Limits on offshoring in commercial software subcontract

Hello. Company sells commercial software solutions to the VA via value added reseller primes that hold GSA Schedules and VA IDIQs. Their software is based in the cloud and transmits PII and PHI. We are trying to define any restrictions to offshoring software developers. Seems like this should be a straightforward inquiry, but we are not finding anything on point. Wondering if anyone here could point us in the right direction. Thanks