Published rankings of outsourcing companies are close to useless for this decision, because the qualities that predict a good outcome are relationship specific and invisible from outside: who is actually assigned to you, how the firm behaves when it is late, and whether its process survives contact with your requirements. Those are knowable, but only by asking directly.
With developers outsourcing, ask about the team you get rather than the company you are buying
A firm's average quality is irrelevant; the five people assigned to you are the entire product. Ask for their names, their tenure at the firm, what else they are working on, and who decides if they are moved. Ask what the firm's annual attrition is and get the number rather than an adjective. A supplier that will put the assigned team in the contract with notice periods for replacement is offering something materially different from one that sells you a capability and staffs it later.
Software developer outsourcing references are only useful if you ask the failure questions
Any firm can supply happy references, so use the calls differently. Ask what went wrong and how it was handled. Ask whether the project was late and who said so first, because a supplier that reports its own slippage early is worth a premium. Ask whether the team changed mid engagement and what that cost. Ask if they would use the firm again for something harder. The answers to those four predict your experience far better than a case study.
Test the process on something small and real, whichever of the top IT outsourcing companies you shortlist
The most informative thing you can buy from a shortlisted firm is a small paid piece of real work, ideally a genuine integration or a slice of the actual system rather than a demonstration. You learn how they ask questions, how they handle ambiguity, what their code review looks like and whether their estimates mean anything. That is a few weeks and a modest amount of money against a decision that will run for years, and it is the single highest value step in the selection.
Security and data handling, written down before the pilot
Wherever the firm is, it will hold your data and your credentials, so require the controls in writing early. The elements at 16 CFR 314.4 make a practical checklist even outside financial services: a named person accountable for security, a written risk assessment, access controls, encryption in transit and at rest, multi factor authentication, secure development practices, logging and monitoring, periodic testing and incident response. Ask which of those exist today rather than which are planned.
Questions people ask about software outsource companies
Are lists of the best IT outsourcing companies or the best offshore development companies worth using?
Barely, and mostly as a list to start from. They measure firm size and marketing, not the five people who will be assigned to you or how the firm behaves when it is late. Use them to build a shortlist, then decide on named teams and a paid pilot.
What is the single best step for choosing an outsourcing development company?
Buy a small piece of real work from each finalist. A few weeks of genuine delivery tells you more about estimates, code quality and communication than any number of references or proposals.
What should we require of IT outsourcing providers and any offshore software outsourcing company on security?
A named security owner, written risk assessment, access controls, encryption in transit and at rest, multi factor authentication, secure development practices, logging, periodic testing and an incident response plan. The list at 16 CFR 314.4 is a good template to copy.