Highlights
THE EDCCENTECH GROUP, a small business of McLean, Virginia, protests the exclusion of its proposal from the competition by the Department of the Air Force under request for proposals (RFP) No. FA8771-17-R-1000 for information technology (IT) services.
DOCUMENT FOR PUBLIC RELEASE
The decision issued on the date below was subject to a GAO Protective Order. This redacted version has been approved for public release.
Decision
Matter of: THE EDCCENTECH GROUP, Inc.
File: B-415716.25
Date: May 24, 2019
Kenneth A. Martin, Esq., The Martin Law Firm, PLLC, for the protester.
Alexis J. Bernstein, Esq., Lieutenant Colonel Kevin P. Stiens, and Francis D. Hollifield, Esq., Department of the Air Force, for the agency.
Katherine I. Riback, Esq., and Amy B. Pereira, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision.
DIGEST
Protest challenging the agency’s evaluation of protester’s technical proposal is denied where the record shows that the evaluation was reasonable and consistent with the solicitation.
DECISION
THE EDCCENTECH GROUP, a small business of McLean, Virginia, protests the exclusion of its proposal from the competition by the Department of the Air Force under request for proposals (RFP) No. FA8771-17-R-1000 for information technology (IT) services.
We deny the protest.
BACKGROUND
On September 28, 2017, the Air Force issued the Small Business Enterprise Application Solutions (SBEAS) RFP, which was set aside for small businesses, pursuant to the procedures of Federal Acquisition Regulation part 15. Agency Report (AR), Tab 5, RFP at 162. The solicitation contemplated the award of 40 indefinite-delivery, indefinite‑quantity (IDIQ) contracts with a 5-year base and 5-year option ordering period. Id. at 138-139, 162. The scope of the SBEAS RFP included a “comprehensive suite of IT services and IT solutions to support IT systems and software development in a variety of environments and infrastructures.” Id. at 130. Additional IT services in the solicitation included, but were not limited to, “documentation, operations, deployment, cybersecurity, configuration management, training, commercial off-the-shelf (COTS) product management and utilization, technology refresh, data and information services, information display services and business analysis for IT programs.” Id.
Citations to the RFP are to the conformed copy provided by the agency. AR, Tab 5, RFP.
Proposals were to be evaluated based on two factors, technical experience and past performance. Id. at 164. The technical experience factor was comprised of ten technical elements and various sub-elements (each with a designated point value), and one non‑technical experience element. Id. at 165-171. The past performance factor was comprised of the following three subfactors in descending order of importance: life‑cycle software services, cybersecurity, and information technology business analysis. Id. at 164. Award was to be made on a past performance tradeoff basis among technically acceptable offerors, using the three past performance subfactors. Id. at 162.
The solicitation stated that pursuant to “10 U.S.C. § 2305(a)(3)(C), as amended by Section 825 of the National Defense Authorization Act (NDAA) for Fiscal Year 2017, the Government will not evaluate cost or price for the IDIQ contract. Cost or price to the Government will be considered in conjunction with the issuance of a task or delivery order under any contract awarded hereunder.” RFP at 162.
The technical experience factor was comprised of the following technical elements: life-cycle software services; cybersecurity; IT business analysis; programming languages/frameworks; tools/software development methodologies; platforms/environments; database components; mobile/internet of things; server operating systems; and COTS/GOTS (government-off-the-shelf)/FOSS (free and open source software) software, as well as the non‑technical experience element of government facility clearance level. Id. at 165-171.
Section L of the solicitation instructed offerors that “[t]he proposal shall be clear, specific, and shall include sufficient detail for effective evaluation and for substantiating the validity of stated claims.” Id. at 142. Offerors were instructed to not simply rephrase or restate requirements, but to “provide [a] convincing rationale address[ing] how the [o]fferor’s proposal meets these requirements.” Id. The RFP also instructed offerors to assume that the agency has no knowledge of the offeror’s facilities and experience, and would “base its evaluation on the information presented in the [o]fferor’s proposal.” Id.
The solicitation provided that offerors should submit their proposals in four volumes: capability maturity model integration (CMMI) documentation, technical experience, past performance, and contract documentation. Id. at 145. As relevant to this protest, the technical volume was to contain a table of contents, a cross-reference matrix, a glossary of terms, a self-scoring worksheet, and technical narratives (TNs). Id. at 149. The RFP instructed offerors to describe, in their technical narratives, experience that supports the technical element points claimed in the self-scoring worksheet. Id.
The RFP’s instructions directed offerors to complete a cross-reference matrix, which was attached to the solicitation. Id. at 146, 179-183. The offeror’s cross‑reference matrix was required to demonstrate “traceability” between the offeror’s contract references. An offeror’s cross-reference matrix was required to show “which contract references [were] used to satisfy each technical element and each past performance sub-factor.” Id. at 146.
The solicitation allowed offerors to provide up to six contract references, each of which was to have its own technical narrative, to demonstrate its technical experience. RFP at 149. Technical narratives were to be submitted in numerical order (i.e., TN 1, TN 2, TN 3, TN 4, TN 5, and TN 6). Id.
The solicitation stated that the agency intended to evaluate proposals and make awards without discussions to the offerors deemed responsible, and whose proposals conformed to the solicitation’s requirements and were judged, based on the evaluation factors, to represent the best value to the government. Id. at 163.
The agency’s estimated value for all of the SBEAS contract awards is a maximum of $13.4 billion. Contracting Officer’s Statement (COS) at 3.
Section M of the solicitation established a tiered evaluation process. Id. at 163-164. The first step of the evaluation was a CMMI appraisal, which required offerors to be certified at level 2 in CMMI. Id. If an offeror passed the CMMI appraisal as level 2 certified, the agency would then evaluate an offeror’s technical experience using the self‑scoring worksheet and technical narratives provided by the offeror. Id. at 164. The solicitation provided that technical experience would receive an adjectival rating of acceptable or unacceptable. Id. at 164-165. A proposal would be considered acceptable when it attained 4,200 points per the self-scoring worksheet, and was “verified per the technical narratives.” Id. at 165.
CMMI is a process level improvement training and appraisal program that is administered by the CMMI Institute.
In the event that technical experience was evaluated as acceptable, the agency would then evaluate the offeror’s past performance. Id. at 164. The agency would review the accompanying past performance narratives and evaluate each offeror’s past performance references for recency, relevancy, and quality. Id. at 172.
EDCCENTECH timely submitted its proposal in response to the solicitation. On December 18, the agency notified EDCCENTECH that its proposal was considered technically unacceptable and had been eliminated from further consideration because its proposal, which received a score of 3,150 points, did not receive the minimum required 4,200 points under the technical experience factor. AR, Tab 9, Agency Notification Memorandum to EDCCENTECH (Dec. 18, 2018).Following a debriefing, EDCCENTECH filed a pro se agency-level protest on December 31, contesting the exclusion of its proposal from the competition, which was denied by the agency on February 5, 2019. AR, Tab 12, EDCCENTECH Agency-Level Protest (Dec. 31, 2018); Tab 13, Agency Response of EDCCENTECH’s Agency-Level Protest (Feb. 5, 2019). On February 14, EDCCENTECH filed this protest with our Office.
DISCUSSION
EDCCENTECH protests the exclusion of its proposal from the competition, alleging that the agency failed to properly evaluate its proposal under the technical experience factor. The protester contests the agency’s evaluation of ten sub-elements of its proposal under the following elements; life-cycle software services, cybersecurity, IT business analysis, tools/software development methodologies, platforms/environments mobile/internet of things, and server operating systems. Protest at 28‑34. While we do not address each of the protester’s arguments, we have reviewed them all and find that none provide a basis to sustain the protest.
Our Office will examine an agency’s evaluation of an offeror’s technical experience only to ensure that it was reasonable and consistent with the stated evaluation criteria and applicable statutes and regulations. See Shumaker Trucking & Excavating Contractors, Inc., B-290732, Sept. 25, 2002, 2002 CPD ¶ 169 at 3. A protester’s disagreement with a procuring agency’s judgment, without more, is insufficient to establish that the agency acted unreasonably. WingGate Travel, Inc., B-412921, July 1, 2016, 2016 CPD ¶ 179 at 4-5. In addition, it is an offeror’s responsibility to submit an adequately written proposal with adequately detailed information which clearly demonstrates compliance with the solicitation requirements and allows a meaningful review by the procuring agency. See International Med. Corps, B-403688, Dec. 6, 2010, 2010 CPD ¶ 292 at 8. An offeror’s technical evaluation is dependent on the information furnished, and an offeror that fails to submit an adequately written proposal runs the risk of having its proposal downgraded. LOGMET, B-400535, Oct. 30, 2008, 2008 CPD ¶ 199 at 3.
Life-cycle Software Services
ElementEDCCENTECH protests the agency’s evaluation of its proposal under the life‑cycle software services element. This element was comprised of five sub-elements: developing/implementation; re-engineering; data or system migration; modernization; and COTS/GOTS/FOSS enterprise resource planning software systems. RFP at 165‑166. EDCCENTECH protests the agency’s evaluation of its proposal under the developing/implementation and modernization sub-elements of this element, arguing that the agency’s evaluation under these sub-elements was unreasonable. Protest at 28-29.
In order to receive the 500 points available under the developing/implementation sub‑element, an offeror was required to demonstrate experience in the design, build, test and implementation of an information system in each of the following four areas:
The process of implementing software solutions to one or more sets of problems.
The process by which source code is converted into a stand-alone form that can be run on a computer or to the form itself. One of the most important steps of a software build is the compilation process, where source code files are converted into executable code. [hereinafter build]
Obtaining, verifying, or providing data for any of the following: the performance, operational capability, and suitability of systems, subsystems, components, or equipment items; or vulnerability and lethality of systems, subsystems, components, or equipment items. [hereinafter test]
Planning; coordinating; scheduling; deploying/installing (or providing all needed technical assistance to deploy/install) and transitioning a technical solution (e.g., information system) into the operational environment.
RFP at 165‑166,185. The agency found that EDCCENTECH’s proposal failed to demonstrate experience in build and test as defined by the RFP.
With regard to build, the protester argues that it provided sufficient information regarding its building experience. In this regard, the protester contends that in TN 2, it stated that it used an Agile Scrum methodology, which demonstrates its building of an information system. EDCCENTECH highlights the following passage in its narrative:
Agile describes a set of guiding principles that uses iterative approach for software development. Scrum is one of the implementations of Agile methodology.
Every three weeks a [DELETED] [test] confirmed that the software was error-free and conformed to the requirements and specifications. During this process, multiple compilations of the source code were necessary and executed.
AR, Tab 6, EDCCENTECH Proposal, Vol. II, Technical Proposal at 17. The protester maintains that its proposal demonstrated that it is thoroughly familiar with the typical compilation process of running a compiler against the source code file to create object (.OBJ) files and then linking to the libraries, either dynamically or statically, to create stored executable (.EXE) files. Comments at 3. According to the protester, a typical compilation for most web-enabled software environments is often not required in today’s systems, including Agile, because many auto-compile, and, thus, require no separate compilation by the software engineer for creation of executables. Id.
The agency asserts that EDCCENTECH’s proposal did not demonstrate the building of an information system, as required by the solicitation. AR, Tab 8, EDCCENTECH Technical Evaluation at 11‑18; COS at 9. The agency rejects the protester’s contention that its use of an Agile methodology thereby demonstrates its experience building an information system, asserting that the evaluation criteria required the offeror to demonstrate experience through clear explanation of the offeror’s steps (process) to compile its source code, which is more than just stating that the end result of these “compilation” was the “build” as executed. Id. at 10 citing AR, Tab 6, EDCCENTECH Proposal, Vol. II, Technical Proposal at 17; Memorandum of Law at 12-13. In addition, regarding the protester’s assertion that its use of the Agile process in TN 2 thereby demonstrated its experience in building an information system, the agency notes that the protester’s Agile experience does not override the solicitation’s requirement to specifically demonstrate the offeror’s experience building an information system. COS at 10.
Based on our review of the record, we find that the agency reasonably determined that the protester failed to include adequate detail concerning its experience building an information system. While EDCCENTECH provides conclusory language regarding its use of the Agile process, much of the information it claims its proposal provided was not found in its proposal, but instead was provided in its agency-level protest. AR, Tab 12, EDCCENTECH’s Agency-Level Protest at 20. As a result, we find that EDCCENTECH’s argument that it provided adequate detail, amounts to disagreement with the agency’s evaluation, which, without more, is insufficient to establish that the agency’s evaluation under this sub‑element was unreasonable. Trofholz Techs., Inc., B-404101, Jan. 5, 2011, 2011 CPD ¶ 144 at 3-4.
As stated above, in order to receive the 500 points available under the developing/implementation sub-element, offerors were required to demonstrate experience in all four areas of this sub-element. Because we find reasonable the agency’s determination that the protester failed to demonstrate experience in the process of building an information system, we need not address the protester’s arguments regarding testing. This protest ground is denied.
EDCCENTECH next challenges the agency’s evaluation of its proposal under the modernization sub-element. In order to receive the 300 points available under this sub‑element, an offeror was required to show the following:
[T]he offeror’s demonstrated experience modernizing a legacy IS [information system] during its life-cycle to include the conversion and code rewriting of a legacy system, software libraries and protocols to a modern programming language and porting the new IS to a new hardware platform.
RFP at 166 (emphasis in original). The agency would not accept points claimed by an offeror if the cited experiences failed to include the identification of the modernization of the information system and the hardware. Id.
EDCCENTECH maintains that its proposal demonstrated its experience in modernizing a legacy information system as required by the solicitation. The protester contends that TN 3 references the protester’s support to Oracle’s Business Intelligence Enterprise Editions (OBIEE), a COTS application, together with cloud services to provide the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) with “Platform As A Service” (PAAS) and “Software As A Service” (SAAS), which meets the requirements of the modernization sub-element. Protest at 29. EDCCENTECH contends that migration of data to the cloud necessarily encompasses modernization of an information system and, therefore, satisfies the requirements for demonstrated experience for the modernization sub-element because the “state-of-the-art method of modernization is to move data and/or applications to a cloud environment.” Id.
ECCENTECH’s agency-level protest included a challenge to the evaluation of TN 3 under this sub-element. To the extent that the protester now challenges the agency’s evaluation of its other four TNs provided under this sub‑element, we dismiss this ground as untimely because EDDCENTECH did not substantively challenge the agency’s evaluation of the other four TNs in its agency‑level protest, and the issue is not otherwise timely. Bid Protest Regulations, 4 C.F.R. § 21.2(a)(2)-(3); see MediaNow, Inc., B-405067, June 28, 2011, 2011 CPD ¶ 133 at 2 (dismissing protest as untimely where issue, not otherwise timely, was not raised in agency-level protest).
The agency responds that EDCCENTECH’s proposal did not demonstrate the modernization of a legacy information system, as required by the solicitation. AR, Tab 8, EDCCENTECH Technical Evaluation at 6-7. The agency contends that TN 3, which describes the offeror implementing both PAAS and SAAS, describes efforts to bring the ATF into an efficient infrastructure platform, but does not fulfill the evaluation criteria requirements to demonstrate the offeror’s experience modernizing an information system, which includes the conversion and rewriting of a legacy system, software libraries and protocols to a modern computer programming language. Id. at 7. According to the agency, EDCCENTECH’s proposal did not demonstrate its experience moving the OBIEE IS to the cloud to use either PAAS or SAAS, nor did the proposal provide any information of any associated rewriting and conversion of OBIEE to use a virtualized environment or new cloud-based hardware. AR, Tab 8, EDCCENTECH Technical Evaluation at 6-7; COS at 16-17. The agency also maintains that EDCCENTECH’s proposal similarly fails to demonstrate experience porting the new information system to a new hardware platform. Id.
The agency notes that the RFP’s definition of modernization is as follows:
Software modernization means the conversion and rewriting of a legacy system, software libraries and protocols to a modern computer programming language and porting the new IS to a new hardware platform.
RFP at 217.
We agree that the agency reasonably concluded that EDCCENTECH’s proposal failed to demonstrate the modernization of a legacy information system. We find reasonable the agency’s conclusion that EDCCENTECH’s TN 3 describing its experience with PAAS and SAAS fails to demonstrate experience modernizing an information system as required by the RFP. As noted above, offerors are responsible for submitting well‑written proposals with adequately-detailed information that allows for a meaningful review by the procuring agency. Government Telecomms., Inc., B‑299542.2, June 21, 2007, 2007 CPD ¶ 136 at 5. We find no basis to question the agency’s evaluation in this regard.
Cybersecurity Element
EDCCENTECH next challenges the agency’s evaluation under the vulnerabilities and threats sub‑element of the cybersecurity element. In order to receive the 300 points available under this sub-element, an offeror was required to “demonstrate[ ] knowledge and experience in providing services to assess software application vulnerabilities and threats using the Risk Management Framework (RMF).” RFP at 167.
The cybersecurity element was comprised of two sub-elements: vulnerabilities and threats, and risk management. RFP at 167.
The solicitation defined RMF as follows:
The six-step RMF includes security categorization, security control selection, security control implementation, security control assessment, information system authorization, and security control monitoring. The RMF promotes the concept of near real-time risk management and ongoing information system authorization through the implementation of robust continuous monitoring processes, provides senior leaders the necessary information to make cost-effective, risk-based decisions with regard to the organizational information systems supporting their core missions and business functions, and integrates information security into the enterprise architecture and system development life cycle. Applying the RMF within enterprises links risk management processes at the information system level to risk management processes at the organization level through a risk executive (function) and establishes lines of responsibility and accountability for security controls deployed within organizational information systems and inherited by those systems (i.e., common controls).
RFP at 221.
The protester contends that the agency unreasonably evaluated its proposal with regard to TN 1, alleging that its proposal expressly stated that this project followed the RMF, as instructed by the Army Program Management Office. Protest at 30 citing AR, Tab 6, EDCCENTECH Proposal, Vol. II, Technical Proposal at 13. EDCCENTECH further highlights the following passage in TN 1, which involved the Integrated Pay and Personnel System for the Department of the Army (IPPS-A), regarding this sub‑element, which stated the following:
When a vulnerability was detected our experts worked with the Oracle Development and Security Department to work on either a [DELETED] or a [DELETED]. . . . Furthermore, we provided security policy recommendations through [DELETED] to protect the database, network, and application server components while they were being used throughout the IPPS-A implementation process.
AR, Tab 6, EDCCENTECH Proposal, Vol.II, Technical Proposal at 14. The protester argues that the agency focused on a single sentence in TN 1 that discussed security policy recommendations, and ignored the protester’s use of the continuous monitoring of the systems in accordance with the RMF. Protest at 30.
The agency responds that EDCCENTECH’s mention of the use of the RMF in TN 1 is not a substitute for having demonstrated experience using the RMF to assess software vulnerabilities and threats. AR, Tab 8, EDCCENTECH Technical Evaluation at 9. In this regard, the agency argues that the protester’s claimed adherence to RMF does not demonstrate its experience or knowledge of using RMF to assess software application vulnerabilities and threats, as required by the solicitation. COS at 17-18 The agency further states that while EDCCENTECH’s proposal included security policy recommendations in design documents, the protester failed to provide any further information concerning the contents of those security policy recommendations, such as, whether they were the result of assessing software for vulnerabilities and threats, or how those policy recommendations reflect EDCCENTECH’s knowledge of RMF. Id. at 18.
Again, we agree with the agency. In explaining its experience, the protester provided a broad-brush response regarding the provision of security policy recommendations and its claimed adherence to the RMF. The agency reasonably concluded that the proposal failed to address the solicitation language that asked the offeror to “demonstrate[ ] knowledge and experience in providing services to assess software application vulnerabilities and threats using the Risk Management Framework (RMF).” RFP at 167. We find no basis to question the agency’s evaluation in this regard.
Platforms/Environments Element
EDCCENTECH challenges the agency’s evaluation of its proposal under the DISA (Defense Information Systems Agency) DECC (Defense Enterprise Computing Center) or DOD (Department of Defense) Computing sub-element of the platforms/environments element. In order to receive the 200 points available under this sub-element, an offeror was required to demonstrate “experience developing or modifying an existing IS to operate within a DISA DECC or DOD computing facility.” RFP at 170.
The platforms/environments element was comprised of four sub-elements: mainframe, mid-tier/client-server, or web services; customer’s facility; commercial, non‑commercial, or hybrid cloud; and DISA DECC or DOD Computing Facility. RFP at 169‑170.
EDCCENTECH argues that its proposal met the requirements of this sub-element because its information systems “were developed and/or modified at DOD (US Army) [c]omputing [f]acilities where they were installed, deployed, and made operational on an DOD [c]omputing [f]acility.” Protest at 32. The protester contends that the following language in its TN 1, which concerned the IPPS-A, demonstrated the requisite experience:
[T]he IPPS-A system was installed in an Army/DOD Computing Facility (ALTESS) in Radford, VA as well as Ft. Knox Army Post, TN (HRC). . . . All implementation activities to include modifications and migrations of the system occurred in both data centers At Go Live the HRC was dedicated the primary data center whereas ALTESS was the secondary data center that was used in case of a failure of the primary data center or in cases of planned shut downs of the primary data center.
AR, Tab 6, EDCCENTECH Proposal, Vol.II, Technical Proposal at 16.
The agency counters that the RFP clearly states that it is seeking “demonstrated experience developing or modifying an existing IS to operate within a DISA DECC or DOD computing facility.” RFP at 170. The agency explains that EDCCENTECH appears to argue that because its TN 1 concerns the IPPS-A system, which operates in an Army facility, this demonstrates the required experience for this sub-element. COS at 26. The agency acknowledges that, while the IPPS-A system operates in an Army facility, the solicitation required an offeror to demonstrate experience developing or modifying an existing information system “to operate within a DISA DECC or DOD computing facility.” Id. at 26-27. The agency contends that EDCCENTECH’s proposal failed to explain “what it had to do to modify or develop an IS in order to achieve the successful operation [of the IPPS-A system] within a DOD or DISA facility.” Id. at 27.
Based on our review of the record, we conclude that the agency reasonably found that EDCCENTECH’s proposal failed to demonstrate “experience developing or modifying an existing IS to operate within a DISA DECC or DOD computing facility.” RFP at 170. We also agree that the agency reasonably concluded that while EDCCENTECH’s information system operates in an Army facility, EDCCENTECH’s TN failed to include information describing its “demonstrated experience developing, designing or modifying an existing IS to operate within a DISA DECC or DOD computing facility.” RFP at 170. Here, the protester simply failed to provide the sufficient information to demonstrate its experience under this sub-element. Accordingly, we find no basis to question the agency’s conclusions.
Given our conclusion that the agency’s evaluation of these four sub-elements is reasonable, we need not address the other six alleged evaluation errors. As stated above, to be considered technically acceptable, a proposal must achieve a score of at least 4,200 points. EDCCENTECH’s technical proposal received a score of 3,150 points. Even if our Office agreed with EDCCENTECH that the other six evaluation findings were in fact incorrect, this would only afford EDCCENTECH an additional 950 points, leading to a technical score of 4,100, which is 100 points below the minimum acceptable score.
The protest is denied.
Thomas H. Armstrong
General Counsel.
This is a verbatim capture of GAO's own published decision. Nothing is summarized or reworded, and the sections run in the order GAO wrote them. One thing is moved: GAO collects its numbered notes at the foot of the document, and each is shown here under the paragraph that first cites it, with its own number carrying you back. A note the decision never cites stays where GAO printed it.