Government IT Services

Federal technology work is not won the way commercial work is won, and any vendor page that pretends otherwise is aimed at the wrong reader. Agencies find you through SAM.gov, a contract vehicle, a set-aside category and past performance, long before anyone types your service into a search box. This page is written for the contracting officer and the program manager who already have a requirement, and want to know quickly whether we are a viable path to award.

How agencies and primes can buy from Sthenos

Sthenos holds no GSA Multiple Award Schedule contract and appears on no GSA vehicle: searches of GSA eLibrary for Sthenos, Sthenos LLC, our UEI and our CAGE code all return no matches. The routes below are the ones that do exist, each named with the authority that creates it, so a contracting officer can check the mechanism rather than take our word for it.

The set-aside path, and the codes it actually covers

A contracting officer may restrict competition to WOSB concerns, including EDWOSB concerns, for requirements in NAICS codes SBA has designated as substantially underrepresented, where market research supports a reasonable expectation that two or more such concerns will submit offers and that award can be made at a fair and reasonable price (FAR 19.1505(c)). A contracting officer may also set aside acquisitions above the micro-purchase threshold, which is $15,000, for competition restricted to EDWOSB concerns in NAICS codes SBA has designated as underrepresented (FAR 19.1505(a)(2)(i), FAR 2.101).

To submit an offer under either set-aside, a firm must qualify as small under the size standard for the NAICS code assigned to the contract and must be certified under 13 CFR 127.300 (FAR 19.1505(d)). We are certified, so a contracting officer verifying us will find us designated as a certified concern rather than as a pending application (FAR 19.1505(e)). Where only one acceptable offer comes back from a qualified WOSB or EDWOSB concern, the contracting officer may still make the award (FAR 19.1505(g)).

SBA’s current eligible-industries list covers 733 NAICS codes, of which 626 are designated for competition among all WOSB Program participants and 107 for competition among SBA-certified EDWOSBs only. That list is effective 1 October 2022 and the page carrying it was last updated 13 June 2023. The codes we work in are on that list with the WOSB designation, not the EDWOSB designation:

• 541511 Custom Computer Programming Services
• 541512 Computer Systems Design Services
• 541513 Computer Facilities Management Services
• 541519 Other Computer Related Services
• 541611 Administrative Management and General Management Consulting Services
• 541613 Marketing Consulting Services
• 541990 All Other Professional, Scientific, and Technical Services
• 518210 Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services

In plain terms, in the codes we actually work in the restricted competition available is the WOSB set-aside, and an EDWOSB set-aside is not available to a contracting officer in those codes. Our EDWOSB certification still counts, because EDWOSB concerns are eligible to compete in a WOSB set-aside (FAR 19.1505(c)).

The sole-source path, and the ceiling on it

A contracting officer shall consider a sole-source award to a WOSB concern, including EDWOSB concerns, in NAICS codes SBA has designated as substantially underrepresented, before considering small business set-asides, provided none of the exclusions at FAR 19.1504 apply, the contracting officer does not have a reasonable expectation that offers would be received from two or more such concerns, and the conditions at FAR 19.1506(c) are met.

Those conditions are a dollar ceiling and two findings. The anticipated award price of the contract, including options, must not exceed $8.5 million for a requirement within the NAICS codes for manufacturing, or $5.5 million for a requirement within any other NAICS codes (FAR 19.1506(c)(1)). Our work sits in the professional and computer services codes, so the ceiling that applies to us is $5.5 million. The firm must also have been determined a responsible contractor with respect to performance, and the award must be able to be made at a fair and reasonable price (FAR 19.1506(c)(2) and (c)(3)).

A sole-source award may only go to a concern certified under 13 CFR 127.300, and a contracting officer may not request a status determination on a pending application for a sole-source award (FAR 19.1506(d)). We are certified rather than pending, which is the condition that clause turns on.

Buying below the simplified acquisition threshold

The simplified acquisition threshold is $350,000 (FAR 2.101). A direct award below that threshold is frequently the fastest compliant route to getting work started with a set-aside eligible small business.

How a prime can count us toward subcontracting goals

Any contractor receiving a contract worth more than the simplified acquisition threshold must agree that small business and women-owned small business concerns, among others, will have the maximum practicable opportunity to participate in contract performance (FAR 19.702). In negotiated acquisitions expected to exceed $900,000, and $2 million for construction, the apparently successful offeror must submit an acceptable subcontracting plan (FAR 19.702(a)(1)(i)), and that plan must carry separate percentage goals for small business concerns and for women-owned small business concerns as subcontractors, among the other categories (FAR 19.704(a)(1)).

We sit in two of the categories that plan must carry a separate goal line for: small business, which SBA records us as under every NAICS code on our profile, and women-owned small business, which SBA has certified us as. We are not an SBA-certified HUBZone, 8(a), VOSB or SDVOSB firm, so we do not count against those goal lines.

Maryland

Maryland certified us under certificate number 26-134 as a Minority Business Enterprise and a Small Business Enterprise. Maryland’s MBE Program has a statewide aspirational goal of 29% across 70 participating agencies and departments, set by regulation, and only the work of certified MBEs can be counted toward an established contract goal, which is why the certificate number matters to a procurement officer building a participation schedule. The overall percentage goal is set on a biennial basis by the Special Secretary for the Office of Small, Minority, and Women Business Affairs, so the applicable figure is the one in force for the current period rather than a fixed number in statute. Maryland MBE certification is separate from the federal DBE and ACDBE programs.

The commodity codes certified on 26-134 are NAICS 541611 and 541613. Our federal primary code, 541511, is not among them, so a Maryland participation schedule keyed to 541511 will not match us on the certificate as it stands today.

What we do not hold

What we actually do for agencies

Services agencies buy from us

Each line below is a service with its own page, so a program office can read the detail before naming it in a requirement. A solicitation can name several of them at once.

• Custom software development. Mission and business applications built to the requirement rather than configured around a product licence, including legacy modernization off unsupported platforms.
• Cloud and migration. Assessment, sequencing and execution, including the authorisation boundary questions that decide how long an ATO takes.
• Cybersecurity and penetration testing. Security engineering against the framework the contract names, plus vulnerability assessment, application and cloud security testing, and IT security audit work that produces the evidence an assessor asks for.
• Data analytics. Pipelines, warehouses and lineage that survive an audit rather than a demo.
• AI and agentic AI. Applied to defined workflows, with the human review points designed in rather than assumed.
• Managed IT and help desk. Incident, problem, change and release management, with L1 and L2 help desk and L3 application support behind it.
• Staff augmentation. Engineers who join an existing program team and work under your direction.
• Microsoft 365 and SharePoint. SharePoint consulting, Microsoft 365 tenant governance and Azure integration.
• Salesforce. Salesforce consulting and implementation, CRM work across four platforms, and ERP integration.

Legacy modernization for federal agencies

When an agency needs to move a mission system off an unsupported platform, we sequence the work so each phase delivers on its own, rather than running a rewrite-everything programme. The authorisation boundary questions are settled first, because in a migration they decide the timeline. For the public record on what aging federal systems cost to keep running, and why big-bang rewrites keep failing, see our 2026 Legacy Modernization Cost and Risk Report.

Federal civilian, defense, health, state and local: what changes by tier

The engineering looks similar across these tiers. What changes is the route to award and the framework the contract will name, and getting either wrong is what makes a capable vendor unbuyable. No client is named below and none of this is past performance: it is the buying path and the compliance vocabulary that fit each tier.

Federal civilian agencies

The routes that fit are a WOSB set-aside in a NAICS code SBA has designated, where the contracting officer expects offers from two or more such concerns at a fair and reasonable price (FAR 19.1505(c)); a direct award below the simplified acquisition threshold of $350,000; and a micro-purchase below $15,000 (FAR 2.101). The frameworks a civilian requirement can name are FISMA, which binds the agency and the contractors that operate a federal information system on its behalf; NIST SP 800-53, through the minimum security requirements FIPS 200 sets under FISMA; FedRAMP, where the service is a cloud service processing unclassified information used by federal agencies; and Section 508, which reaches all federal agencies when they develop, procure, maintain or use electronic and information technology. Where the requirement ends in an authority to operate, the work that decides the schedule is the evidence package behind the ATO, not the build.

Defense and the defense industrial base

Subcontracting to a prime is the route to check first. Any contractor receiving a contract worth more than the simplified acquisition threshold must agree that small business and women-owned small business concerns have the maximum practicable opportunity to participate (FAR 19.702), and a negotiated acquisition expected to exceed $900,000 requires an acceptable subcontracting plan carrying separate percentage goals for both categories (FAR 19.702(a)(1)(i), FAR 19.704(a)(1)). A WOSB set-aside is available on the same terms as anywhere else where the assigned NAICS code carries the designation. The frameworks are NIST SP 800-171, which binds nonfederal systems that process, store or transmit Controlled Unclassified Information and which DFARS 252.204-7012 makes a contract requirement on covered defense contractor systems, and CMMC, which under 32 CFR 170.3 reaches all DoD contract and subcontract awardees handling Federal Contract Information or CUI on contractor information systems.

Federal health agencies

Sole-source is the route worth checking first, because a contracting officer shall consider a sole-source award to a WOSB concern before considering a small business set-aside where the conditions in FAR 19.1506 are met, up to $5.5 million on the codes we work in (FAR 19.1506(b) and (c)(1)). Alongside FISMA, NIST SP 800-53 and FedRAMP, a health requirement names HIPAA, which binds health plans, health care clearinghouses, health care providers who transmit health information electronically in connection with a covered transaction, and their business associates, per 45 CFR 160.102 and 160.103. We are not SOC 2 attested and hold no HITRUST certification, so where the requirement asks for an attestation held by the vendor rather than evidence produced for the system, we are the wrong answer and will say so before proposal.

State agencies

In Maryland the route is the MBE participation goal. Only the work of certified MBEs can be counted toward an established contract goal, and our certificate is 26-134, certified for NAICS 541613 and 541611. Our federal primary code, 541511, is not on that certificate, so a participation schedule keyed to 541511 will not match us as it stands today. The frameworks a state requirement names are StateRAMP, now GovRAMP, which is voluntary and binds a provider only where a government buyer makes it a contract condition; the CJIS Security Policy, which reaches criminal justice agencies and any private contractor handling criminal history record information under a security addendum approved by the Attorney General, per 28 CFR 20.33(a)(7); and FERPA, where the buyer is an educational agency or institution receiving funds under a program administered by the U.S. Secretary of Education, per 34 CFR 99.1.

Counties and municipalities

The federal thresholds above do not apply to a county or a city. Each jurisdiction sets its own purchasing rules, and we read those off the solicitation rather than assuming a federal equivalent. Maryland’s MBE program is a state program, with a statewide aspirational goal set by regulation across 70 participating agencies and departments, so whether a county or a municipal buyer applies a participation goal is that jurisdiction’s decision and is stated in its own solicitation. The frameworks a local requirement can name are the CJIS Security Policy, for anything touching criminal history record information, and GovRAMP where the buyer has adopted it. At every tier on this page, one route is closed: we hold no GSA Multiple Award Schedule contract and appear on no GSA vehicle, so a schedule buy is not a path to us.

Why a small business is often the lower-risk choice

The instinct is that a larger integrator is safer. On a large multi-year programme that is frequently true. On a defined technical scope it often is not, for reasons worth stating plainly.

Where we are, and why that matters here

We work from Tysons, Virginia and Bethesda, Maryland, inside the National Capital Region. For federal work that is not a marketing detail. It means we can be at your facility for the working sessions that actually move a requirement forward, we are in your time zone for the whole working day, and we understand the review and authorisation rhythms that determine whether a schedule is realistic.

Delivery scales through our established engineering partnership with NeoSOFT, so a small local team is not a capacity ceiling.

Our registration details

Everything a contracting officer needs to check us before a conversation, in one place.

• 2007Operating under a former name.
• 2021Registered as Sthenos Technologies.
• 5 March 2026SBA certified us as a Woman-Owned Small Business and as an Economically Disadvantaged Woman-Owned Small Business.
• 5 March 2029The exit date SBA records against both certifications.

Separately from the two SBA certifications, our SAM.gov registration carries self-certifications that SBA displays but does not vet, including Minority-Owned Business, Women-Owned Small Business, Woman-Owned Business and Subcontinent Asian (Asian-Indian) American Owned. The difference matters at award: WOSB and EDWOSB are SBA certifications a contracting officer can verify, and the rest are representations we made in SAM.gov.

SBA certifications and SAM.gov self-certifications, compared

Assurance, stated plainly

Sthenos holds no independent attestation of its own, and that includes SOC 2: we are not SOC 2 attested. What we do instead is build to the framework the contract names, run the controls it requires, and hand over the evidence trail, so your assessor and your authorising official have something to stand on. The agencies and mission areas named on this site are the ones our capability is aimed at. They are targets, not past performance, and we will tell you which is which in the first conversation rather than at proposal.

From solicitation to evidence: how we deliver government IT solutions

The steps below put in order what this page, our about page and the contact section at the foot of every page already say happens, and name who acts at each one.

• The requirement gets its NAICS codeWhether a requirement can be set aside depends on the NAICS code the contracting officer assigns to it.Contracting officer
• You send the solicitationThe solicitation number, the RFP or RFQ documents, any NDA you need in place, and the date responses are due. Primes and other government IT contractors buying through one of the government contract vehicles they hold reach us the same way, through a subcontract under it.Your office or the prime
• We check it against our registrationWe check the NAICS code on it against our registration and tell you whether a set-aside path is open before we write anything. If we are the wrong fit, we say so in the first conversation rather than consume your acquisition timeline finding out.Sthenos
• A call, a short discovery, a costed roadmapWe schedule a call at your convenience, run a short, bounded discovery scoped to the engagement, and give you a costed roadmap before committing to a build. Where the scope is clear we quote a fixed price for a defined outcome.Sthenos
• Delivery in two week sprintsWorking software every two weeks, built to the framework the contract names and running the controls it requires.Sthenos
• The evidence trail goes to your assessorWe hand over the evidence trail, so your assessor and your authorising official have something to stand on. Where the requirement ends in an authority to operate, that evidence package is the work that decides the schedule, not the build.Your assessor

What you receive, before award and during delivery

These are the things that land on a contracting officer’s or a program manager’s desk, in the order they arrive. None of them is an attestation.

Government IT services pricing: what moves the cost and the schedule

We publish our rates. Our rates are $150 to $250 per hour, depending on the seniority and mix of the team, and a typical project runs $50,000 to $200,000. Both figures are the ones in the key facts at the top of this page.

What to ask us

• What is your CAGE code and what NAICS codes do you carry? Ask any vendor this first; it decides whether a set-aside path exists at all.
• Show past performance on a comparable technical scope. Not a logo wall.
• Who is the named technical lead, and what else are they on?
• What would make you decline this requirement?

If you have a requirement and want to know quickly whether we are a viable path, talk to our engineers. We would rather tell you in the first conversation that we are the wrong fit than consume your acquisition timeline finding out. Related: what an independent readiness audit examines and what FedRAMP actually requires.

Frequently asked questions

Do you hold a GSA schedule?

No. Sthenos holds no GSA Multiple Award Schedule contract and appears on no GSA vehicle: GSA eLibrary searches for Sthenos, Sthenos LLC, our UEI and our CAGE code all return no matches. Agencies reach us through a set-aside, a sole-source award, a direct purchase or a prime’s vehicle.

Can an agency award to Sthenos sole-source?

Yes, within limits. FAR 19.1506 lets a contracting officer make a sole-source award to a WOSB concern in a NAICS code SBA has designated as substantially underrepresented, where offers from two or more such concerns are not expected. The anticipated award price, including options, must not exceed $5.5 million in our codes.

What are your UEI and CAGE?

Our Unique Entity ID is ULUZGKWYCJB7 and our CAGE code is 9RX92. The SBA profile for that UEI and CAGE reports our SAM.gov registration status as Active.

Which set-aside categories do you qualify for?

SBA certified us as a Woman-Owned Small Business and as an Economically Disadvantaged Woman-Owned Small Business, both entered 5 March 2026. In the NAICS codes we work in the SBA designation is WOSB, so the restricted competition available is the WOSB set-aside, which EDWOSB concerns are eligible to compete in.

Can a prime count Sthenos toward subcontracting goals?

Yes. A subcontracting plan under FAR 19.704 must carry separate percentage goals for small business concerns and for women-owned small business concerns. SBA records us as small under every NAICS code on our profile and has certified us as women-owned, so we sit in both of those goal lines.

Which NAICS codes do you work under?

Our primary code is 541511, Custom Computer Programming Services, and SBA’s record lists 31 codes for us in total. The ones we work in are 541511, 541512, 541513, 541519, 541611, 541613, 541990 and 518210, and all eight sit on SBA’s eligible-industries list with the WOSB designation.

More about government IT services

Services. Custom software development, cloud consulting, cybersecurity, data analytics and artificial intelligence and machine learning.

Standards. What FedRAMP is and what SOC 2 compliance means. We build to both and hold no attestation of our own against either.

Insights. AI for government agencies.

Before you send us an RFP