Outsourcing software development from Missouri

Missouri outsourcing at a glance

The lanes are not interchangeable. A Missouri mailing address does not place an ordinary private product under State purchasing rules. A qualified-vendor-list contract does not prove that a particular statement of work, offshore delivery plan, or data path is approved. An exception is not a blanket permission for every supplier function. A backup site is still a work and data location. “Twenty-four-hour support” is not evidence that the support queue matches a certified place of performance.

The core decision: can normal work and recovery tell the same truth?

Most outsourcing proposals describe normal delivery and postpone resilience until contract negotiation. Missouri’s offshore-services and contingency evidence makes that separation dangerous for State work. A bidder may certify domestic performance while the operating model depends on an overseas escalation desk, global cloud administrator, offshore subcontractor, or recovery site. The system works on an ordinary day, but the first disruption changes who performs the service and where.

Use a work-location and recovery truth lock. It has four linked records:

1. Proposal truth. The prime, every known subcontractor, each service, the normal site, contemplated outside-U.S. work, applicable condition, maximum offshore share where requested, and assumptions used in evaluation.
2. Execution truth. Actual people, service accounts, repositories, build runners, support queues, data stores, model providers, administrative consoles, and physical or cloud operating locations.
3. Recovery truth. Alternate vendors, sites, platforms, data replicas, support contacts, credentials, restoration sequence, and temporary manual procedures.
4. Acceptance truth. The buyer’s proof that an artifact, restored service, incident state, or exit package came through an approved path and matches the contract.

The lock opens only when those records agree. If the recovery plan introduces a site absent from the proposal, the plan is not ready. If a subcontractor changes, the location record and contract review change with it. If an AI coding assistant sends prompts to a new service region, that is a tooling and data-path change even when the human developer stays put. If a domestic vendor routes weekend support abroad, the support operation must be classified rather than dismissed as overhead.

This is useful outside State procurement too. A private Missouri buyer may choose any lawful and suitable international model, but it still benefits from knowing whether the recovery promise depends on undisclosed people, infrastructure, or jurisdictions. The difference is scope: use the State rule only when the State procurement perimeter actually applies; use the truth-lock method as a commercial control wherever it helps.

Scope four Missouri perimeters before comparing providers

Missouri does not impose one outsourcing rule on every buyer in the state. Start with the work, buyer, contract, data, and system.

Ordinary private work

For an ordinary private product, the buyer defines the delivery model subject to applicable federal, Missouri, destination-country, sector, customer, and contract obligations. Executive Order 04-09 is a State procurement authority, not a universal ban on international development. A private buyer can use a direct foreign contractor, agency, managed service, employer-of-record structure, or U.S. prime with international contributors after evaluating the real arrangement.

Missouri section 407.1500 can still matter when the project handles defined personal information of Missouri residents. It distinguishes an owner/licensee from a person maintaining or possessing data it does not own. The maintainer must notify the owner or licensee immediately following discovery of a breach, subject to the stated law-enforcement qualification. The owner retains investigation and consumer-notice decisions. Keep that lane separate from State incident policy.

State bid and contract work

The current procurement authority page links Executive Order 04-09 as an active procurement authority. The exact solicitation controls the procurement. That relationship matters: the order is not a promise that offshore work is always eligible, and a solicitation-specific prohibition is not displaced by a general exception theory.

Read the entire solicitation, amendments, incorporated standards, response forms, award, statement of work, and change process. Record which terms are mandatory, which require a response, which are evaluated, which survive termination, and which apply to subcontractors. Do not convert a vendor handbook summary into a legal conclusion about a new bid.

Consolidated-agency State systems

Missouri ITSD’s Enterprise Architecture is designed to make State technology operate as one enterprise for security, service, and efficiency. Its approved security-domain standards cover supply chain, system life cycle, incidents, contingency, cryptography, authentication, documentation, and other controls. Determine which standards and agency rules are incorporated into the project.

SP-18 expressly reaches employees, contractors, consultants, volunteers, and others authorized to access electronic data of consolidated executive-branch agencies. It requires recurring security education, role-based training for relevant cyber and infrastructure roles, onboarding training, and appropriate application-development, systems-administration, network, and cloud training. A provider roster without training state is incomplete.

Public records and audit

Chapter 610 defines public records broadly enough to include certain records created or maintained by private contractors for a public governmental body. Section 610.029 bars a public-record database contract from impairing public inspection or copying and requires security and integrity provisions for electronic services. Section 29.235 provides State Auditor access and subpoena powers within its scope. Those rules do not make every technical record public; Missouri also authorizes closure for specified security and code records. They do mean a supplier cannot treat platform possession as authority to obstruct a lawful custodian, export, audit, or record decision.

Build the record lane with the custodian and counsel. Separate public, potentially closed, privileged, security-sensitive, source-code, proposal, audit, and ordinary operational material. Preserve the ability to export and review first; decide disclosure under the applicable authority later.

Read Executive Order 04-09 as a decision gate

The official order requires bidders to certify the location where contracted services will be performed and whether any necessary work is contemplated offshore. Missouri’s procurement materials describe four award conditions for work at a site outside the United States:

• a unique good or service is mandatory and no comparable domestically provided service adequately duplicates its unique features;
• a foreign firm is hired to market Missouri services or products to a foreign country;
• a significant and substantial economic cost factor outweighs the domestic economic impact such that failure to use the service would cause economic hardship to the State; or
• the vendor or subcontractor has a significant U.S. business presence and performs only a trivial portion of contract work outside the United States.

Treat these as four separate evidence gates. Do not merge “unique,” “cheaper,” and “trivial” into one persuasive paragraph. Each has different proof, boundary, and change sensitivity.

For the unique-service path, identify the exact feature, why it is mandatory, domestic alternatives evaluated, and what would be lost. A familiar brand, preferred framework, or vendor claim of special expertise is not automatically unique. For economic hardship, normalize complete cost and operational impact; a lower hourly rate by itself does not establish the stated condition. For significant U.S. presence and trivial offshore work, define “trivial” in the response, disclose the maximum percentage where the form requests it, and instrument actual work so the cap can be checked. The foreign-marketing condition is narrow and should not be repurposed for general software delivery.

The order also addresses a later shift after a contractor or subcontractor certified U.S. performance. Missouri procurement guidance describes that shift as breach unless the Office of Administration makes the relevant written determination concerning extraordinary circumstances or State economic hardship. The practical control is simple: no delivery manager, incident commander, vendor account executive, or automated routing rule may relocate work on its own.

Build a location ledger that survives subcontracting

A provider’s headquarters proves little about where services occur. Create one row per operational unit:

Require the prime to maintain the ledger and flow the same disclosure and change duties to subcontractors. Reconcile it against invoices, time records where appropriate, repository identities, service logs, support tickets, cloud regions, model-provider settings, and exercise observations. Do not collect invasive personal location data without a valid need; the objective is to verify contract-relevant execution, not surveil workers.

A supplier directory is not the ledger. A qualified-vendor list shows an available contract relationship, not the people, locations, exception, or statement of work for the buyer’s project. The 2025–2028 CT242213 material covers project management, architecture, custom development, data, security/privacy/accessibility, integration, independent validation, cloud, business continuity, and other categories, but excludes staff augmentation and products, and requires cloud services to be specifically identified in the SOW. Use the actual contract and project assessment process.

Keep international engineering artifact-based where the work lane is narrow

When the solicitation permits a narrowly described international contribution, minimize ambiguity by separating development from State operations.

An outside-U.S. engineering environment can receive public requirements, approved architecture constraints, generated test data, synthetic records, mock interfaces, public standards, and buyer-approved dependencies. It returns a versioned source package, reproducible build instructions, software bill of materials, dependency and license evidence, tests, static and dynamic analysis, vulnerability results, model or prompt package where relevant, limitations, and handover documentation.

The buyer-controlled admission lane then:

1. verifies the source, signer, build and work-location manifest;
2. scans dependencies, secrets, malware, vulnerabilities and prohibited additions;
3. reproduces the build in a controlled environment;
4. runs functional, security, accessibility, performance and recovery tests;
5. confirms that fixtures and outputs do not contain protected production data;
6. checks the accepted artifact against the SOW and exception boundary;
7. obtains a named human release decision;
8. records rollback and rejection state.

This design does not prove that outside-U.S. work is allowed. It makes an already authorized work package easier to describe, constrain, inspect, and exit. If the solicitation prohibits all outside-U.S. performance, even artifact-only work performed abroad may remain prohibited. The buyer must resolve that before work starts.

Make recovery part of the original representation

Missouri’s contingency-planning process starts with scope, responsibilities, testing and maintenance schedules, backup frequency and location, and coordination with security, operations, emergency preparedness, and other plans. Its business-impact analysis identifies processes, tolerable downtime, resources and recovery priorities. Its strategy considers backups, offsite storage, alternate sites, equipment replacement, vendor agreements, existing compatible equipment, roles and cost.

Translate that into contract facts:

• define the business service and minimum viable manual mode;
• set buyer-approved recovery time and recovery point objectives;
• inventory software, data, models, configurations, keys, identities, licenses, facilities, people and vendor dependencies;
• name the primary and alternate execution locations;
• map every backup, replica, observability feed and restore destination;
• preserve an independent copy of source, infrastructure definitions, schemas, runbooks and contacts;
• decide who may activate, operate, communicate, release and return to normal;
• test restoration without using an undisclosed supplier or location;
• record the exact restored version and any lost or replayed work;
• update the proposal/contract record before a permanent change.

Recovery geography and work geography are connected but not identical. A data replica may sit in one site while people administer it from another. A domestic alternate cloud region can still rely on an offshore support queue. A U.S. engineer can invoke a foreign-hosted model or managed service. Record data, people, service, control plane, and artifact paths separately.

Test the truth lock, not just the backup

The contingency testing guidance calls for alternate-platform recovery, coordination among recovery teams, connectivity, alternate-equipment performance, restoration of normal operations, notification, documented lessons, annual testing, training, exercises, vendor contacts, and plan maintenance.

Run one exercise that deliberately pressures the location representation:

1. The primary supplier contact and build runner become unavailable.
2. The team must activate the alternate environment without changing the approved country, site, subcontractor, cloud administration path, or offshore percentage.
3. A simulated vendor proposes an unlisted support center as the fastest recovery option.
4. The incident commander must reject or quarantine that path and escalate for the required written contract decision.
5. The authorized team restores the selected release, validates identity and connectivity, confirms data and key state, and runs acceptance checks.
6. Records, notifications, elapsed times, rejected paths, changed assumptions and unresolved dependencies are captured.
7. The buyer decides whether to update the plan, SOW, exception evidence, supplier roster, RTO/RPO or architecture.

Use measurable acceptance: target recovery time, maximum lost transactions, required functions, permitted locations, approved actors, evidence completeness, notification time, restored-security state, and successful return to normal. “Exercise completed” is not a result.

Treat supply-chain resilience as more than a second vendor

Missouri’s approved supply-chain acquisition guidance connects acquisition methods to law, executive orders, policy, controlled distribution, adequate supply, multiple suppliers, substitutes, assessment before selection or acceptance, and documented evidence. It names design review, static and dynamic analysis, simulations, white/gray/black-box testing, fuzzing, stress testing and penetration testing among possible assessments.

For software and AI, “adequate supply” can mean:

• more than one person understands the system and recovery path;
• the buyer holds source, build, deployment and model configuration evidence;
• critical dependencies have approved versions, substitutes or removal plans;
• vendor accounts and signing keys are not controlled by one individual;
• the buyer can replace a hosted service without losing records or business logic;
• a second supplier is contractually and technically eligible for the same work location;
• the alternate component or vendor has already passed acceptance and location review;
• the provider’s own supplier failure does not force an unapproved offshore shift.

Do not add a nominal backup vendor whose personnel, tooling, data access and place of performance were never assessed. Resilience is an executable option, not a logo in a slide.

Separate incident clocks and authority

For private work involving Missouri resident personal information, section 407.1500 defines the trigger and roles. A non-owner maintainer should provide the owner immediate facts, not wait to decide consumer notice. The owner needs enough evidence to determine unauthorized access and acquisition, affected fields and residents, encryption or redaction state, scope, restoration, fraud risk, law-enforcement constraints and notice. If the owner determines notice is not required under the statute’s risk path, preserve the written determination for the stated five years.

For Office of Administration data, C-19 has a narrower policy scope and its own command path. It calls for immediate reporting by relevant employees or contractors to OCS, identification of involved third parties, awareness of storage locations, technical investigation, a timeline, backup processes for continuity, and evidence preservation with chain of custody. Do not generalize the named phone route to every public entity or private company; bind the actual agency and contract contacts.

Use progressive incident packets:

• initial signal: reporter, time, system, symptom, suspected data/service, containment already taken, location and people involved;
• operational state: affected identities, repositories, services, primary/recovery locations, business impact, safe actions, continuity decision;
• technical evidence: logs, files, images, commands, vulnerability, acquisition facts, data fields, encryption state, timeline and preserved hashes;
• decision packet: applicable owner/maintainer or agency lane, affected population, notice and law-enforcement inputs, communications authority, recovery candidate and residual risk;
• closure: accepted restored state, rotated access, retained evidence, lessons, contract/location change, disposal and follow-up.

The international team may contain, preserve and report within written authority. It should not make the buyer’s legal notice, public communication, State command, or restored-production release decision unless the contract lawfully and explicitly assigns that decision.

Preserve public access without exposing security detail

Missouri public-record work needs two capabilities at once: usable access to records that must be available and controlled protection for records that may lawfully be closed. Section 610.029 prohibits a database contract that makes inspection or copying practically harder and calls for security and integrity terms. Section 610.021 separately addresses source code, procurement-stage material, security configurations and other categories. Design for segregation rather than an all-open or all-secret system.

Require:

• a field and record inventory with public/closed decision ownership;
• export in usable, documented formats without proprietary extraction fees or vendor-only tools;
• preservation of original values, timestamps, relationships and disposition state;
• search, view, print, copy, redaction and audit-log tests;
• separate protected configuration, credentials and security evidence;
• contractor-created record capture where Chapter 610 applies;
• retention, legal hold, destruction and migration procedures;
• State Auditor and agency access consistent with the contract and law;
• an exit rehearsal that imports the export into a clean target.

Do not put secrets or exploit detail into a public-safe release merely to prove transparency. Do not use security as a reason to make an otherwise public database practically inaccessible. The records custodian and security owner need a shared decision log.

Include AI services in the work-location record

Missouri’s evidence here does not create one general private-sector AI law or one universal State AI permission. AI still changes the place-of-performance and supplier analysis.

Inventory each model, coding assistant, agent framework, retrieval service, vector store, evaluation platform, observability tool and human review queue. Record provider and subprocessors, service and support locations, prompt/input classes, training and retention settings, model/version, tools/actions, production authority, logs, incident path, continuity and exit.

An agent operating in a domestic cloud region can call a service or human review queue elsewhere. A recovery configuration can select a different model provider. A code assistant can send repository fragments outside the approved work lane. Treat these as actual service paths.

For artifact-only AI engineering, return prompts or templates where appropriate, model and provider identifiers, input provenance, evaluation sets, measured results, failure modes, tool permissions, human-review record, reproducible configuration, monitoring thresholds, rollback and retirement instructions. The buyer releases the artifact; the model does not approve itself.

Schedule Central-time authority from real locations

Missouri uses Central Time, but an international delivery city can change its UTC offset on dates different from U.S. daylight-saving transitions. Use the IANA time-zone database to calculate overlap for the buyer’s real city, execution sites, recovery sites and incident contacts on representative dates.

Build three windows:

• delivery overlap: sustainable product, design and engineering collaboration;
• decision window: named Missouri-side owners for scope, data, security, exception, acceptance and production release;
• incident/recovery coverage: an acknowledged route with safe containment authority and backup owners outside ordinary hours.

Do not solve continuity by silently moving work to a different global center. A relay follows the same work-location ledger or triggers contract review. Test U.S. and destination clock transitions, holidays, supplier absence, network disruption and degraded manual mode.

Compare destination countries after the Missouri gate

The Missouri decision answers whether and how a work package can leave the United States under the applicable buyer and contract perimeter. It does not select the country.

For each proposed destination, verify:

• exact contracting entity, beneficial and operational facts appropriate to risk;
• worker or subcontractor structure and authority;
• assignment of employee, contractor, model and collaborative IP;
• confidentiality and trade-secret controls;
• data-transfer, localization, sector, sanctions and export-control questions;
• currency, tax, invoicing and payment assumptions;
• actual people, cities, work sites, support and recovery sites;
• secure development, component provenance and vulnerability response;
• language, overlap, holidays, travel and decision latency;
• enforceability, dispute path, insurance and practical exit.

Use the WIPO office directory to reach the relevant destination-country sources. Do not claim a Missouri choice-of-law clause automatically resolves contributor rights or local mandatory rules.

Normalize complete cost and exception evidence

Hourly-rate comparison is especially weak when an exception or resilience claim depends on cost. Model the same accepted outcome:

If evaluating the economic-hardship condition, document domestic alternatives and the total State impact, not just provider labor. If relying on the trivial-offshore condition, price and measure the capped task so growth is visible. Do not invent a legal threshold for “trivial”; use the exact solicitation, response and approving interpretation.

Put these questions in the RFP and demo

Before issuing the questions, decide how answers will become operating controls. A long response is not useful if no field reaches access provisioning, support routing, recovery configuration, invoice review, or change approval.

Reconcile the proposal to actual performance

Create a monthly reconciliation that is narrow enough to operate and strong enough to expose drift. The procurement owner should not need personal surveillance or a forensic investigation to discover that a represented domestic service is now performed elsewhere.

Start with the approved work-location ledger. Compare it with contract-relevant evidence:

• named prime and subcontractor roster changes;
• repository, build and deployment identities associated with accepted versions;
• support and incident tickets showing the assigned queue and escalation path;
• cloud, model, observability and managed-service region or support-setting changes;
• invoices and work-package reports against the disclosed task and maximum share;
• recovery-plan and vendor-contact changes;
• new tools, integrations or affiliates receiving source, prompts, data or credentials;
• exception or written-determination review dates;
• rejected paths, policy violations and remediation.

The result should be one of four states: matched, explained within the existing approval, change review required, or stop/quarantine. “Unknown” cannot become an informal approval. Assign a deadline and owner to resolve it before the affected work is accepted or invoiced.

Reconciliation also protects the provider. When the contract clearly distinguishes an approved international artifact team from domestic operations, evidence can show that the supplier stayed inside the agreed lane. It reduces the risk that a buyer later interprets every automated service or affiliate as undisclosed performance without examining the actual SOW.

Use proportional proof. A low-risk private prototype may need a simple roster, tool inventory and monthly attestation. A State system with a narrow offshore condition may need version-level location evidence, subcontractor reporting, support-queue controls, invoices tied to work packages, and independent sampling. The buyer should document why the evidence is sufficient and how long it is retained.

When a mismatch appears, preserve the facts before changing the system. Identify the work, actor, site, time, data, artifact, contract paragraph, reason, benefit, affected recovery path and buyer decision. Stop only the affected lane where safe. Do not destroy incident or performance evidence in the act of removing access.

Design a recovery stack the buyer can actually carry

Supplier recovery fails when the provider alone owns every prerequisite. A usable Missouri truth lock gives the buyer an independent path through five layers:

1. Identity. Buyer-controlled administrative accounts, break-glass procedure, signer inventory, recovery contacts and revocation evidence.
2. Knowledge. Current architecture, dependency map, data dictionary, operating constraints, runbooks, decision history and known defects.
3. Artifact. Source, reproducible build, infrastructure definitions, schemas, migrations, configuration templates, model and evaluation assets, dependency locks and release signatures.
4. State. Approved backups, export formats, key handling, retention, restore sequence, reconciliation rules and proof of the last successful restore.
5. Authority. Named people who may declare disruption, activate an alternate, accept restored state, communicate externally, approve a location change, return to normal and close the event.

Test each layer independently. A complete repository is not useful if the build depends on a departed engineer’s account. A valid backup is not useful if the schema, key or restoration order is missing. A detailed runbook is not useful if the replacement vendor is ineligible under the location representation. An alternate site is not useful if the buyer cannot lawfully or technically reach it.

For a managed AI service, add the model/version, system prompts or equivalent configuration, retrieval indexes, evaluation sets, safety settings, tool permissions, rate limits, monitoring thresholds and a downgrade or removal path. Decide which assets can be exported and which need a documented substitute. Recovery should preserve the buyer’s decision boundary rather than merely returning any model response.

The final recovery packet should be small enough to locate during an incident, protected according to its sensitivity, and duplicated in an approved independent location. It should point to authoritative artifacts rather than contain stale copies of everything. Test it with a person who did not write it.

Watch for Missouri-specific failure modes

• The headquarters shortcut. The proposal lists a U.S. prime but omits the subcontractor or support site that performs the service.
• The exception blend. The response combines uniqueness, price and U.S. presence without proving any one stated condition.
• The recovery escape hatch. Normal work is domestic, but the continuity plan routes production administration or support to an unlisted global center.
• The percentage without a denominator. “Less than five percent” does not say whether the measure is hours, fees, deliverables, contract value or people.
• The cloud-only map. Data regions are recorded while human administration, model services, build runners and incident queues remain invisible.
• The QVL assumption. A statewide vehicle is treated as approval of the project, supplier team, SOW, data, security and location plan.
• The record hostage. The vendor can export screenshots or PDFs but not a usable database with relationships, timestamps and disposition state.
• The annual theater. A tabletop ends with no measured result, remediation owner, contract implication or updated plan.
• The emergency email. A manager authorizes a new site in chat even though the contract requires a different written determination or amendment path.
• The exit afterthought. Source is returned, but keys, build services, model configuration, records, support knowledge and subcontractor copies remain outside buyer control.

Turn each failure mode into a test. A control is stronger when the buyer has watched it reject the wrong path, not merely heard that it would.

1. Identify every entity and subcontractor that will perform or support the service.
2. For each service, state the normal and recovery country, city/site or cloud region.
3. Is outside-U.S. work prohibited by this solicitation? Cite the controlling paragraph.
4. If proposed, which Executive Order 04-09 condition is relied on and what evidence supports it?
5. What maximum portion of contract value and work is performed outside the United States where requested?
6. Which tools, model services, support queues and administrators create additional places of performance?
7. How is a new subcontractor, site, service region, support center or offshore share blocked before approval?
8. What data, prompts, source, credentials and production actions can each actor access?
9. Can international contributors build against synthetic fixtures and return inspectable artifacts?
10. Show a reproducible build, dependency inventory, scan, evaluation and buyer acceptance record.
11. Demonstrate recovery on the approved alternate platform without changing the work-location ledger.
12. Show the last exercise result, deficiencies, owners, remediation and updated plan.
13. How are incident evidence, immediate escalation, continuity and legal/public communication separated?
14. How are contractor-created State records captured, exported, redacted and migrated?
15. What source, data, model, configuration, records, credentials and knowledge return at exit?

Ask finalists to demonstrate, not narrate. Give them a small representative work package and a recovery scenario that offers an attractive but undisclosed alternate site. Observe whether their process blocks the shortcut.

Contract the truth lock

The contract and SOW should state:

• exact prime, disclosed subcontractors and change process;
• services and ordinary/recovery places of performance;
• applicable prohibition or offshore condition and locked supporting facts;
• maximum offshore percentage or task boundary where used;
• no unapproved relocation through support, affiliate, cloud, model, recovery or subcontracting;
• data, environment, identity, tool and production authority;
• secure-development, component, testing and acceptance evidence;
• training requirements and maintained records where applicable;
• backup, RTO/RPO, alternate platform/site, annual exercise and remediation;
• incident clocks, safe containment, evidence, chain of custody and buyer decisions;
• public-record, audit, retention, export, redaction and migration support;
• IP assignment, confidentiality, open-source and AI-output handling;
• invoice/location reconciliation and audit rights;
• transition assistance, access revocation, return and verified destruction.

Use a written exception and change register. Each row records the contract paragraph, fact, owner, approver, evidence, effective date, expiration or review date, affected work, recovery implication and closure. A sales email is not the register.

Run a paid truth-lock pilot

Use a four-to-six-week pilot with a bounded, reversible feature and one recovery exercise.

Week 0 — classification. Decide private versus State scope, read the solicitation, classify data and records, define the artifact, identify normal and recovery locations, and resolve whether outside-U.S. work is prohibited or conditionally eligible.

Week 1 — evidence. Verify entities, subcontractors, people, tools, model services, sites, roles, training, repositories, access, contract condition, IP chain, cost and exit deliverables. Create synthetic fixtures and acceptance tests.

Weeks 2–3 — delivery. Produce small signed versions. Keep State operations and data inside the approved lane. Record build, dependency, evaluation, review, location and decision evidence. Measure clarification latency, rework and buyer effort.

Week 4 — recovery pressure. Remove the primary person or platform. Offer an undisclosed alternate. Require the team to stop, escalate and recover through the approved path. Measure RTO/RPO, functions restored, evidence, notifications and restored-security state.

Week 5 — exit. Export source, build, data or fixtures, records, configurations, model assets, tickets, decisions and runbooks; rotate access; reconcile subcontractors and work share; destroy residual material as required; import the package into a clean buyer-controlled environment.

Expand only if the buyer can answer who performed the work, where normal and recovery work occurred, why the lane was allowed, what was accepted, how recovery behaved, what evidence remains, and how the relationship ends.

Frequently asked questions

Can a Missouri company hire developers outside the United States?

Generally, a private Missouri company can evaluate international delivery under its applicable contracts and laws. Executive Order 04-09 is a State procurement control, not a general prohibition for every Missouri business. The buyer still needs entity, data, IP, security, tax, employment, export and destination-country review.

Does Missouri ban offshore work on every State contract?

Do not reduce the current materials to that sentence. The order restricts awards and describes conditions; an exact solicitation may prohibit outside-U.S. work or may require compliance with the order. Read the active solicitation, response form, award, SOW and incorporated terms with the responsible procurement and legal owners.

Is disclosure alone enough for State offshore work?

No. Disclosure identifies the proposed performance. The award restriction and applicable condition still need to be resolved, and a solicitation-specific prohibition may control. The buyer should preserve the evaluation and written contract basis.

Can a U.S. prime use an international subcontractor?

The prime’s address does not answer the place-of-performance question. Disclose and evaluate the subcontractor, exact service, site, work share, tools and recovery path under the solicitation and order. Flow the same change duties down the chain.

What does “trivial portion” mean?

The cited State materials use the phrase but this guide does not invent a universal numeric threshold. Define the task and maximum share in the bid where requested, obtain the responsible interpretation, measure actual performance, and stop before the representation changes.

Can disaster recovery use an overseas team if normal work is domestic?

Not silently. Recovery is still service performance. Put alternate people, vendors, sites, platforms, support queues and administration paths in the original ledger, or trigger the required written contract decision before changing them.

Is a cloud region the only location that matters?

No. Record data stores and replicas, control-plane administrators, support queues, model services, build runners and people. A U.S. data region can be operated from an undisclosed site.

Does a State qualified-vendor list approve every proposed team?

No. It provides a procurement vehicle subject to its terms. The project still needs the applicable assessment, SOW, category, vendor, subcontractor, location, security, data, acceptance, continuity and change evidence.

Can an outside-U.S. team deliver only source code?

Artifact-only delivery can reduce data and operational access, but it does not override a prohibition on where services are performed. Use it only after the work lane is authorized, then inspect and accept the artifact in a buyer-controlled environment.

What incident notice should the supplier promise?

Use the applicable lane. A non-owner maintaining Missouri resident personal information should support immediate owner notification under section 407.1500. A covered Office of Administration project follows its agency and OCS route. Contract a faster operational signal with progressive facts without transferring the buyer’s legal or public-communication authority.

Are supplier records public records?

Some records created or maintained by a contractor for a Missouri public governmental body can fall within Chapter 610’s definition. Applicability and closure decisions are fact-specific. Design capture, segregation, export and custodian authority without promising that every technical record is public.

How often should recovery be tested?

The cited State contingency guidance says testing should occur at least annually and after relevant changes through plan maintenance. A high-change or high-impact project may need more frequent component and supplier exercises. Contract the cadence and triggers.

Should a recovery test actually cut over?

Use risk-proportionate progression: tabletop, technical restore, functional simulation, and controlled cutover where appropriate. The State guidance recognizes both tabletop and functional exercises. Define safeguards so the exercise does not harm normal operations.

How should AI coding tools be handled?

Treat each tool as a supplier, data path and possible place of performance. Approve inputs, provider, region, retention, training, subprocessors, model/version, output review and recovery behavior. Return reproducible evidence and keep human acceptance with the buyer.

What is the best country for a Missouri buyer?

There is no universal best country. First resolve the Missouri buyer and contract perimeter; then compare actual entities and teams on people, work locations, data, IP, security, overlap, complete cost, continuity and exit.

Missouri buyer checklist

• Separate ordinary private, State procurement, consolidated-agency system, public-record and incident perimeters.
• Read the exact solicitation, amendments, award, SOW and incorporated controls.
• Decide whether outside-U.S. work is prohibited or conditionally eligible.
• Record the exact Executive Order 04-09 condition and supporting evidence where applicable.
• Identify every prime, subcontractor, affiliate, service, tool, model and support queue.
• Map normal and recovery people, sites, cloud regions, data, control planes and artifacts.
• Cap and reconcile offshore work share where the response relies on a narrow boundary.
• Block unapproved supplier, site, service, region, tool, data and recovery changes.
• Use synthetic fixtures and artifact admission where authorized and appropriate.
• Require reproducible build, dependency, test, evaluation and human-release evidence.
• Define RTO/RPO, alternate platform, vendor contacts, annual exercises and remediation.
• Test a tempting undisclosed recovery shortcut and require the team to stop.
• Keep private and State incident roles, clocks, evidence and communications separate.
• Preserve public-record usability, protected-record segregation, audit and migration.
• Verify destination-country IP, data, engagement, sanctions and export questions.
• Normalize buyer work, location control, resilience, risk and exit in complete cost.
• Exercise source, data, record, configuration, model, credential and knowledge exit.
• Obtain named human procurement, security, records, recovery and release decisions.

The best Missouri outsourcing plan is not the one with the broadest global roster. It is the one whose contract, actual work, recovery behavior, accepted artifacts and retained evidence keep telling the same verifiable story—even when the primary supplier path fails.