deciding converts that moment from panic into procedure.