Highlights
KPaul Properties, LLC, a small business of Indianapolis, Indiana, protests the terms of request for proposals (RFP) No. 70RTAC21R00000003, issued by the Department of Homeland Security (DHS) for information technology services. KPaul asserts that the requirement for offerors to submit with phase I proposals either International Organization for Standardization (ISO) certification 9001:2015 quality management systems and/or ISO certification 20243:2018 open trusted technology provider standards is unduly restrictive of competition. KPaul further protests that the agency failed to follow the terms of the solicitation when it eliminated the firm from the competition without evaluating KPaul's phase I proposal because KPaul did not provide an ISO certification. Finally, KPaul protests that the agency could not reject KPaul's proposal for failing to provide an ISO certification, without referring the matter to the Small Business Administration (SBA) for a certificate of competency (COC) assessment.
DOCUMENT FOR PUBLIC RELEASE
The decision issued on the date below was subject to a GAO Protective Order. This redacted version has been approved for public release.
Decision
Matter of: KPaul Properties, LLC
File: B-419893; B-419893.6
Date: September 15, 2021
J. Bradley Reaves, Esq., and Beth V. McMahon, Esq., ReavesColey, PLLC, for the protester.
Peter G. Hartman, Esq., Roger A. Hipp, Esq., Department of Homeland Security, for the agency.
Mary G. Curcio, Esq., and John Sorrenti, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision.
Digest
1. Protest that requirement to submit International Organization for Standardization certification with phase I proposal is unduly restrictive of competition is denied where requirement is reasonably related to agency’s needs.
2. Protest that agency was required to allow protester to elect to participate in phase II of procurement is denied where protester was eliminated following a compliance check, and its phase I proposal was not evaluated.
3. Protest that agency could not eliminate protester’s proposal from the competition for failing to provide International Organization for Standardization certification with its phase I proposal without referring the matter to the Small Business Administration under its certificate of competency procedure is denied where certification is a technical evaluation criterion, and not a responsibility criterion.
Decision
KPaul Properties, LLC, a small business of Indianapolis, Indiana, protests the terms of request for proposals (RFP) No. 70RTAC21R00000003, issued by the Department of Homeland Security (DHS) for information technology services. KPaul asserts that the requirement for offerors to submit with phase I proposals either International Organization for Standardization (ISO) certification 9001:2015 quality management systems and/or ISO certification 20243:2018 open trusted technology provider standards is unduly restrictive of competition. KPaul further protests that the agency failed to follow the terms of the solicitation when it eliminated the firm from the competition without evaluating KPaul’s phase I proposal because KPaul did not provide an ISO certification. Finally, KPaul protests that the agency could not reject KPaul’s proposal for failing to provide an ISO certification, without referring the matter to the Small Business Administration (SBA) for a certificate of competency (COC) assessment.
The agency initially also eliminated KPaul’s proposal from the competition because the protester included a hyperlink in its proposal. KPaul protested this reason for its elimination. In its report responding to the protest, the agency agreed that the proposal should not have been eliminated because of the hyperlink. Agency Report (AR), Tab 2.1, Supp. Contracting Officer’s Statement (Supp. COS), at 4. This basis of protest is therefore academic and will not be considered further.
We deny the protest.
BACKGROUND
The solicitation was issued as a small business set-aside on April 20, 2021, for two functional categories--information technology value added resellers and software under the DHS-wide FirstSource III contract. The solicitation anticipates the award of multiple indefinite-delivery indefinite-quantity (IDIQ) contracts under each of the functional categories for a 5-year base period, three 1-year option periods, and one 2-year option period. AR, Tab 6b, RFP amend. 2 at 24. The estimated value of the procurement is $10 billion. Id. at 1. Offerors are permitted to submit proposals for either or both functional categories. Id. at 104.
The RFP included the following small business set-aside categories: 8(a); historically underutilized business zone; service-disabled veteran-owned small business; women-owned small business; and all small businesses. RFP amend. 2 at 2.
First Source III is a DHS-wide contract vehicle for commercial information technology commodity solutions and value-added reseller services for a wide variety of applications. The contract provides DHS with a full array of value-added reseller services and access to a wide and renewable variety of information technology commodities and solutions (hardware and software) from multiple original equipment manufacturers that will be available through delivery order competitions. RFP at 10.
The agency is conducting the procurement in two phases. Id. During phase I, offerors were required to submit a compliance checklist, a signed cover letter, and responses to two technical evaluation factors: ability to perform the work, and supply chain risk management approach. Id. at 104, 105. The compliance checklist included a list of proposal requirements identified in the solicitation and a column where the offerors could indicate that their proposals met each requirement. AR, Tab 6c, RFP amend. 2, attach. 6, Compliance Checklist. Phase I proposals were due on June 9.
As relevant to this protest, the solicitation instructed offerors to provide ISO certification 9001:2015 quality management systems and/or ISO certification 20243:2018 open trusted technology provider standards at the time of submission of their phase I proposals. RFP at 111. Offerors were required to indicate whether they submitted the required certifications in the compliance checklist. AR, Tab 6c, RFP amend. 2, attach. 6, Compliance Checklist. The certifications also were to be evaluated as part of technical factor I, ability to perform the work. RFP at 111. The solicitation advised offerors that the government would look more favorably on proposals that included both certifications. Id.
The solicitation notified offerors that the government would conduct a compliance review for both phases. In particular, the RFP stated that proposals that “do not contain a completed compliance review checklist will not be evaluated” and that proposals that were found to be “noncompliant in accordance with the solicitation instructions will not be evaluated.” RFP at 107.
Following the compliance review the agency evaluated phase I proposals. When the evaluation of the phase I proposals was completed, the agency provided an advisory notification letter to each offeror. Id. at 113, 122. The letter advised the offeror either that its proposal was among the most highly rated and the offeror should proceed to phase II, or that the proposal was not among the most highly rated, and the offeror was not likely to be a viable competitor. Id. The government’s advice was a recommendation only; offerors who were advised not to proceed to phase II could elect to continue their participation in the procurement. Id.
In phase II offerors will be required to submit a compliance checklist, a signed cover letter, technical proposal assumptions, price proposal assumptions, and responses to the following factors: demonstrated prior experience, past performance, and price. RFP amend. 2 at 105.
On June 8, KPaul submitted a protest to our Office prior to the due date for phase I proposals. In that protest KPaul asserted that the requirement to submit the ISO certification with the phase I proposal was unduly restrictive of competition. Subsequently, KPaul submitted a phase I proposal which was rejected because KPaul failed to submit an ISO certification with the proposal. KPaul then submitted a supplemental protest in which it argued that under the terms of the solicitation the agency was required to allow KPaul to participate in phase II if KPaul chose to do so. KPaul also protested that when the agency rejected KPaul’s proposal for failing to provide an ISO certification, the agency was considering KPaul’s responsibility and thus was required to refer the matter to the SBA for a COC assessment. As discussed below we find that none of these bases of protest have merit.
On July 9, we dismissed KPaul’s protest as untimely because it appeared from the record before us at the time that KPaul had failed to file its initial protest challenging the terms of the solicitation prior to the deadline for submission of initial proposals, as required by our regulations. 4 C.F.R. § 21.2(a). KPaul subsequently filed with our Office a request for reconsideration of that dismissal. During a conference call with the parties discussing the request for reconsideration, GAO learned for the first time that the agency had issued a solicitation amendment extending the deadline for submission of initial proposals and, as a result, KPaul’s initial protest had been filed prior to the revised deadline. Accordingly, we granted the request for reconsideration, reopened the protest, and requested the agency file an agency report responding to the initial protest. As the request for reconsideration has been granted, we are with this decision memorializing that request and our resolution.
DISCUSSION
ISO Certification Requirement
KPaul protests that the requirement to provide the ISO certification at the time phase I proposals are submitted is unduly restrictive of competition. KPaul states that its certification application is pending and will be available before performance under the contract begins. KPaul asserts in this regard that the certification is related to quality management and maintenance of standards that will be applied during contract performance, not to the contractor’s ability to do the work requested by the solicitation. Therefore, according to KPaul, the certification is not needed at the time phase I proposals are submitted, and instead should be required at the time performance begins. KPaul contends that GAO has considered this issue in two decisions, USA Jet Airlines, Inc.; Active Aero Group, Inc., B-404666, Apr.1, 2011, 2011 CPD ¶ 91 at 4, and LBM Inc., B-286271, Dec. 1, 2000, 2000 CPD ¶ 194 at 3, and concluded that the requirement for the ISO certification to be supplied with proposals was unduly restrictive of competition.
KPaul asserts in this regard that the certification process is costly and can take three to six months to complete. According to KPaul, many small businesses pursue the certification only when particular opportunities require it, and when the potential economic gain under the particular opportunity would justify the expense.
The determination of a contracting agency’s needs and the best method for accommodating them are matters primarily within the agency’s discretion. Systems Application & Techs., Inc., B-270672, Apr. 8, 1996, 96-1 CPD ¶ 182 at 3. However, where a protester challenges a requirement as unduly restrictive of competition, we will review the record to determine whether the restrictions imposed are reasonably related to the agency’s needs. Id. The adequacy of the agency’s justification is ascertained through examining whether the agency’s explanation is reasonable, that is, whether the explanation can withstand logical scrutiny. LBM, Inc., B-286271, supra at 3.
We have reviewed the record and conclude that the requirement for offerors to submit an ISO certification with their phase I proposals is not unduly restrictive of competition. First, in the USA Jet and LBM decisions, our Office did find that the requirement to have an ISO certification at the time that proposals were due was restrictive of competition. Those decisions, however, were based on the specific facts presented in those protests, and were not meant to stand for the proposition that a procuring agency can never require ISO certifications when proposals are due.
In USA Jet, the agency asserted that offerors must possess an ISO certification at the time of proposal submission because the certification could take several months to several years to complete and the agency would not allow performance to begin without the certification. We noted that an agency’s otherwise legitimate requirements regarding an offeror’s demonstrated ability to meet contract requirements may not generally be applied at a point in time prior to when such qualifications become relevant. We found that the only explanation offered by the agency--that the certification was required in time for performance--did not justify the restriction because the protester could potentially obtain the certification in time for performance.
In LBM, the solicitation was issued in anticipation of a cost comparison pursuant to Office of Management and Budget Circular A-76 between the private-sector proposal offering the best value to the government and the government’s most efficient organization. We concluded that the ISO certification was justified, but that the agency’s conclusive determination that an offeror would not be capable of meeting the contract requirements, based solely on the fact that it had not obtained the necessary certification prior to submitting a proposal, would unreasonably exclude potential offerors. This was particularly the case in the context of an A-76 cost comparison, where the time between submission of private-sector proposals and actual commencement of the contract activities might be substantial.
Here, unlike the situation in USA Jet, the agency’s sole justification for the restriction is not that the certification is needed for performance. Rather, the agency has explained that FirstSource is the department’s key resource for procuring information technology hardware. Over the life of the FirstSource program almost 15,000 orders have been issued and over $3.7 billion has been spent. Supp. COS at 11. With the volume of ordering across DHS and its components, as well as the diverse mission of DHS which includes matters of national security such as immigration, intelligence and cybersecurity, DHS needs assurances that the IT equipment it buys is not compromised by vulnerabilities or malware from bad actors. Id. Further, this is unlike the situation in LBM because this solicitation does not concern an A-76 cost comparison, which, as we noted in LBM, can involve a substantial passage of time between submission of proposals and commencement of the contract.
The agency explains that the ISO 20243:2018 certification requirement is a means by which DHS seeks assurance against supply chain vulnerabilities. In addition, the ISO 9001:2015 certification provides the government with an objective measure of the offeror’s quality management processes. The agency therefore is using the certifications in phase I as part of its evaluation of the offeror’s ability to provide high quality services. Id. We find that this explanation reasonably supports the agency’s position and demonstrates that the restriction is reasonably related to the agency’s minimum needs. See Contract Services, Inc., B-411153, May 22, 2015,
2015 CPD ¶ 161 (requirement for facility security clearance at time of proposal submission is reasonable).
We also note that the agency began the procurement process in June 2020 with a draft statement of work and evaluation factors, and subsequently released two additional draft solicitations in November 2020 and February 2021. The agency also held two industry days in July and December 2020, and held a pre-proposal conference on April 26, 2021. Supp. COS at 3-8. Throughout these events the agency continuously indicated its intention to require ISO certifications with phase I proposals. Id. The agency was also fully engaged with potential offerors, and based on offeror input adjusted its strategy to make the procurement more competitive. Among other things, the agency decided to require ISO certification 9001-2015 and/or ISO certification 20243:2018 based on comments from potential offerors that these certifications were more widely available. Id. at 8. The agency thus provided potential offerors with the opportunity to comment on the certification, and substantial time to apply for the certification. Moreover, during phase I the agency received 637 proposals from 325 offerors; only 5 offerors failed to provide at least one of the certifications. Id. at 3. The agency’s actions in conducting the procurement, and the number of offers it received, further support our finding that the restriction did not unduly restrict competition.
Advisory Notice
KPaul protests that in eliminating its proposal from the competition for not including a required certification, the agency failed to follow the procedure set out in the solicitation. In this regard, KPaul notes that the solicitation provided that after phase I proposals were evaluated, the agency would provide offerors with a notice advising them that their proposals were selected to proceed to phase II, or that they were unlikely to be viable competitors but could elect to proceed to the next phase. KPaul asserts that the solicitation did not advise offerors that their proposals would be eliminated from the competition, without further consideration, if they did not include the required certifications. KPaul concludes that under the terms of the solicitation the agency was required to allow KPaul to proceed to phase II if KPaul chose to do so, rather than not evaluate its proposal.
The agency counters that the process described in the solicitation occurs only after phase I proposals are evaluated. The agency explains that KPaul’s phase I proposal was not evaluated because it failed to conform to the solicitation requirements. Since, KPaul’s proposal was eliminated after the compliance review, the agency argues it was not required to provide KPaul with an opportunity to submit a phase II proposal. Based on our review of the record, we agree with the agency.
The solicitation informed offerors that “[t]he government will conduct a compliance review for both Phases I and II. The compliance checklist is included as Attachment 6 to this solicitation.” RFP at 107. The phase I checklist provided, “[t]he contractor shall compare its Phase I proposal against each of the requirements as stated in the solicitation prior to submission and indicate yes or no to ensure compliance. . . . [T]he government requires strict compliance with all solicitation requirements or the proposal may not be accepted.” AR Tab 6c, RFP attach. 6, Compliance Checklist at 1. The solicitation also notified offerors that proposals that were found to be noncompliant in accordance with the solicitation instructions would not be evaluated. RFP at 107.
The solicitation specifically instructed offerors to include one of the two required certifications with their phase I proposals. RFP at 111. The compliance checklist required offerors to indicate whether one of the two required certifications had been submitted. RFP attach. 6, Compliance Checklist at 1. It therefore was clear from the solicitation, and the compliance checklist, that the agency would consider whether the certifications were submitted when it reviewed the compliance checklist. As noted above, the solicitation also notified offerors that proposals that were found to be noncompliant in accordance with the solicitation instructions would not be evaluated. Thus, KPaul was on notice that if it did not include the required certifications its proposal would not be evaluated.
Moreover, the agency’s responses to questions that offerors submitted regarding the certification requirement confirmed that proposals would be eliminated if they did not include one of the certifications with their phase I proposal. For example, one offeror asked if the agency would consider proposals where the offeror committed to achieve the certification within 180 days of award. The agency responded, “[n]o, DHS will not consider proposals where the ISO certifications have not been secured prior to the proposal response date and included with the Phase I proposal in accordance with solicitation requirements.” AR, Tab 5h Solicitation Questions & Answers, Question 1.
Another offeror asked the agency to “[p]lease confirm that the Government will consider proposals from vendors that have neither certification.” The agency responded, “[t]he two certifications listed are a proposal requirement. Offerors that do not have either certification do not meet proposal requirements.” Id., Question 59. Given the clear language in the solicitation, KPaul’s argument that the agency was required to evaluate the protester’s phase I proposal and allow the protester to participate in phase II is denied.
Responsibility
KPaul also argues that the ISO certification concerns performance quality and is therefore a responsibility type criterion. As a result, according to KPaul, since it is a small business the agency could not reject its proposal without referring the issue to the SBA pursuant to the COC program.
Under the Small Business Act, 15 U.S.C. § 637(b)(7), the SBA has conclusive authority to determine the responsibility of small business concerns. Thus, when a procuring agency finds that a small business is not eligible for award based on a nonresponsibility determination or a failure to satisfy definitive responsibility criteria, the agency is required to refer the matter to the SBA for a final determination under its certificate of competency procedures. Specialty Marine, Inc., B-292053, May 19, 2003, 2003 CPD ¶ 106 at 2.
Even if the ISO certification is a matter of responsibility, an issue we do not decide here, agencies may use responsibility criteria as technical evaluation factors. Consulting and Program Management, B-225369, Feb. 27, 1987, 87-1 CPD ¶ 229 at 4. Here, the ISO certification was considered under the ability to perform the technical evaluation criterion. The solicitation required that offerors satisfy the ISO certification requirement at the time of proposal submission. RFP at 13. In addition, as discussed above, a proposal that did not include the certification did not meet the solicitation requirements and would not be considered. Thus, under the terms of the solicitation, the requirement to submit one of the two ISO certifications at the time of proposal submission was a material term of the solicitation. See Tridentis, LLC, B-418690.4, Jan. 5, 2021, 2021 CPD ¶ 186 at 6; ProTech Servs. USA, LLC, B-417484, July 19, 2019, 2019 CPD ¶ 260 at 4.
Where a proposal, on its face, leads an agency to the conclusion that an offeror has not complied with a material term or condition of the solicitation, the matter is one of the proposal’s acceptability, and not a matter of the offeror’s responsibility.MT & Associates, LLC, B-410066, Oct. 17, 2014, 2014 CPD ¶ 326 at 6. Since KPaul did not submit the ISO certification its offer was properly eliminated from the competition and the agency was not required to refer KPaul to the SBA. Tridentis, LLC, B-418690.4, supra.
The protest is denied
Edda Emmanuelli Perez
General Counsel
This is a verbatim capture of GAO's own published decision. Nothing is summarized or reworded, and the sections run in the order GAO wrote them. One thing is moved: GAO collects its numbered notes at the foot of the document, and each is shown here under the paragraph that first cites it, with its own number carrying you back. A note the decision never cites stays where GAO printed it.