Cyber Essentials, DSPT and Public-Sector Supply Chains: Can You Use an Offshore Dev Partner?

The Question Public-Sector Suppliers Keep Asking

A UK software supplier wins a place on a framework, or a contract with an NHS trust or a government department, and then hits a familiar problem: delivery capacity. Hiring UK developers is slow and expensive. An offshore team could help. But the contract mentions Cyber Essentials, the NHS Data Security and Protection Toolkit, supply chain security and sometimes data location. Can you use an offshore partner without putting your certification, your framework place or the contract at risk?

The honest answer for cyber essentials offshore development is: sometimes yes, depending on scope, data and contract. This guide explains how the schemes treat remote and offshore staff, where public-sector buyers commonly draw lines, and how to structure an engagement so it holds up in an assessment. Requirements change, so verify everything against current scheme documents and your own contracts. This is general information, not legal advice.

What Cyber Essentials Actually Certifies

Cyber Essentials is a UK government-backed baseline scheme, delivered through accredited certification bodies, that checks an organization against a set of technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Cyber Essentials Plus adds independent technical testing of the same controls.

Two points matter for offshore work. First, certification attaches to an organization and a defined scope, meaning the people, devices, networks and cloud services included in the assessment. It is not a licence that follows your data around. Second, it is a baseline, not a guarantee of security. Many public-sector contracts, particularly those handling personal data or involving certain central government work, require Cyber Essentials as a minimum entry condition, and some require Plus or additional assurance such as ISO 27001.

How Scope Treats Remote and Offshore Staff

The scheme’s scoping rules generally expect that devices used by staff to access organizational data and services fall within scope, wherever they are, including home workers and company or personal devices where permitted. The principle is that if a device or user can reach in-scope data or services, the controls apply to it.

For an offshore team, three scoping routes are commonly considered, and you should confirm with your certification body which is acceptable:

• Offshore staff on your devices and accounts: The developers use endpoints you provision and manage, and access your in-scope cloud environment. These devices sit inside your scope and must meet the controls.
• Offshore staff on vendor devices: The vendor’s devices access your systems. Those devices and the supporting network are effectively part of the access path, so you may need evidence of control equivalent to your own, such as the vendor’s own certification covering those devices, or a managed virtual desktop that keeps data and execution inside your environment.
• Offshore staff with no access to in-scope systems: They work on separate, non-sensitive material and hand over code through controlled channels. This narrows the scope question but may not suit every project.

The cleanest design for many suppliers is a virtual desktop or tightly controlled remote environment hosted in your UK cloud tenancy, with the offshore developer’s local device acting only as a thin client.

Cyber Essentials Offshore Development in Practice

Putting this together, a workable model keeps source code, build pipelines and test data inside UK-hosted accounts you control, uses single sign-on and multi-factor authentication, and applies the five control themes to every endpoint that touches the environment. Offshore developers then contribute through pull requests and reviews rather than holding copies of data locally.

Ask your certification body early how they want offshore staff declared in scope, and document the answer. Assessors differ in how they interpret remote working, and surprises at renewal are costly. Keep an inventory of all devices and users with access, including the offshore team, and re-confirm it before each annual renewal.

NHS DSPT: What It Means for a Software Supplier

The Data Security and Protection Toolkit is the online self-assessment used by organizations that access NHS patient data and systems to show they meet national data security standards. Suppliers to NHS organizations are commonly asked to complete it at the level appropriate to their role and the data they handle, and NHS customers often check an NHS DSPT software supplier’s published status before contracting.

The toolkit’s assertions cover areas such as governance, staff responsibilities and training, managing data access, process reviews, responding to incidents, continuity planning, unsupported systems, IT protection and accountable suppliers. The DSPT is also being aligned over time with the NCSC Cyber Assessment Framework, so expect assertion wording and evidence expectations to evolve. Check the current version and whether your organization type has a specific track.

Offshore Development and the DSPT: The Key Issues

For a supplier using offshore developers, several DSPT themes need thought. Staff responsibilities and training: offshore developers with any access to patient data need appropriate data security training and confidentiality commitments, and you need records. Managing data access: access must be limited, justified, logged and reviewed. Accountable suppliers: you must manage your own suppliers, which includes the offshore vendor, with appropriate contracts and assurance.

Data location is the sharpest issue. NHS organizations are cautious about patient data leaving the UK, and many contracts, guidance documents and local policies restrict or require approval for processing outside the UK. Assume that live patient data should not be accessible offshore unless your contract, your customer’s information governance team and your data protection impact assessment all clearly allow it. The safer pattern is to build with synthetic or properly de-identified data and keep live data in UK-hosted environments accessible only to UK staff.

Public-Sector Supply Chains and Subcontractors

UK public sector offshore development raises the subcontractor question directly. Public contracts typically require suppliers to disclose or obtain approval for subcontractors, flow down security and data protection obligations, and remain responsible for the subcontractor’s performance. Under the Procurement Act 2023 regime, transparency obligations around subcontracting and supply chain have also been tightened for covered contracts, so check what applies to your contract type and thresholds.

Practically, review each contract for clauses on subcontracting consent, personnel security, data location, audit rights and termination. Some contracts demand that named individuals are approved and that those with access to certain data hold UK security clearances or meet specific nationality or residency conditions. Offshore teams usually cannot satisfy such conditions for sensitive work, so identify those restrictions early.

G-Cloud and Framework Considerations

A G-Cloud supplier offshore arrangement has its own considerations. Suppliers on G-Cloud describe their services, security and data handling in their service definition and terms, and buyers make decisions partly on that information. If you list a service stating that data is held and supported in the UK, using offshore access to that data would contradict your own description and could breach your framework terms.

Read the framework agreement, the call-off terms and your own service definition together. Look for clauses on data location, subcontracting, security, personnel and audit. If you plan to use offshore developers only on non-production build work with no access to customer data, document that boundary and make sure it is consistent with your service definition and your customer contracts. If in doubt, ask the buyer or the framework authority rather than assume.

Supply Chain Security UK: What Buyers Expect

Supply chain security UK buyers apply ranges from basic certification checks to detailed assurance questionnaires. Government guidance, including NCSC’s supply chain security principles, encourages buyers to understand their suppliers’ suppliers, to set security requirements in contracts and to monitor compliance. Expect buyers to ask who has access to data, where they are located, how your suppliers are assessed and how incidents are reported.

Suppliers that answer these questions with evidence stand out. Prepare a standard supply chain pack covering your subcontractor register, due diligence summary, contract security schedule, access control model, data location statement and incident process. For regulated sectors with similar duties, our guide to FCA outsourcing requirements for software shows how a regulator frames third-party oversight, which maps well onto public-sector expectations.

Government Security Classifications and Sensitive Work

Public-sector data is handled under the Government Security Classifications policy, which sets handling expectations for OFFICIAL and above. Much digital service work involves OFFICIAL data, including OFFICIAL-SENSITIVE information that needs additional care. Work involving higher classifications or national security contexts usually requires cleared UK personnel and approved environments, which makes offshore delivery unsuitable.

Even for OFFICIAL work, the Cloud Security Principles and your contract may set expectations about data location, administrative access and personnel screening. Classify the data your offshore team could touch before deciding whether offshore participation is acceptable, and keep a written decision record.

Designing an Offshore Engagement That Fits These Constraints

A practical design for suppliers who want offshore capacity while respecting public-sector constraints looks like this:

• Separate build from live data: Offshore engineers work on features, tests and tooling using synthetic or de-identified data.
• UK-hosted environments you control: Repositories, pipelines and environments sit in your UK cloud accounts, with SSO and multi-factor authentication.
• No offshore access to production data: Production access, deployment rights and secrets stay with UK-based, screened staff.
• Managed access path: Offshore developers connect through a virtual desktop or managed endpoints in scope of your Cyber Essentials assessment.
• Peer review and branch protection: UK staff review changes before release.
• Logging and review: Access and activity are recorded and reviewed.
• Written scope boundary: A document records what offshore staff can and cannot touch, agreed with your information governance lead.

This approach also tends to satisfy buyers, because it limits risk and produces clear evidence.

Contract and Governance Terms for the Offshore Vendor

Your agreement with the offshore vendor should flow down what your customers require. Include confidentiality for the vendor and each developer, security obligations matching your contract schedule, restrictions on data location and access, personnel screening and training with records, subcontracting limits, audit and inspection rights, short incident notification, return and deletion of data and code on exit, and present IP assignment to your company.

Keep your own governance in order: a subcontractor register, a documented risk assessment, a data protection impact assessment where personal data is involved, and a named owner. Note that UK GDPR requires a lawful transfer mechanism for personal data sent outside the UK, so avoid transfers altogether where you can through design.

Vetting the Vendor’s Security Evidence

Ask the offshore vendor for evidence, not assurances. Useful documents include an information security policy set, independent certifications where held (for example ISO 27001) with scope, device management and endpoint protection standards, access control and offboarding procedures, security awareness training records, background screening practice, incident response plans and a facility walkthrough. Verify registration independently, which in Pakistan means checking the company’s status with the relevant registries.

If the vendor does not hold Cyber Essentials, which is a UK scheme, do not treat that as disqualifying by itself. The question is whether the devices and access path used by their staff meet the control standard within your scope, by whatever combination of vendor controls and your own managed environment you can evidence to your assessor.

Cost and Commercial Reality

Offshore developers in Pakistan typically run $15–$45 per hour against $80–$130 for comparable UK talent. Public-sector constraints may limit the share of work that can go offshore, but where non-sensitive build, testing and tooling work can be separated, the saving is real. Budget for governance overhead: scoping, documentation, managed access environments, UK-based review time and assurance. A hybrid model with UK staff handling sensitive and customer-facing work and an offshore team handling the bulk of build often gives the best balance.

Choosing an Engagement Structure

Suppliers needing to extend a small UK team can bring in named specialists through flexible IT staffing arrangements, working inside your managed environment. Those building a longer-term capability may prefer to form a dedicated offshore team with continuity and defined controls. For wider options across development, cloud and support, see our overview of IT outsourcing and delivery options. Whichever you choose, agree the scope boundary and contract terms before onboarding.

A Controlled Onboarding Path

A public-sector-aware onboarding adds scoping steps. Days 1–3: review customer contracts, data classification and scope, and NDA. Days 4–7: vendor evidence review and your technical interviews. Days 8–10: agreements with security schedule, IP assignment and individual NDAs. Days 11–14: managed access provisioning, synthetic data setup, architecture walkthrough and a supervised first sprint. Allow extra time if your customer must approve subcontractors in advance.

Getting Started

Cyber Essentials offshore development works when you treat scope, data and contract as the deciding factors: bring offshore access inside your certified scope or keep it away from in-scope data, keep live public-sector data in UK-controlled environments, check subcontractor and data-location clauses for each contract, and document the boundary. Verify current scheme rules and contract terms before you commit, and involve your information governance lead and customer early.