IT Solutions to Build Scalable Professional Services Firms

IT solutions for professional services firms, built to improve operations, secure data and deliver scalable digital platforms for growth. This page sets out the three ways we work with a firm, the rules that reach a firm's client data, how an engagement runs, what moves the cost, and what to ask any firm bidding for the work, including us.

On this page

• Three ways to engage, compared
• The rules that reach a professional services firm's data
• How an engagement runs
• What drives the cost
• What to ask any firm before you hire one
• What you receive
• Case studies, delivered by NeoSOFT
• Frequently asked questions
• Related pages

Three ways to engage, compared

The service cards above describe three different arrangements, and the difference between them is who faces your client and who carries the delivery.

Behind all three, a senior Sthenos team stays accountable on every engagement. The commercial relationship stays with Sthenos.

The rules that reach a professional services firm's data

Confidentiality is on the White-Labeled card above, and for a firm that holds client data it is also a set of named frameworks. Each entry names who issues it and whom it binds, and links the issuer's own page so you can read the source rather than take our word for it.

The FTC Safeguards Rule, for accounting and tax firms

Who issues it, and whom it binds. The Federal Trade Commission, at 16 CFR part 314, which “sets forth standards for developing, implementing, and maintaining reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information”. Its definition of a financial institution is wider than a bank: “An accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution”. The FTC's business guidance names tax preparation firms among its examples.

What it asks of the build. Among the elements of the program the rule lists is “Requiring your service providers by contract to implement and maintain such safeguards”, which is how the rule reaches the service providers a firm brings in. The FTC's own summary of where responsibility sits: “If your company brings in a service provider to implement and supervise your program, the buck still stops with you.”

SOC 2, the report clients ask a firm for

Who issues it, and whom it binds. A SOC 2 report comes from an examination performed under AICPA standards, which the AICPA describes as part of “a suite of service offerings CPAs may provide in connection with system-level controls”. It covers controls relevant to security, availability, processing integrity, confidentiality or privacy, and a report is produced by a licensed auditor rather than by the company itself. It is frequently required by a contract or a procurement process, which is not the same thing as being required by law.

What it asks of the build. The controls behind it are ordinary engineering: access, logging, encryption, change management and vendor management, evidenced continuously rather than assembled in the month before an audit. Our SOC 2 explainer sets out the five trust services criteria.

ISO/IEC 27001, an information security management system

Who issues it, and whom it binds. ISO and IEC jointly. The IEC listing for ISO/IEC 27001:2022 says the standard “specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system”. It binds a firm when a client or a contract makes certification a condition.

What it asks of the build. A system that sits inside a certified scope inherits that scope, so the records, access and change history an auditor asks about become build requirements rather than a later project.

NIST Cybersecurity Framework 2.0

Who issues it, and whom it binds. The National Institute of Standards and Technology, in NIST CSWP 29: “The NIST Cybersecurity Framework (CSF) 2.0 provides guidance to industry, government agencies, and other organizations to manage cybersecurity risks.” NIST says it “may be adopted voluntarily and through governmental policies and mandates.”

What it asks of the build. Very little directly, by design: “The CSF does not prescribe how outcomes should be achieved.” NIST describes it as a taxonomy of high-level cybersecurity outcomes that any organization can use to better understand, assess, prioritize, and communicate its cybersecurity efforts, which is what makes it useful in a vendor conversation.

How an engagement runs

The four steps below condense the stages published on our custom software development page. We work in two week sprints, so working software arrives every two weeks and a first production release typically lands in three to six months, as published on our about page.

1. DiscoveryThe problem, the constraints and the success criteria are mapped before a line of code. It ends with a written scope and a costed roadmap, which is the point at which a fixed price becomes possible.
2. Architecture and designThe data model, where state lives, how the system fails, how it scales, and how a reviewer will later verify its security posture.
3. Build and releaseTwo week sprints that end in something reviewable, then hardening, testing and a controlled release with the rollback path decided before the deployment.
4. Handover and supportThe repository and the cloud accounts in your name, then monitoring, maintenance and a roadmap tied to business outcomes.

Under White-Labeled Development the same stages run behind your brand, and the handover stage is the ownership transfer the service card describes.

What drives the cost

Our rates are $150 to $250 per hour, depending on the seniority and mix of the team, and a typical project runs $50,000 to $200,000. Where the scope is clear we quote a fixed price for a defined outcome, with a costed roadmap before any build starts.

No two quotes for the same brief are comparable until you know which of these each vendor assumed.

• The seniority and mix of the team. This is the stated reason our own rate band has a range at all.
• How settled the scope is. A settled scope can be quoted as a fixed price; an unsettled one priced as though it were settled is where the buffer comes from.
• How many systems it has to talk to. Systems integration is one of the highlights on the Full-Service card, and every integration adds a counterparty whose availability, data quality and release calendar you do not control.
• The control framework the contract names. Work scoped against a named framework, such as the SLAs, compliance and NDA protocols on the White-Labeled card, carries evidence, review and documentation the same build would not otherwise need.
• Team size and how long the engagement runs. The same total effort costs differently spread over two quarters than compressed into one, which is the trade Strategic Resource Scaling is built around.
• What happens after launch. A quote that stops at go-live is not cheaper, it is shorter; hosting, monitoring and managed product maintenance are part of the White-Labeled scope on this page.

What to ask any firm before you hire one

These questions are not about Sthenos, they are about this category, and every one of them is already published on this site, so you can put all of them to us as easily as to anybody else.

• Ask who actually does the work, for the named technical lead on the contract, and for a notice clause if that person changes.
• Ask what documentation is a contractual deliverable, not what they promise to write.
• Ask who reviews the code, and whether that person can veto a merge.
• Ask where the engineers physically are. Data residency, contract terms and your own compliance review all depend on the answer.
• Ask which certifications are audited and which are self declared, then ask for the report date.
• For white-labeled work, ask who owns the code and the cloud accounts at handover, and whether any licence runs back to the builder.

What you receive

A process description says what a vendor does. This says what you end up holding, which is the version worth checking a proposal against.

• The repository and the cloud accounts, in your name from the first commit, with no licence back to us and no dependency on Sthenos continuing to exist.
• A written scope and a costed roadmap, before any build starts.
• Working software every two weeks, not a status report about software.
• Architecture and a security posture you can put in front of a reviewer.
• Infrastructure your own engineers can run once we hand it over.
• Monitoring, maintenance and a roadmap after launch, priced up front.

Case studies, delivered by NeoSOFT

The two case studies in the carousel above were delivered by NeoSOFT. Read each one on its own page: the online management and communication platform built for a leading construction and engineering company, improving collaboration, operational efficiency and leadership development through a centralized digital tool; and the leadership development platform built for a comprehensive HR leadership initiative, equipping HR professionals with the skills, insights and tools to lead effectively in modern organizations.

Frequently asked questions

Does the FTC Safeguards Rule apply to an accounting firm?

The rule's definition says an accountant or other tax preparation service that is in the business of completing income tax returns is a financial institution, and the rule applies to financial institutions subject to the FTC's jurisdiction that are not subject to the enforcement authority of another regulator under section 505 of the Gramm-Leach-Bliley Act.

Does Sthenos hold a SOC 2 report?

No. As of September 2026 Sthenos holds no SOC 1 or SOC 2 report, PCI DSS attestation or ISO 27001 certificate of its own. We build to these controls and we hand you the evidence; formal certifications and audits are the institution's to hold.

What does white-labeled development mean here?

It means we provide product development services that allow consulting firms and agencies to deliver digital solutions under their own brand. Each engagement is built for confidentiality, technical compatibility and ownership transfer, and it adheres to the SLAs, compliance and NDA protocols the engagement names.

Who owns the code and the cloud accounts?

You do, entirely, from the first commit. The repository and the cloud accounts are in your name, with no licence back to us and no dependency on us continuing to exist.

What does a project cost and how long does it take?

Our rates are $150 to $250 per hour, depending on the seniority and mix of the team. A typical project runs $50,000 to $200,000. We work in two week sprints, so working software arrives every two weeks and a first production release typically lands in three to six months.

How do you work with NeoSOFT?

A senior Sthenos team stays accountable on every engagement, and through our partner NeoSOFT we add delivery capacity. Where enterprise-scale certifications matter, we reference NeoSOFT accurately rather than claiming them as Sthenos's own. The commercial relationship stays with Sthenos.

Related pages

• Team augmentation, when the constraint is capacity rather than direction.
• Software outsourcing services, with the engagement models compared.
• IT consulting services, a bounded engagement that ends with an assessment, a plan or a recommendation you can act on.
• Custom software development, with the build, buy or configure decision set out.
• Legal, for law firms and legal teams.
• Financial services, where SOC 1 and SOC 2 are defined in full.

Talk to an engineer. We are happy to answer any questions you may have and help you determine which of our services best fit your needs. Talk to our engineers.