← VCE Software Development U4O2

Choosing in-house or external development

Choosing in-house or external developers by weighing cost, skills, control, security and time against the organisation's objectives, sometimes using a hybrid of both.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 8

Understanding Choosing in-house or external development in VCE Software Development U4O2

What it does: Splitting the work by sensitivity keeps control over security-critical code and still uses outside skills or capacity. External developers already have the skills and can start quickly, which meets the time and skills criteria. Contracts should state security requirements, such as secure coding, data handling and breach reporting, so the supplier is accountable. A sourcing decision compares each option against these criteria instead of relying on a single factor. When development is external, security requirements and responsibilities must be written into the contract so they can be enforced.

Common mistakes: On the cost criterion, external development is only the better choice when it costs less. The test should be ext_cost < in_cost, not >. The organisation should only sign when the supplier meets every security requirement. 'or' lets one requirement pass the check, so it should be 'and'.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Choosing in-house or external development to a class →

This module's key terms are also in a printable crossword (Modules 1–22) and word search (Modules 1–47).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A bank must keep tight control over how customer data is handled. Which sourcing choice usually gives it more direct control?
In-house developmentExternal development
Matches
choose EXTERNAL because it is cheapest
↓
The decision uses only cost. It should weigh cost, skills, control, security and time against the organisation's objectives.
Applying
Meanings
Term
sourcing decision
Meaning
Choosing in-house or external developers by weighing cost, skills, control, security and time against the organisation's objectives, sometimes using a hybrid of both.
Practice
IF skillsInHouse = FALSE AND security = "high" THEN
Testing
Gaps
inHouseSkills = FALSE THEN
Check Answer
Spots
2ext_cost = 60000
3if ext_cost > in_cost:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Golden Eagle' badge — High Flyer, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A bank must keep tight control over how customer data is handled. Which sourcing choice usually gives it more direct control?
A. In-house development ✓
B. External development
In-house teams work under the organisation's own policies and supervision, so control over security and data handling is more direct.
2. A small start-up needs an app built fast but has no developers. Which option is likely to suit its time and skills criteria?
A. Wait to train a new in-house team from scratch
B. Hire an external development company ✓
External developers already have the skills and can start quickly, which meets the time and skills criteria.
3. Which is the best way to make a sourcing decision?
A. Compare each option against criteria linked to the organisation's objectives ✓
B. Pick whichever option has the lowest upfront price
A sourcing decision weighs cost, skills, control, security and time together. Cost alone ignores the other criteria.
4. Which contract clause best protects an organisation's security when it uses an external developer?
A. Letting the supplier choose its own security practices without checking
B. Requiring the supplier to follow set security requirements and allow audits ✓
Contracts should state security requirements, such as secure coding, data handling and breach reporting, so the supplier is accountable.
5. What is a hybrid approach to development?
A. Using an in-house team for sensitive parts and an external supplier for other parts ✓
B. Using two different external suppliers and no in-house staff
A hybrid approach combines in-house and external developers, for example keeping the security-critical code in-house.

Match the Pairs

criteria = [cost, skills, control, security, time] → The factors an organisation weighs when comparing in-house and external development against its objectives
contract.require(secureCoding, breachReporting) → A supplier contract clause that sets security requirements the external developer must meet
A hybrid approach keeps sensitive work in-house and gives less critical work to an external supplier → authModule = IN_HOUSE; websiteDesign = EXTERNAL
Comparing options against criteria means scoring each option on every criterion and choosing the best fit for the objectives → IF totalExternal > totalInHouse THEN choose EXTERNAL
choose EXTERNAL because it is cheapest → The decision uses only cost. It should weigh cost, skills, control, security and time against the organisation's objectives.
contract: supplier handles security, no requirements written → Security requirements are not specified. The contract should state the security requirements the supplier must meet, because outsourcing does not remove the organisation's responsibility.

Key Term

sourcing decision
Choosing in-house or external developers by weighing cost, skills, control, security and time against the organisation's objectives, sometimes using a hybrid of both.

Fill in the Blanks

1. IF inHouseSkills = FALSE THEN option ← "external" END IF
Hint: Type the keyword that starts a decision based on a condition, here checking whether the organisation lacks the skills.
2. score ← cost + skills + control + security + time
Hint: Type the criterion about protecting the software and its data that is weighed alongside cost, skills, control and time.
3. IF contractSigned AND auditDone THEN approveSupplier() END IF
Hint: Type the logical operator that requires both the signed contract and the supplier audit to be true.
4. IF coreInHouse AND supportExternal THEN approach ← "hybrid" END IF
Hint: Type the keyword that ends the condition and begins the action to run when it is true.
5. IF supplierRiskScore > maxRisk THEN rejectSupplier() END IF
Hint: Type the comparison operator that checks whether the supplier's risk score is above the limit set in the security requirements.

Spot the Error

Question 1
A in_cost = 90000
B ext_cost = 60000
C if ext_cost > in_cost:
D choice = 'external'
Line C — On the cost criterion, external development is only the better choice when it costs less. The test should be ext_cost < in_cost, not >.
Question 2
A clause = True
B nda = True
C audit = True
D if clause or nda or audit:
E sign_contract()
Line D — The organisation should only sign when the supplier meets every security requirement. 'or' lets one requirement pass the check, so it should be 'and'.
Question 3
A core_code = in-house
B extras = 'external'
C approach = 'hybrid'
D print(core_code, extras)
Line A — The text 'in-house' must be in quotes. Without quotes Python reads in-house as a subtraction of two undefined names. It should be core_code = 'in-house'.
Question 4
A cost = 4 * 0.3
B skills = 5 * 0.2
C score = cost * skills
D print(score)
Line C — A weighted decision score adds up the weighted score of each criterion. Multiplying them distorts the result. It should be score = cost + skills.
Question 5
A weights = [3, 2, 5]
B total = sum[weights]
C print(total)
Line B — Functions are called with round brackets, not square brackets. It should be total = sum(weights) to add up the criteria weights.

Student with a class code? Join your class →