The Industries We Build Software For
Updated
No matter your industry, Sthenos delivers IT and software solutions for businesses like yours.
This list is not comprehensive. Let us learn more and share our experience with your industry.
Why industry expertise for IT is critical
Industry compliance
There are ever-evolving industry compliance and regulatory needs. Are you meeting them? Healthcare, legal, financial: we have the compliance experience to save you time and stress.
Industry applications
Many industries use industry-specific applications. Our team has the experience to configure, update, and troubleshoot applications like Sage, Quickbooks, ERP systems, and more.
Industry security
Cyberattacks hit small businesses regularly, and some industries are at greater risk than others. Our cybersecurity offerings ensure that your business is protected.
Sthenos builds software and IT for the thirteen industries on this page, and for legal teams and the public sector. Seven of the industry pages set out the rules in scope, each named with its source.
Plus legal and the public sector, each with its own page.
Seven pages name each rule in scope with its source.
No SOC 1 or SOC 2 report, PCI DSS attestation or ISO 27001 certificate of our own.
Custom Computer Programming Services.
On this page
- The rules each regulated industry page sets out
- Mandatory rules versus voluntary frameworks
- How an industry engagement runs
- What an industry project costs
- Questions to ask a software partner in a regulated industry
- Industry questions, answered
The rules each regulated industry page sets out
HIPAA is the one everybody names, and it is rarely the only one in scope. Seven industry pages list the rules in scope, each named with its issuer.
Figure 1. The fifteen industry pages, and the seven that set out the rules in scope
Caption: derived from the industry pages on this site as they read on 11 September 2026. The thirteen tiles above plus the legal and public sector pages; highlighted pages carry a section that names the rules in scope with their issuers.
| Industry page | Rules it sets out |
|---|---|
| Healthcare | HIPAA, the HITECH Act of 2009, 42 CFR Part 2, the 21st Century Cures Act information blocking rule, FDA 21 CFR Part 820 and Part 11, and the CCPA |
| Financial services | The Sarbanes-Oxley Act, the Gramm-Leach-Bliley Act, the Bank Secrecy Act, Reg E and Reg Z, NYDFS Part 500, FINRA Rule 4511 and PCI DSS |
| Legal | ABA Model Rule 1.6 and Rule 1.1, HIPAA, GDPR Article 28 and the CCPA |
| Public sector | FISMA, NIST SP 800-53 and 800-171, CMMC, FedRAMP, the CJIS Security Policy, HIPAA, FERPA, Section 508 and GovRAMP, formerly StateRAMP |
| Manufacturing | CMMC, ITAR, ISO 9001, 21 CFR Part 11 and ISA/IEC 62443 |
| Logistics and supply chain | FMCSA hours of service and the ELD rule under 49 CFR part 395, CTPAT, and GS1 SSCC and EPCIS |
| Ecommerce and retail | PCI DSS, WCAG 2.2, the ADA, GDPR and the CCPA |
Mandatory rules versus voluntary frameworks
The public sector, financial services and logistics pages tag each rule mandatory or voluntary and say who it binds, so a legal obligation is not read as a design target.
Mandatory
A legal obligation on someone named- FISMA: federal agencies, and the contractors and other sources that use or operate a federal information system on an agency's behalf.
- FedRAMP: cloud services that process unclassified information used by federal agencies.
- FINRA Rule 4511: binding on FINRA member firms.
- The ELD rule: mandatory with the exceptions the section lists.
Voluntary
Chosen, or required by a partner- GovRAMP, formerly StateRAMP: state, local and education cloud buyers that choose to adopt it.
- GS1 SSCC: voluntary, and in practice required by any partner who scans on receipt.
- An attestation an organization chooses to undergo is tagged voluntary.
How an industry engagement runs
- A callWe schedule a call at your convenience.
- Bounded discoveryWe run a short, bounded discovery, scoped per engagement.
- Costed roadmapWe give you a costed roadmap before committing to a build.
- Fixed price where clearWhere the scope is clear we quote a fixed price for a defined outcome.
What an industry project costs
Our rates are $150 to $250 per hour, depending on the seniority and mix of the team. Where the scope is clear we quote a fixed price for a defined outcome, with a costed roadmap before any build starts.
Questions to ask a software partner in a regulated industry
| Ask | Our answer |
|---|---|
| Which attestations do you hold? | None of our own: no SOC 1 or SOC 2 report, PCI DSS attestation or ISO 27001 certificate. We build to the framework your contract names. |
| Who is the named technical lead, and what else are they on? | The people who pitch are the people who deliver. |
| Who owns the code? | You do, entirely, from the first commit. The repository and the cloud accounts are in your name, with no licence back to us and no dependency on us continuing to exist. |
| Which rules apply to our build? | The industry page names each rule with its source. We build to the framework your contract names. |
What you receive
- A costed roadmap before committing to a build
- Working software every two weeks from the start
- The repository and the cloud accounts in your name
- A build to the framework your contract names
Industry questions, answered
Which industries does Sthenos work in?
Ecommerce and retail, financial services, professional services, healthcare, logistics and supply chain, manufacturing, sports, travel and hospitality, real estate, telecom, education and learning, media and entertainment, and ISVs and digital products, plus legal teams and the public sector.
Does Sthenos hold SOC 2, PCI DSS or ISO 27001?
No. As of September 2026 Sthenos holds no SOC 1 or SOC 2 report, PCI DSS attestation or ISO 27001 certificate of its own. We build to the framework your contract names.
Which rules apply to healthcare software?
HIPAA is the one everybody names, and it is rarely the only one in scope. The healthcare page also sets out the HITECH Act of 2009, 42 CFR Part 2, the information blocking rule, and FDA 21 CFR Parts 820 and 11.
How much does industry software cost?
Our rates are $150 to $250 per hour, depending on the seniority and mix of the team. Where the scope is clear we quote a fixed price for a defined outcome.
Related pages
Custom software, cloud, cybersecurity and data for federal and state teams.
Sthenos builds secure, scalable web, mobile, AI, and cloud software for federal and regulated buyers.
A software and IT firm serving government and commercial clients, based in Tysons, VA.
Don't see your industry? This list is not comprehensive. Let us learn more and share our experience with your industry.