The controls enterprise clients ask for, and the ones that actually reduce risk.
Offshore risk is an operating-model question, not a geography question.
Managed devices, enforced MDM, least-privilege access and physical facility control close the majority of the exposure.