Manufacturing Software and IT Services for Connected Production
Updated
Clients of NeoSOFT
Manufacturing IT Solutions
Smart Manufacturing
Key Highlights:
- Automated and connected manufacturing operations
- Smart logistics and supply chain coordination
- Real-time analytics and demand forecasting
- Reduced operational cost and higher output efficiency
Asset Management & Optimization
Key Highlights:
- Real-time asset monitoring and reporting
- Predictive maintenance for machinery and equipment
- Data-driven insights for improved asset performance
- Reduced maintenance costs and operational risks
Warehouse Management
Key Highlights:
- Automated and real-time inventory management
- Integrated ERP and CRM systems for better coordination
- Improved warehouse security and accessibility
- Faster fulfillment and optimized supply chain flow
Product Lifecycle Management (PLM)
Key Highlights:
- Streamlined product design and engineering workflows
- Process standardization and documentation control
- Real-time performance monitoring and reporting
- Faster innovation cycles and reduced rework
Enterprise Supply Chain Management
Key Highlights:
- Smarter planning and real-time coordination
- Optimized logistics and supplier collaboration
- Improved data visibility across global operations
- Lower operational costs through process automation
Inventory & Order Management
Key Highlights:
- Predictive demand forecasting and inventory control
- Automated workflows for order and supply management
- Streamlined reporting and dashboard visibility
- Reduced waste and optimized stock levels
Key Highlights:
- Automated and connected manufacturing operations
- Smart logistics and supply chain coordination
- Real-time analytics and demand forecasting
- Reduced operational cost and higher output efficiency
Key Highlights:
- Real-time asset monitoring and reporting
- Predictive maintenance for machinery and equipment
- Data-driven insights for improved asset performance
- Reduced maintenance costs and operational risks
Key Highlights:
- Automated and real-time inventory management
- Integrated ERP and CRM systems for better coordination
- Improved warehouse security and accessibility
- Faster fulfillment and optimized supply chain flow
Key Highlights:
- Streamlined product design and engineering workflows
- Process standardization and documentation control
- Real-time performance monitoring and reporting
- Faster innovation cycles and reduced rework
Key Highlights:
- Smarter planning and real-time coordination
- Optimized logistics and supplier collaboration
- Improved data visibility across global operations
- Lower operational costs through process automation
Key Highlights:
- Predictive demand forecasting and inventory control
- Automated workflows for order and supply management
- Streamlined reporting and dashboard visibility
- Reduced waste and optimized stock levels
Custom AI Solutions Designed For Measurable Business Outcomes
Selected Project Examples
Manufacturing Execution System (MES) Built to Improve Operational Efficiency for a Manufacturing Firm
Driving higher efficiency, better inventory control, and increased production output through a customized MES
Smart Commerce Platform Built for a Leading German Company in Advanced Cleaning Solutions
Enhancing digital shopping experiences for cleaning devices through intelligent analytics and offline-first design
(NeoSOFT project)
What clients say on Clutch
“Their work has improved the quality of our software, reduced bugs, and helped us maintain positive performance trends across our platform.”
Clutch review, December 13, 2025
“Sthenos Technologies' strong design sense and understanding of UX stood out.”
Clutch review, October 23, 2025
“We were particularly impressed by their technical expertise, professionalism, and the quality of their work.”
Clutch review, December 8, 2025
“Report generation that once took hours now happens in minutes.”
Clutch review, December 1, 2025
“Their work has noticeably improved the performance and reliability of our systems.”
Clutch review, December 13, 2025
Manufacturing software lives or dies on the boundary between the plant floor and the business. This page names the standards that boundary is built on, the export and defense rules that reach a manufacturer’s systems, what actually moves the cost of a project, and what to ask any firm bidding for the work, including us.
Depending on the seniority and mix of the team. Where the scope is clear we quote a fixed price for a defined outcome.
Working software to look at every two weeks rather than a status report, with discovery first.
No CMMC certification, no ISO certificate and no SOC 2 report. We build to the framework your contract names and hand over the evidence.
The repository and the cloud accounts are in your name, with no licence back to us.
On this page
- What we build for manufacturers
- The standards a plant floor integration has to speak
- CMMC, ITAR and a manufacturer in the defense supply chain
- Quality systems and electronic records: ISO 9001 and 21 CFR Part 11
- What drives the cost of a manufacturing software project
- How the work is scheduled
- What to ask any firm building manufacturing software
- Frequently asked questions
- More about manufacturing IT
- Talk to our engineers
What we build for manufacturers
The solutions above are the outcomes. These are the service lines the work is actually staffed from, each with the page that describes it in full.
- Custom and enterprise software. Custom software development and enterprise software development for the workflows no vendor package models, built alongside the systems the plant already runs.
- ERP and business systems. ERP, SAP and CRM work, which is where most shop floor data has to land before anybody outside operations sees it.
- Industrial IoT and connected equipment. Internet of things engineering: sensors, gateways, telemetry pipelines and the alerting on top of them.
- AI, machine learning and agents. Artificial intelligence and machine learning and agentic AI, applied to forecasting, quality and scheduling problems that have a measurable answer.
- Data platforms and analytics. Data analytics and big data engineering, including the historian and time series work that plant analytics depends on.
- Cloud and migration. Cloud computing and cloud migration and optimization, with the question of what stays on premises answered by the network, not by fashion.
- Security and testing. Cybersecurity, penetration testing and software testing. On an industrial network the test plan is a safety document as much as a security one.
- Automation and RPA. Robotic process automation and automation for the paperwork that sits between the machines and the ledger.
- Run and support. Managed services, infrastructure management and DevOps, so the system has an owner after go live.
- Mobile for the floor. Mobile application development for handhelds, scanners and tablets, where the interface has to work in gloves.
- People. Team augmentation when the constraint is capacity rather than direction.
Case study, delivered with our partner NeoSOFT. Manufacturing Execution System (MES) built for a firm focused on improving operational efficiency, which the case study page describes as driving higher production output, smarter inventory control, and measurable efficiency gains through a customized MES.
The standards a plant floor integration has to speak
Figure 1. Where plant data goes, and the line ISA-95 draws through it
Every box names systems this page names. The dashed line is the boundary ISA-95 defines between manufacturing control functions and business functions, in that standard’s own scope language; ISA/IEC 62443 is the series ISA writes for industrial automation and control systems. Deciding where that line falls, before any code, is what the section below asks you to do first.
ISA-95, enterprise control system integration
Who issues it, and whom it binds. The International Society of Automation, as a multi part consensus standard. It is voluntary, which means it binds you when a customer or a vendor writes it into a contract. Its own scope says the standard sets out to “Define in detail an abstract model of the enterprise, including manufacturing control functions and business functions, and its information exchange” and to “Define electronic information exchange between the manufacturing control functions and other enterprise functions including data models and exchange definitions”.
What a software build has to do under it. Decide, before any code, which functions sit on the control side of the boundary and which sit on the business side, and name the objects that cross it. Most integration arguments late in a project are really an unstated disagreement about that line.
What we do. We write the boundary down in discovery, in the standard’s own vocabulary, and put the object list in the interface contract so both vendors are reading the same document.
ISA/IEC 62443, security for industrial automation and control systems
Who issues it, and whom it binds. The ISA99 committee, established by ISA in 2002, and the standards are then submitted to the International Electrotechnical Commission for global adoption. ISA describes the series as defining “requirements and processes for implementing and maintaining electronically secure industrial automation and control systems (IACS)”, and names the stakeholder groups it addresses: “asset owners (end users), automation product suppliers, integrators who build and maintain control system solutions and their components, and service suppliers who support the operation of control systems”.
What a software build has to do under it. Treat the integrator role as a named party with obligations, not as a contractor who shows up with a laptop. Segmentation, remote access and patching are design inputs.
What we do. We build to it as the integrator the series describes. We hold no certification against it, and we will say so before you ask.
OPC UA, the open interface to controllers and historians
Who issues it, and whom it binds. The OPC Foundation, which describes OPC Unified Architecture, released in 2008, as “a platform independent service-oriented architecture that integrates all the functionality of the individual OPC Classic specifications into one extensible framework”. Voluntary, and available to you only where the equipment vendor implemented it. The same page describes its security provisions as encryption, authentication and auditing, and its information modeling framework as turning data into information with object oriented capabilities.
What a software build has to do under it. Model the address space deliberately. An OPC UA server that exposes a flat list of tags is a data feed; one with a considered information model is something an application can be written against for years.
What we do. We check what the controllers on your floor actually expose before we design the interface, because that is an equipment fact and not an architectural preference.
MQTT, publish and subscribe messaging for constrained devices
Who issues it, and whom it binds. OASIS, whose specification describes MQTT as “a Client Server publish/subscribe messaging transport protocol” that is “light weight, open, simple, and designed to be easy to implement”, with characteristics that make it “ideal for use in many situations, including constrained environments such as for communication in Machine to Machine (M2M) and Internet of Things (IoT) contexts”. Voluntary, adopted by product choice rather than by rule.
What a software build has to do under it. Design the topic hierarchy and the quality of service level as a schema decision, because both are extremely expensive to change once devices are in the field.
What we do. We treat the topic tree as an interface, version it, and document it with the same care as an API.
CMMC, ITAR and a manufacturer in the defense supply chain
If any part of your output reaches a defense program, the rules below reach your systems, and they reach them at whatever tier of the supply chain you sit at. This is the same regulatory ground our public sector practice and government IT services already work on.
CMMC, the Cybersecurity Maturity Model Certification program
Who issues it, and whom it binds. The Department of Defense, codified at 32 CFR part 170. The rule states that it “establishes requirements for defense contractors and subcontractors to implement prescribed cybersecurity standards for safeguarding Federal Contract Information (FCI) and Controlled Unclassified Information (CUI)”, and applies that to “contractor information systems that: process, store, or transmit FCI or CUI”.
Mandatory where the contract says so. On flow down, section 170.23 is explicit: “CMMC requirements apply to prime contractors and subcontractors throughout the supply chain at all tiers that will process, store, or transmit any FCI or CUI on contractor information systems in the performance of the DoD contract or subcontract.”
What a software build has to do under it. Answer one question first: will this system hold FCI, CUI, or neither. The rule ties the level to that answer, requiring a CMMC Status of Level 1 (Self) for a subcontractor handling only FCI and at least Level 2 (Self) for one handling CUI. The program uses the security requirements in 48 CFR 52.204-21 and NIST SP 800-171, so the control set is public and the scoping decision is the expensive one.
What we do. We design the system boundary so the scoped enclave is as small as the workflow allows, we build to the named control set, and we hand over the evidence. Sthenos holds no CMMC certification and no independent attestation of its own, and we are not SOC 2 attested.
ITAR, the International Traffic in Arms Regulations
Who issues it, and whom it binds. The Directorate of Defense Trade Controls at the Department of State, under section 38 of the Arms Export Control Act, at 22 CFR part 120. Mandatory for anyone dealing in defense articles, defense services or technical data. Two definitions decide how it lands on a software project. Technical data expressly includes “Software (see 120.40(g)) directly related to defense articles”. And export includes “Releasing or otherwise transferring technical data to a foreign person in the United States (a deemed export)”.
What a software build has to do under it. Treat repository access, screen sharing and cloud region as regulated events rather than IT preferences. A foreign national reading controlled technical data on a laptop in the same building is an export under the definition above.
What we do. We ask you which items are controlled rather than guess, and we settle in writing who may see the repository before the first commit.
EAR, the Export Administration Regulations
Who issues it, and whom it binds. The Bureau of Industry and Security at the Department of Commerce, at 15 CFR part 730. The regulation explains that a “dual-use” item “has civil applications as well as terrorism and military or weapons of mass destruction (WMD)-related applications”, and that items subject to the EAR “include purely civilian items, items with both civil and military, terrorism or potential WMD-related applications, and items that are exclusively used for military applications but that do not warrant control under the International Traffic in Arms Regulations (ITAR)”.
What a software build has to do under it. Do not assume that not being ITAR controlled means uncontrolled. The EAR is the other half of the map, and classification is a specific exercise on a specific item.
What we do. We keep the classification question inside your compliance function, where it belongs, and design the system so a later classification decision does not force a rebuild.
Quality systems and electronic records: ISO 9001 and 21 CFR Part 11
ISO 9001, quality management systems
Who issues it, and whom it binds. ISO. The current edition is ISO 9001:2015, the fifth edition of the requirements standard for quality management systems, published in September 2015 and maintained by technical committee ISO/TC 176/SC 2. It is voluntary, and it binds a manufacturer when a customer or a market makes certification a condition.
One point is worth stating plainly because vendors misuse it: ISO’s own certification page says “ISO does not perform certification or issue certificates, and it does not permit anyone to use the ISO logo in connection with certification. Certification is performed by external certification bodies, thus a company or organization cannot be certified by ISO.” Any certificate is issued by a certification body and can be verified through the accreditation route ISO describes.
What a software build has to do under it. Nothing, until the software touches a process inside the certified scope. Then it inherits that scope, and the questions an auditor asks about records, changes and traceability become build requirements rather than a later project.
What we do. We ask for the scope statement on your certificate before design, because it tells us which processes the software will be audited alongside. Sthenos holds no ISO certificate of its own and does not present one.
FDA 21 CFR Part 11, electronic records and electronic signatures
Who issues it, and whom it binds. The Food and Drug Administration, part of the Department of Health and Human Services, at 21 CFR part 11. Mandatory where it applies: the scope section says the part “applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations”, and sets the criteria under which the agency treats electronic records and signatures as “trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper”.
What a software build has to do under it.
Section 11.10 lists the controls for closed systems, and several of them are architecture rather than features: validation of the system, “the ability to generate accurate and complete copies of records in both human readable and electronic form”, “protection of records to enable their accurate and ready retrieval throughout the records retention period”, “limiting system access to authorized individuals”, and “use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records”, where “record changes shall not obscure previously recorded information”.
Section 11.50 then requires a signed record to carry the printed name of the signer, the date and time of signing, and the meaning of the signature.
What we do. Where Part 11 is in scope we design the audit trail and the signature manifestation first, because both are close to impossible to retrofit honestly, and we hand over the design so your validation effort has something to validate against.
What drives the cost of a manufacturing software project
We do not publish a price for this work because the range is set by your plant rather than by our rate. These are the factors that actually move the number, in roughly the order they move it.
A line of controllers with a documented OPC UA server is a different project from a line where half the assets expose a serial port and a printout.
If nobody has ever drawn the ISA-95 line, discovering it is part of the build.
Two plants running the same process is a configuration problem. Two plants running two processes is two projects sharing a codebase.
That single answer changes the control set, the hosting decision and who can work on it.
Audit trail, retrieval and electronic signature are structural, so this is decided at design time or paid for twice.
Where it cannot, the answer is an edge component with its own lifecycle, which is a second thing to build and support.
ERP, MES, PLM, WMS, quality, maintenance and the historian are each a contract with somebody else’s release schedule.
High frequency telemetry kept for years is a storage and query design, not a checkbox.
A fixed HMI, a handheld in a glove, and a browser in the office are three interfaces, not one responsive layout.
Offline tolerance and reconciliation is one of the largest single swings in scope on a plant project.
How the work is scheduled
We work in two week sprint cycles, so there is working software to look at every two weeks rather than a status report. Discovery comes first and produces a written problem statement both sides agree on before any architecture conversation, and on a plant project that discovery includes reading the equipment rather than the equipment list.
- DiscoveryA written problem statement both sides agree on, before any architecture conversation.
- Read the equipmentOn a plant project, discovery means reading the equipment rather than the equipment list.
- Two week sprintsWorking software to look at every two weeks rather than a status report.
- HandoverThe repository and the cloud accounts are in your name from the first commit, against a readiness standard we publish in full.
We do not publish a duration for a project we have not scoped. What we will do on a first call is tell you which parts of the work are known and which are discovery, and say plainly which is which. If you want to see the standard we hold our own delivery to, the production readiness checklist is published in full.
What to ask any firm building manufacturing software
These questions work on us as well as on anybody else you are talking to. If a vendor cannot answer them, that is the answer.
- Which ISA-95 level does the integration terminate at, and who owns the objects that cross the boundary? A vendor who has not thought about this will describe screens instead.
- Will you connect through OPC UA or a vendor SDK, and what happens when that SDK is deprecated? The second half of the question is the one that matters in year three.
- Will this system hold FCI or CUI, and who made that determination? If nobody has made it, the scoping work has not started.
- If Part 11 is in scope, show me the audit trail design before the feature list. A vendor who leads with features here has not read the section.
- What does the system do when the network link to the plant drops? Ask for the reconciliation behaviour, not a reassurance.
- Who owns the code, the repository and the cloud accounts when we are done? Get the answer in writing before the first invoice.
- If anything here is export controlled, who will be able to see the repository? Under the ITAR definition above this is a compliance answer, not an HR one.
- Which of your claims are audited and which are self declared? Then ask for the report and its date.
Frequently asked questions
What is ISA-95 and why does it decide the integration?
ISA-95 is the International Society of Automation’s enterprise control system integration standard. It gives you a shared model and vocabulary for what sits on the control side, what sits on the business side, and which data crosses between them, which is the argument most integrations are really having.
Is OPC UA required to connect to a modern controller?
No rule requires it. OPC UA is a platform independent, service oriented specification published by the OPC Foundation, and whether it is available to you is decided by the controller and its firmware. We check what your equipment exposes before designing the interface.
Does CMMC reach a subcontractor?
Yes. 32 CFR 170.23 says CMMC requirements apply to prime contractors and subcontractors throughout the supply chain at all tiers that will process, store, or transmit any FCI or CUI on contractor information systems in performance of the DoD contract or subcontract.
What does CUI mean for a manufacturer’s systems?
Controlled Unclassified Information. Under 32 CFR part 170 the program covers contractor information systems that process, store or transmit FCI or CUI, so the first design decision is which systems are in that boundary and how small you can honestly make it.
Does Sthenos hold a CMMC certification or a SOC 2 report?
No. Sthenos holds no independent attestation of its own, and that includes SOC 2: we are not SOC 2 attested. What we do is build to the framework your contract names, run the controls it requires, and hand over the evidence trail.
What if a machine has no modern interface?
Older assets often expose only a serial link, a file drop or a printout. That is workable, but it moves the design question to where the translation happens and who maintains it, which belongs in discovery rather than in the middle of a build.
Who owns the code and the cloud accounts?
You do, entirely, from the first commit. The repository and the cloud accounts are in your name, with no licence back to us and no dependency on us continuing to exist.
How is the work scheduled?
We work in two week sprint cycles, with discovery first. Discovery produces a written problem statement both sides sign off on before any architecture conversation begins, and if the problem is not what you thought it was, we say so.
More about manufacturing IT
Services. Custom software development, internet of things, ERP, data analytics, cybersecurity, managed services, team augmentation.
Standards and regulation, at the source. ISA-95 (ISA), ISA/IEC 62443 (ISA and IEC), OPC UA (OPC Foundation), MQTT (OASIS), CMMC, 32 CFR part 170, ITAR, 22 CFR part 120, EAR, 15 CFR part 730, ISO 9001:2015, 21 CFR part 11.
Insights and related work. Manufacturing execution systems, the MES case study, the production readiness checklist, public sector IT for the federal framework catalog, and talk to our engineers.
Ready to talk? Tell us what the line already exposes and where the data has to land, and we will tell you which parts of the work are known and which are discovery. Talk to our engineers.
Platforms We Work With
We work across cloud, enterprise platforms, and digital technologies—helping organizations deliver secure, scalable, and future-ready solutions.
