Northrop Grumman Systems Corporation

Decision

Matter of:  Northrop Grumman Systems Corporation

File:  B-412278.7; B-412278.8

Date:  October 4, 2017

DIGEST

1.  An agency cannot waive an alleged unfair competitive advantage based on the hiring of former government employees using the authority of Federal Acquisition Regulation (FAR) subpart 9.5 to waive organizational conflicts of interest, as the unfair competitive advantage allegations arise under the provisions of FAR subpart 3.1, which has no corresponding waiver provision.

2.  Protest alleging that the awardee gained an unfair competitive advantage based on the hiring of former government employees is denied where the record shows that the agency reasonably concluded that any information to which the former employees may have had access was not competitively useful. 

3.  Protest alleging that the agency’s requirements changed in a manner that obligated the agency to revise the solicitation and provide offerors an opportunity to submit revised proposals is denied where the agency reasonably concluded that changes to the agency’s requirements that arose after the issuance of the solicitation did not require an amendment to the solicitation.

4.  Protest challenging the agency’s evaluation of past performance is denied where the agency reasonably evaluated the offerors’ performance record and the protester cannot in any event demonstrate that it could have been prejudiced by the alleged errors.

5.  Protest alleging that the agency conducted unequal discussions by allowing the awardee to submit additional information after the receipt of final proposal revisions is denied where the protester does not demonstrate that the additional information was required to make the awardee’s proposal acceptable and where the information pertained to the awardee’s responsibility.

Northrop Grumman Systems Corporation, of McLean, Virginia, protests the award of a contract to Raytheon Company, of Waltham, Massachusetts, by the Department of Homeland Security (DHS) under request for proposals (RFP) No. HSSA01-14-R-1006 for support of the National Cybersecurity Protection System (NCPS).  The protester argues that the award to Raytheon was improper because the awardee had an unfair competitive advantage arising from the hiring of former DHS employees, the agency failed to revise the RFP to reflect its changed requirements, the agency unreasonably evaluated offerors’ past performance, and the agency conducted unequal discussions with the awardee. 

We deny the protest.

BACKGROUND

DHS issued the solicitation on July 2, 2014, seeking proposals for the agency’s Development, Operations, and Maintenance (DOMino) contract.  Agency Report (AR)[1], Tab D.7, RFP § B-1 at 2.[2]  The RFP anticipated award of an indefinite-delivery, indefinite-quantity (IDIQ) contract with an ordering period of 5 years and a maximum value of $1.15 billion.  Id. 

The DOMino procurement supports DHS’s mission of protecting the .gov web domain from cyberattacks.  The National Programs and Protection Directorate (NPPD) is the DHS component responsible for addressing threats to critical physical and cyber infrastructure.  One of the NPPD’s program activities is the Office of Cybersecurity and Communications (CS&C), which is responsible for enhancing the security, resiliency, and reliability of the nation’s cyber and communications infrastructure.  AR, Tab D.6, Statement of Work (SOW), at 5.  The Network Security Deployment (NSD) division is one of five divisions of CS&C.  Id.  As relevant to this procurement, NSD is responsible for “designing, developing, deploying, operating and maintaining the National Cybersecurity Protection System (NCPS), which is a ‘system of systems’ that employs a wide range of cybersecurity capabilities that are used to detect and deter sophisticated cyber adversaries.”  Id. at 7. 

The NCPS, which is also known as EINSTEIN, is an “integrated system of intrusion detection, analytics, information sharing, intrusion prevention, and core infrastructure capabilities that are used to defend the Federal Executive Branch civilian government’s [information technology] infrastructure from cyber threats.”  Id. at 9.  The DOMino contractor will “coordinate and deliver cybersecurity system design, development, deployment and operations and maintenance (O&M) services in support of the NSD mission.”  Id. at 21.

The RFP stated that offerors’ proposals would be evaluated on the basis of cost and the following eight non-cost factors:  (1) system engineering life cycle (SELC) process integration; (2) technology integration; (3) O&M; (4) staffing; (5) past performance; (6) small business subcontracting; (7) organizational conflicts of interest (OCIs); and (8) security.[3]  RFP § M-3 at 80-86.  The first five factors were to be evaluated and assigned an adjectival rating[4]; the small business subcontracting, OCI, and security factors were to be evaluated on a pass/fail basis.  Id. § M-5 at 84-85.  For purposes of award, each of the first four evaluation factors were more important than past performance, and past performance was more important than cost/price.  Id. § M-2 at 80.  The non-cost/price factors, when combined, were “significantly more important” than cost/price.  Id.  The RFP stated that the agency would issue, at a minimum, a task order for the RFP’s O&M requirements, and provided that the agency could issue up to three task orders at the time of contract award.  Id. § B-1 at 2, § M-2 at 80. 

DHS received proposals from five offerors, including Northrop and Raytheon.  Contracting Officer’s Statement (COS) at 3.[5]  The agency initially awarded the contract to Raytheon on September 21, 2015.  On October 5, Northrop filed a protest with our Office challenging the award to Raytheon (B‑412278).  On October 28, the agency advised our Office that it would take corrective action in response to the protest; our Office subsequently dismissed the protest as academic.  Following corrective action, the agency affirmed the award to Raytheon on June 2, 2016.  Id. at 4.  On June 15, Northrop filed a new protest (B-412278.2).  On August 26, the agency advised that it would again take corrective action in response to Northrop’s protest; our Office subsequently dismissed the protest as academic.  Following corrective action, the agency affirmed the award to Raytheon on June 9, 2017. 

The agency’s second corrective action consisted of reevaluating the record and the offerors’ proposals in light of Northrop’s protest allegations and examining whether the RFP still met the agency’s requirements.  AR, Tab N.1, Second Corrective Action Memorandum, at 4-5.  The agency’s corrective action affirmed the evaluation ratings assigned to the offerors’ proposals in connection with the prior award.  AR, Tab O.1, Source Selection Addendum, at 2.  The final ratings and evaluated costs for the offerors’ proposals relevant to this protest are as follows:

	NORTHROP	RAYTHEON	OFFEROR 3
SELC Process Integration	Good	Outstanding	Good
Technology Integration	Good	Outstanding	Good
Operations & Maintenance	Acceptable	Good	Outstanding
Staffing	Good	Outstanding	Good
Past Performance	Superior	Superior	Superior
Small Business Subcontracting	Pass	Pass	Pass
OCIs	Pass	Pass	Pass
Security	Pass	Pass	Pass
Evaluated Cost	$732 million	$755.1 million	$694.1 million

AR, Tab I.3, Source Selection Decision Document (SSDD), at 3.

As described in the award decision for the second award (May 26, 2016), and as affirmed in the source selection addendum which approved the current award (June 6, 2017), the source selection authority (SSA) concluded that the proposals of Raytheon and Offeror 3 provided the best value to the government in accordance with the RFP’s evaluation criteria.  Id.  The SSA noted that the proposals from the three remaining offerors, including Northrop, received lower technical ratings and had higher evaluated proposed costs as compared to Offeror 3.  Id.; see also AR, Tab O.2, Second Corrective Action Award Recommendation, at 11.  The SSA concluded that the advantages of Raytheon’s higher-rated proposal merited award as compared to Offeror 3’s lower-rated, lower-cost proposal.  AR, Tab I.3, SSDD, at 8-16.

DHS advised Northrop of the affirmed award to Raytheon, and provided a debriefing on June 22, 2017.  This protest followed.

DISCUSSION

Northrop raises the following four primary arguments:  (1) Raytheon received an unfair competitive advantage based on its hiring of a former DHS employee, and based on the hiring by one of its proposed subcontractors of a different former DHS employee; (2) the agency’s requirements for NCPS have changed since the issuance of the RFP in 2014 in a manner that obligated the agency to amend the solicitation and allow offerors to submit revised proposals; (3) the agency unreasonably evaluated past performance; and (4) the agency conducted unequal discussions by allowing Raytheon to submit additional information after the submission of final proposals revisions without providing Northrop the same opportunity for discussions.[6]  For the reasons discussed below, we find no basis to sustain the protest.[7]

Unfair Competitive Advantage

Northrop argues that Raytheon had an unfair competitive advantage that merited disqualification from the competition based on the roles of two former DHS employees.  The protester contends that the awardee gained an unfair advantage based on:  (1) Raytheon’s hiring of a former DHS employee (former employee 1), and (2) the hiring of a former DHS employee by one of Raytheon’s proposed subcontractors (former employee 2) and the access that Raytheon could have had to that employee through its exchanges with its proposed subcontractor.  The protester argues that Raytheon’s employment of or access to these two former government employees allowed the awardee to use non-public information in the preparation of its proposal.  For the reasons discussed below, we conclude that the agency conducted a reasonable investigation of the protester’s allegations and reasonably concluded that the two employees did not have access to competitively useful information that conferred an unfair competitive advantage on Raytheon. 

The Federal Acquisition Regulation (FAR) requires contracting agencies to “avoid strictly any conflict of interest or even the appearance of a conflict of interest in Government-contractor relationships.”  FAR § 3.101-1; see VSE Corp., B-404833.4, Nov. 21, 2011, 2011 CPD ¶ 268 at 7.  As our Office has recognized, the standard for evaluating whether a firm has an unfair competitive advantage under FAR subpart 3.1 stemming from its hiring of a former government employee is virtually indistinguishable from the standard for evaluating whether a firm has an unfair competitive advantage arising from its unequal access to information as a result of an organizational conflict of interest under FAR subpart 9.5.[8]  Health Net Fed. Servs., LLC, B-401652.3, B-401652.5, Nov. 4, 2009, 2009 CPD ¶ 220 at 28 n.15. 

Where a firm may have gained an unfair advantage through its hiring of a former government official, the firm can be disqualified from a competition based upon the appearance of impropriety which is created by this situation--even if no actual impropriety can be shown--so long as the determination of an unfair competitive advantage is based on hard facts and not on mere innuendo or suspicion.  Health Net Fed. Servs., LLC, supra, at 28; see NKF Eng’g, Inc. v. U.S., 805 F.2d 372 (Fed. Cir. 1986).  In determining whether an offeror obtained an unfair competitive advantage in hiring a former government employee based on the individual’s knowledge of non-public information, our Office has considered a variety of factors, including whether the non-public information was in fact available to the protester, whether the non-public information was the protester’s proprietary information, and whether the non-public information was competitively useful.  International Resources Grp., B-409346.2 et al., Dec. 11, 2014, 2014 CPD ¶ 369 at 9.  We review the reasonableness of the contracting officer’s investigation and, where an agency has given meaningful consideration to whether an unfair competitive advantage exists, will not substitute our judgment for the agency’s, absent clear evidence that the agency’s conclusion is unreasonable.  VSE Corp., supra; PCCP Constructors, JV; Bechtel Infrastructure Corp., B-405036 et al., Aug. 4, 2011, 2011 CPD ¶ 156 at 17.

Waiver

As a preliminary matter, DHS requested that our Office dismiss Northrop’s arguments concerning the former government employees because, the agency contends, it waived all potential conflicts pursuant to the authority in FAR subpart 9.5.  In this regard, the FAR provides that an agency head or designee, not below the level of the head of the contracting activity, may, as an alternative to avoiding, neutralizing, or mitigating an OCI, execute a waiver determining that application of the FAR’s OCI provisions in a particular circumstance is not in the government’s interest.  FAR § 9.503; AT&T Gov’t Solutions, Inc., B-407720, B‑407720.2, Jan. 30, 2013, 2013 CPD ¶ 45 at 4.  Our Office will dismiss a protest where the agency has waived an OCI pursuant to FAR § 9.503.  AT&T Gov’t Solutions, Inc., supra.

On June 9, 2017, the contracting officer issued what was described as a request to waive any alleged OCIs associated with Northrop’s allegations concerning the two former government employees.  AR, Tab N.6, OCI Waiver Request, at 1.  On June 21, the agency’s acting deputy chief procurement officer approved the waiver, stating as follows:

Considering the importance of allowing the NCPS program office to move forward with obtaining the critical services covered by the DOMino procurement, I conclude that it is in the Government’s interest to waive the application of the rules and procedures of FAR Subpart 9.5 with respect to any residual actual, apparent, potential, or alleged OCI concerns or risks arising from any unequal access to information or unfair competitive advantage allegations described in the attachments to the waiver request.

AR, Tab N.7, OCI Waiver Approval, at 2.

On July 14, DHS requested that our Office dismiss Northrop’s allegations regarding the former government employees based on the OCI waiver.  On July 21, we denied the request for dismissal, concluding that the waiver was not effective because the protester’s allegations did not arise under the provisions of FAR subpart 9.5 and because FAR subpart 3.1 does not have a waiver provision.  GAO Email to Parties, July 21, 2017.  Because our Office has not directly addressed this issue, we provide a fuller explanation of the basis for our decision not to dismiss the protest below.

DHS and Raytheon contend that because our Office has explained that the standard of review for an unfair competitive advantage arising from the hiring of a former government employee mirrors that of an unequal access to information OCI, it follows that agencies may waive either type of concern under the provisions of FAR § 9.503.  Raytheon further argues that the provisions of FAR subpart 3.1 should be considered general guidance concerning conflicts of interest, and that the provisions for FAR subpart 9.5 should be considered more specific, and controlling guidance regarding OCIs--as well as any other conflicts of interest.

As our Office has explained in numerous decisions, challenges based on an offeror’s hiring or association with former government employees who have access to non-public, competitively useful information are more accurately categorized as unfair competitive advantages under FAR subpart 3.1 than OCIs under FAR subpart 9.5.  See International Resources Grp., supra, at 9 n.9; Threat Mgmt. Grp., B-407766.6, July 3, 2013, 2013 CPD ¶ 167 at 1 n.1; VSE Corp., supra, at 7 n.4; Health Net Fed. Servs., LLC, supra, at 28 n.15; Physician Corp. of America, B-270698 et al., Apr. 10, 1996, 96-1 CPD ¶ 198 at 4-6.

We acknowledge that our Office has issued decisions which generally describe allegations concerning the hiring of former government employees as an unequal access to information OCI.  E.g., Liquidity Servs., Inc., B-409718 et al., July 23, 2014, 2014 CPD ¶ 221 at 7-8; Science Applications Int’l Corp., B-406921, B-406921.2, Oct 1, 2012, 2012 CPD ¶ 267 at 10-11.  However, as the FAR and our decisions regarding unequal access to information OCIs make clear, such OCIs arise where a contractor has access to non-public information as part of its performance of a government contract, or where the contractor possesses information improperly provided by a government employee.  FAR §§ 9.505(b), 9.505-4; CapRock Gov’t Solutions, et al., B‑402490 et al., May 11, 2010, 2010 CPD ¶ 124 at 25.  In contrast, an unfair competitive advantage arising from the hiring of a former government employee does not implicate the contractor’s access to information through that contractor’s performance of a government contract or from a current government employee.  For this reason, our decisions have distinguished between the concerns arising under FAR subpart 3.1 and FAR subpart 9.5.

To the extent any of our prior decisions suggest a contrary conclusion, we clarify that because FAR subpart 3.1 does not permit the agency to waive concerns arising under that subpart, a waiver executed pursuant to FAR § 9.503 does not warrant dismissal of an argument that the hiring of a former government employee violates the principles of FAR subpart 3.1.

Roles of Former Government Employees

Northrop’s arguments concern two former DHS employees whose work was related to the agency’s cybersecurity mission.  Former employee 1 held the following relevant positions at DHS:  (1) deputy director, NSD, from October 2008 to March 2010; (2) deputy director, National Cyber Security Division (NCSD)[9], from March 2010 to October 2011; and (3) director, NCSD, from October 2011 to January 2012.  AR, Tab N.2, Contracting Officer’s Supplemental OCI Determination & Findings (OCI D&F), at 11.  This individual left DHS in January 2012, and began work at Raytheon that month.  Id. at 12. 

Former employee 2 held the following relevant positions at DHS:  (1) deputy assistant secretary and acting assistant secretary for cybersecurity and communication, from May 2008 to December 2010, and (2) director, cybersecurity coordination in the NPPD from December 2010 to January 2012.  Id. at 12.  This individual also left from DHS in January 2012, and began work for a private firm in February 2012.  This firm was proposed by Raytheon as one of its subcontractors for the DOMino contract.  Id. at 13.

Agency Review

DHS’s corrective action in response to Northrop’s 2016 protest of the second award to Raytheon included a supplemental analysis by the contracting officer of the allegations concerning the two former government employees.  On May 30, 2017, the contracting officer issued a 78-page memorandum summarizing the agency’s analysis of possible conflicts arising from the post-government employment activities of the two former employees.  AR, Tab N.2, OCI D&F, at 1.  The contracting officer also prepared a memorandum summarizing the method and scope of the agency’s analysis of the allegations.  AR, Tab N.1, Second Corrective Action Memorandum, at 1.

The contracting officer’s memorandum addressed the activities of the former government employees during their time at DHS, the information to which the agency found the former employees had or could have had access, and their post-employment activities for Raytheon and Raytheon’s proposed subcontractor.  AR, Tab N.2, OCI D&F, at 13‑67.  The agency conducted interviews with current and former DHS employees who worked with former government employees 1 and 2 and who were familiar with the DOMino procurement.  AR, Tab N.1, Second Corrective Action Memorandum, at 5.  The agency conducted three interviews with former government employee 1 and submitted questions and received responses in writing from former government employee 2.  Id. at 14.  The agency also reviewed numerous agency documents and emails (described by the agency as approximately 25,000 messages).  Id. at 9.  Based on DHS’s review of the work performed by former employees 1 and 2 and the information to which they had or could have had access, the agency found no basis to conclude that Raytheon had an unfair competitive advantage.  AR, Tab N.2, OCI D&F, at 75-77.

Competitively Useful Information

Northrop argues as a general matter that the roles of the two former DHS employees gave them “unlimited access” to all information concerning DHS’s requirements and plans for the DOMino procurement at the time of their departure from the agency.  The protester also argues that, to the extent the agency reviewed whether the information to which the former employees had access was non-public and competitively useful, the agency’s conclusions are not reasonable. 

DHS does not dispute that the positions held by the former DHS employees involved management or leadership roles within parts of the agency which were responsible for or otherwise relevant to the agency’s requirements for DOMino.  Instead, the agency’s analysis emphasized that both former government employees left in January 2012, which was 2 and a half years before the RFP was issued, and 3 and a half years before proposals were due.  AR, Tab N.2, OCI D&F, at 11-12.  The agency found that numerous documents to which the former government employees had or could have had access were subsequently disclosed to offerors or had otherwise been rendered obsolete.  Additionally, the agency found that the passage of time, along with the nature of the information, demonstrated that any non-public information was not competitively useful.  We address three examples of the agency’s review challenged by the protester.

First, DHS assessed whether the former government employees’ participation in or access to internal (DHS) and external (other agency) briefings concerning NSD programs provided competitively useful non-public information, as those programs were part of the requirements for the RFP.  AR, Tab N.2, OCI D&F, at 16‑17.  The agency found that during former employee 1’s tenure at DHS, “there were high level program briefings . . . that involved NSD’s budget estimates at the time as well as the Life Cycle Cost Estimate (LCCE) NSD had developed by then.”  Id. at 16. 

The agency concluded that “[k]nowledge of NSD’s budget, LCCEs, and [Office of Management and Budget (OMB)] budget status briefings at the time [former employee 1] worked at DHS would have been based on outdated information by the time the final DOMino solicitation was released.”  Id.  The agency further concluded that these briefings were “not tied to the final strategy nor specific enough to be tied to what became the final DOMino strategy.”  Id. 

The agency acknowledged that the “LCCE cost model was composed of 841 lines and a dozen of these lines were related” to performance by one of the incumbent contractors for certain of the requirements to be incorporated into the DOMino SOW.  Id. at 16-17.  The agency nonetheless concluded that “[i]t would have been difficult to correlate [the information regarding the incumbent] to the DOMino requirement, and implausible to be able to recall the spreadsheet in enough detail to pull those items and make any kind of competitive use of them in order to attain a competitive advantage based on the contractor-specific information.”  Id. at 17.  In this regard, the agency explained that the incumbent information “typically consisted of a lump sum labor amount for particular subtasks included in the cost model,” which was “broken down by year, but did not include any details as to how they were calculated, such as labor rates, indirect rates, or numbers of labor hours or [full-time equivalent personnel].”  Id. at 17 n.18.  The agency further noted that the SOW and cost estimates for the DOMino solicitation were not created until after former employee 1 departed DHS.  Id. at 17. Based on this analysis, the agency concluded that “[t]his information, though non-public, is outdated and lacked usable detail, and therefore is not competitively useful.”  Id.

Northrop argues that the agency unreasonably concluded that the information in the briefings, particularly the LCCEs, was not competitively useful.  In this regard, the protester argues that the agency unreasonably discounted or ignored the significance of the information concerning the incumbent contractor’s performance.  As discussed above, however, the agency specifically concluded that the data in the LCCEs were not specifically tied to the agency’s final acquisition strategy--which was not finalized until after the former employees left DHS--nor was the information in a format that allowed for application to the DOMino solicitation.  On this record, we conclude that the agency gave meaningful consideration to the information and drew reasonable conclusions regarding the competitive usefulness of the information.  The protester’s disagreement with the agency’s assessment, without more, does not demonstrate that the agency’s judgment was based on an inadequate analysis or otherwise unreasonable conclusions.  See Threat Mgmt. Grp., supra, at 5-6.

Next, DHS assessed whether the former government employees’ access to program management reviews (PMRs) provided competitively useful non-public information.  AR, Tab N.2, OCI D&F, at 48.  These documents concerned the status of NCPS program activities and their supporting contracts in 2010 and 2011, and were “used to support decision making about contracts to be awarded in the upcoming fiscal year.”  Id.

The agency concluded that it was “plausible” that the two former government employees had access to “contractor PMR/contract execution information” regarding two contractors, and that this information “would have included the status of [contractor] staffing actions, accomplishments from the reporting period, planned accomplishments for the next reporting period, issues, and funding burn rate (including details related to the procurement of hardware & software [other direct costs]).”  Id. at 49-50.

The agency concluded, however, that the information was not competitively useful because “there was about two and a half years between when [the two former employees] left DHS and when the DOMino solicitation was released, [and therefore] the PMR data would be outdated since such data changes rapidly.”  Id. at 50.  In support of this conclusion, the agency explained that information concerning staffing levels on the contracts referenced in the PMRs was subsequently released in the RFP and in the bidder’s library, in some with a greater degree of detail than addressed in the PMRs.  Id.  With regard to performance concerns, the agency concluded that the “risks/issues presented were either not directly related to DOMino or were no longer risks/issues at the time that the RFP was released.”  Id.  In sum, the agency concluded that “[t]his information, though non-public, was too outdated or lacking in detail to be competitively useful.”  Id.

Here again, Northrop argues that the agency’s analysis was inadequate because it identified what the protester contends could have been competitively useful information.  Although the protester disagrees with the agency’s assessment of the usefulness of the information, this disagreement, without more, does not provide a basis to sustain the protest.  See Threat Mgmt. Grp., supra, at 5-6.

Third, Northrop argues that DHS failed to reasonably evaluate exchanges between the two former government employees and a then-current DHS employee in 2013.  The protester contends that the exchanges show that the two former government employees may have received information regarding the agency’s requirements that conferred an unfair competitive advantage.[10]

With regard to former employee 2, the agency found that on December 13, 2013, he requested and received from the then-current DHS employee[11] a document called the NCPS technical vision.  AR, Tab N.2, OCI D&F, at 64.  This document addressed a summary of the “five year technical vision for the DHS National Cybersecurity Protection System (NCPS).”  AR, Tab J.2.vii, NCPS Technical Vision, at 3.[12]  DHS noted that the document provided by the then-current DHS employee to former employee 2 was “the exact same version [of the technical vision document] as what was provided to all Offerors as part of the Bidder’s Library in May 2014, prior to the release of the original solicitation.”  AR, Tab N.2, OCI D&F, at 64.  For this reason, the agency concluded that this document could not have conferred an unfair competitive advantage on former employee 2’s current employer, or on Raytheon based on its proposal of this employer as subcontractor.  Id. at 67.

Despite the fact that the document was made available to all offerors for the DOMino procurement, the agency also conducted additional investigations regarding the December 2013 exchange, including an interview with the then-current DHS employee in October 2016.  Id. at 64; Tab N.4.i, DHS Employee Interview, Oct. 20, 2016.  The agency found that former employee 2 and the then-current DHS employee corresponded regarding a conference sponsored by former employee 2’s current employer.  The purpose of the then-current DHS employee’s participation in the conference was to provide information to industry about the agency’s intended direction for NCPS and the DOMino procurement.  AR, Tab N.2, OCI D&F, at 65; Tab N.4.i, DHS Employee Interview, Oct. 20, 2016, at 7.  The agency interviewed the then-current DHS government employee and found credible his explanation that exchanges with former employee 2 did not concern any non-public information.  Id.  The agency also reviewed email accounts of DHS employees for emails from government employee 2 and did not find evidence of exchanges with “any direct relevance to DOMino or the NCPS program.”  AR, Tab N.2, OCI D&F, at 65.  Based on this review, the agency found no basis to conclude that that former employee 2 received non-public competitively useful information through exchanges with DHS employees.  Id. at 67.

DHS also found that former employee 1 contacted the then-current DHS employee in October 2013 to request information concerning a document called the E3A Security Requirements Traceability Matrix.  Id. at 65.  The agency found, however, that the document was not provided to former employee 1.  Id. at 67; see Tab N.4.i, DHS Employee Interview, Oct. 20, 2016, at 6. 

Here again, the protester disputes the adequacy of the investigation and the reasonableness of the agency’s conclusions.  On this record, we find no basis to conclude that the protester’s disagreement, without more, provides a basis to sustain the protest.  See Threat Mgmt. Grp., supra, at 5-6.  In sum, we conclude that DHS gave meaningful consideration to Northrop’s allegations regarding the two former government employees and reasonably investigated whether they had or may have had access to competitively useful non-public information.[13]

Changed Requirements

Next, Northrop argues that DHS’s requirements for cybersecurity and the mission of the NCPS have changed since the 2014 issuance of the RFP, and that the agency should revise the solicitation to reflect the changed requirements and provide offerors an opportunity to submit new proposals.  For the reasons discussed below, we find no basis to sustain the protest.

A contracting agency has the discretion to determine its needs and the best methods to accommodate them.  JLT Grp., Inc., B-402603.2, June 30, 2010, 2010 CPD ¶ 181 at 2.  A protester’s disagreement with the agency’s judgment concerning its needs and how to accommodate them does not show that the agency’s judgment is unreasonable. Dynamic Access Sys., B-295356, Feb. 8, 2005, 2005 CPD ¶ 34 at 4. 

Where an agency’s requirements materially change after a solicitation has been issued, it must issue an amendment to notify offerors of the changed requirements and afford them an opportunity to respond.  FAR § 15.206(a); Murray-Benjamin Elec. Co., L.P., B‑400255, Aug. 7, 2008, 2008 CPD ¶ 155 at 3-4.  Amending the solicitation provides offerors an opportunity to submit revised proposals on a common basis that reflects the agency’s actual needs.  Global Computer Enters., Inc.; Savantage Fin. Servs., Inc., B‑404597 et al., Mar. 9, 2011, 2011 CPD ¶ 69 at 8.

Northrop primarily argues that a memorandum prepared by the acting deputy director of the NSD during the corrective action identifies new requirements not contemplated by the current RFP.[14]  AR, Tab P.1, New Requirements Memorandum.[15]  The memorandum was requested by the contractor officer to assess whether changes to the agency’s NSD branch and other changes in the agency’s needs required a change to the RFP.  AR, Tab O.4, Determination Regarding RFP Amendment, at 2.  The memorandum identified six areas that NSD recommended “be evaluated as substantial enough to support the development of a new SOW to support the new Branches and additional NCPS requirements”:  (1) continuous diagnostic monitoring new product/capability evaluation; (2) certification and accreditation; (3) support for cloud and mobile development; (4) support for new program offices; (5) enhanced cybersecurity services engineering support; and (6) NCPS non-signature based engineering development and operations.  AR, Tab P.1, New Requirements Memorandum, at 4-5.

The contracting officer reviewed the new requirements memorandum and exchanged views with the acting deputy director of the NSD regarding the additional requirements.  AR, Tab O.4, Determination Regarding RFP Amendment, at 2-3.  The contracting officer concluded that the RFP did not require amendment because either the current SOW was broad enough to encompass potential changes to the agency’s requirements, or the potential changes identified in the new requirements memorandum were not sufficiently definitive to conclude that they become part of the DOMino contract.  Id. at 3.

Based on our review of the record, we do not agree with Northrop that the agency failed to consider the issues raised in the memorandum or that the agency unreasonably concluded that the RFP did not require amendment.  In general, the protester characterizes the concerns raised in the memorandum as definitive changes to the agency’s requirements, and argues that the contractor will be directed to perform requirements that differ materially from those set forth in the RFP. 

As discussed above, our Office has sustained protests where the agency’s requirements have clearly changed so that offerors could not compete on a common basis that reflects the agency’s actual needs.  For example, in Global Computer Enters., the RFP required offerors to propose their technical solutions based on a schedule that the agency, at the time of award, knew that it would no longer pursue.  Global Computer Enters., supra, at 9-10.  We concluded that while the RFP anticipated the transition to a new financial management system of 20 percent of the agency’s requirements during the first 2 years of contract performance, the agency knew at the time of award that, based on guidance from OMB, that it would only transition approximately 1.5 to 2.9 percent of the agency’s requirements during that time.  Id.  In Symetrics Indus., Inc., B‑274246.3 et al., Aug. 20, 1997, 97-2 CPD ¶ 59, our Office concluded that the agency should have amended a solicitation for an IDIQ contract because although the solicitation initially estimated the agency would require 3,755 units of a product, the agency subsequently learned--prior to award--that the agency no longer had a requirement for 3,219 of those units.  Id. at 6.

Here, the protester argues that various evolving threats or changes to cybersecurity identified in the new requirements memorandum will or should require the agency to change its approach.  For example, Northrop argues that changes in the way that the government uses cloud computing and mobile devices requires the agency to amend the solicitation.  Specifically, the protester contends that increased use by the government of cloud-based and mobile computing means that government users are not routing all of their data traffic through government networks connected to the systems which will be protected through DOMino.  See Decl. of Protester’s Consultant, Aug. 7, 2017, at ¶¶ 15‑18.

The new requirements memorandum noted that the trend towards cloud and mobile computing and away from government data centers “necessitates a reexamination of whether current NCPS services and capabilities can continue to protect [federal agencies] as they move to cloud-based architectures and services.”  AR, Tab P.1, New Requirements  Memorandum, at 5.  The memorandum further advised that “[i]t is imperative for the NCPS to recognize the changing technology and computing environments and provide additional cybersecurity services to protect the physical and data assets that now define the [federal agencies’] information technology environment.”  Id.

The contracting officer’s review of the memorandum found no basis to conclude that the concerns regarding cloud and mobile computing required the agency to amend the RFP.  AR, Tab O.4, Determination Regarding Amendment of RFP, at 2.  Although the contracting officer’s review of the new requirements memorandum did not provide a detailed explanation for the analysis regarding cloud and mobile computing, the agency’s response to the protest provided greater details regarding the basis for the decision.  For example, the author of the new requirements memorandum explained that “there is still significant work that has to be done in identifying and planning the agency’s strategy and approach for securing cloud and mobile services before it will even be possible to define the nature and extent of the DOMino contractor’s responsibilities (if any) for implementing that approach.”  Supp. Decl. of DHS Investments & Contracts Management Branch Chief, Aug. 17, 2017, at 5.[16]  For this reason, the agency states, there is no basis at this time to determine whether changes in the approach to cloud and mobile computer security “will involve labor categories, skill sets, qualifications, or specific places of performance not contemplated by the DOMino solicitation (although we do not currently anticipate that that will be the case).”  Id. at 5-6.

On this record, we conclude that Northrop has not shown that the agency’s requirements have definitively changed in a material manner or that the agency will place orders in a different manner than required by the RFP.  Although Northrop argues that the agency should or may take a different approach to the overall cybersecurity mission in a manner that may also change the requirements of the DOMino contract, the protester’s disagreement with the agency’s judgment not to amend the solicitation does not provide a basis to sustain the protest.[17]

Past Performance Evaluation

Next, Northrop argues that DHS failed to reasonably evaluate offerors’ past performance.  For the reasons discussed below, we find no basis to sustain the protest.

The evaluation of an offeror’s past performance is within the discretion of the contracting agency; our Office will, however, question an agency’s evaluation of past performance where it is unreasonable or undocumented.  Solers, Inc., B-404032.3, B‑404032.4, Apr. 6, 2011, 2011 CPD ¶ 83 at 8.  A protester’s disagreement with the agency’s judgment concerning the merits of the protester’s past performance, without more, does not establish that the evaluation was unreasonable.  Constellation NewEnergy, Inc., B-409353.2, B-409353.3, July 21, 2014, 2014 CPD ¶ 219 at 6.

As relevant here, the RFP stated that the agency would evaluate whether an offeror’s past performance “demonstrates their capability to successfully perform the DOMino Program requirements,” based “on the Offeror’s past performance conducting relevant and recent work of the same and/or similar nature to the requirements described in the solicitation.”  RFP § M-4 at 83.  The RFP defined relevant past performance as “work which is the same and/or similar in size, complexity and scope of the work described in the solicitation,” and stated that performance was to be evaluated based on “the extent to which the past performance is comparable and related to the requirements of the DOMino effort and the extent to which it is of similar scope, size and complexity to the work that is described in the solicitation.”  Id. at 83-84.  Recent past performance was defined as work within 5 years of the issuance of the RFP.  Id. at 83.  The RFP advised that the agency would “place more weight and consideration on recent and more relevant past performance information.”  Id. at 84.

Northrop argues that DHS failed to meaningfully assess the relevance of offerors’ past performance references and, as a result, improperly concluded that all of Raytheon’s references were either the “same” or “similar” to the scope of the DOMino contract in terms of scope and complexity.  The protester contends, for example, that the agency unreasonably found Raytheon’s three past performance references were relevant despite the fact that they were each smaller, and smaller in total, than the $1.15 billion estimated value of the DOMino contract.  In this regard, the three references cited by Raytheon were for $134 million, $281 million, and $214 million, respectively.  AR, Tab H.4, Raytheon Past Performance Evaluation, at 2-4.

Northrop argues that the disparity between the value of Raytheon’s references and the anticipated value of the DOMino contract demonstrates that the agency’s evaluation was unreasonable.  In support of its argument, the protester cites our decision in Al Raha Group for Technical Services, Inc.; Linguistics Mgmt. Int’l, Inc., B-411015.2, B‑411015.2, Apr. 22, 2015, 2015 CPD ¶ 134, where we sustained a protest because the agency’s evaluation unreasonably assigned the highest possible ratings to the awardee’s past performance despite a vast disparity between the combined value of the references and the anticipated value of the contract award.  In Al Raha, we concluded that the agency’s evaluation was unreasonable because the combined value of the awardee’s contract references was only 0.14% of the value of the anticipated contract award.  Al Raha Grp., supra, at 7 (explaining that the combined value of the awardee’s past performance was $152,036 as compared to the $110 million anticipated value of the protested award). 

Here, we do not think that the difference between Raytheon’s references and the value of the anticipated award present the same inherently unreasonable disparity identified in Al Raha.  Moreover, unlike the evaluation in Al Raha, the agency’s evaluation here expressly acknowledged the differences between the awardee’s past performance and the value of the anticipated award.  For example, the agency found that Raytheon’s reference for a $134 million contract for the Federal Bureau of Investigation was “marginally similar” in terms of size, but considered the fact that the value of the reference was over $100 million, which showed the offeror’s ability to successfully perform work under a high dollar value contract.  AR, Tab H.4, Raytheon Past Performance Evaluation, at 3.  The agency further concluded that the reference was nonetheless relevant based on the similarity of the work in terms of scope and complexity.  AR, Tab H.4, Raytheon Past Performance Evaluation, at 2-3.; see Tab I.1, Source Selection Evaluation Board (SSEB) Report, at 49-50.  On this record, we find no basis to conclude that the agency’s evaluation was unreasonable.

Northrop also argues that the agency failed to consider the scope and complexity of the work.  The record shows, however, that the agency expressly considered this matter, and for each of Raytheon’s references concluded that the work performed was relevant to the requirements of the RFP.  AR, Tab H.4, Raytheon Past Performance Evaluation, at 3-4.  For example, the agency noted that the awardee’s reference for a contract with the National Geospatial Intelligence agency had “the same” complexity and scope as the anticipated cybersecurity and O&M work under the RFP.  Id. at 4.

Finally, the protester argues that, even if the agency reasonably found Raytheon’s past performance references to be relevant in terms of size, scope, and complexity, the agency failed to evaluate the relative relevance of offerors’ past performance.  In this regard, the protester contends that although the RFP stated that the agency would “place more weight and consideration on recent and more relevant past performance information,” RFP § M-4 at 84, the agency’s evaluation simply treated all offerors’ past performance as relevant without giving greater weight to more relevant past performance.  The protester contends that the agency’s evaluation failed to compare any of the offerors’ past performance references in detail, and thus improperly ignored substantial differences between what it contends was Raytheon’s smaller, less similar past performance references and Northrop’s significantly larger and more similar references. 

The record shows that DHS found “no clear differentiating factors between the Offeror’s past performance submissions aside from the fact that each of Raytheon’s references are only marginally similar in size to DOMino’s.”  AR, Tab I.1, SSEB Report, at 49-50.  The agency also found that the relevance of offerors’ references “did vary to differing degrees across each Offeror” but concluded that the “variation was minimal and was not enough to represent any kind of significant differentiation” that merited different evaluation ratings.  Id. at 50. 

Even if, as the protester contends, the agency did not give adequate weight to the relative relevance of offerors’ past performance, there is no basis in the record to conclude that the protester could have been prejudiced.  In this regard, competitive prejudice is an essential element of a viable protest, and we will sustain a protest only where the protester demonstrates that, but for the agency’s improper actions, it would have had a substantial chance of receiving the award.  DRS ICAS, LLC, B-401852.4, B‑401852.5, Sept. 8, 2010, 2010 CPD ¶ 261 at 21.  Here, Raytheon had higher ratings than Northrop under each of the first four evaluation factors--each of which was weighted more heavily in the award decision than past performance or cost.  AR, Tab I.3, SSDD, at 3; RFP § M-2 at 80.  On this record, we find no basis to conclude that a lower rating for Raytheon under the fifth-least important evaluation factor would give Northrop a substantial chance for award--particularly where the record shows that the agency selected Raytheon’s proposal for award over the proposal of Offeror 3, which had a higher-rated and lower cost proposal as compared to Northrop.  AR, Tab I.3, SSDD, at 3.  In sum, find no basis to conclude that any of Northrop’s allegations regarding the evaluation of offerors’ past performance provides a basis to sustain the protest. 

Unequal Discussions

Finally, Northrop contends that DHS improperly conducted discussions with Raytheon and failed to provide the protester with the same opportunity to revise its proposal.  Specifically, the protester argues that the agency improperly allowed the awardee to submit a portion of a risk questionnaire for a proposed subcontractor that was omitted from its final proposal revision (FPR); having done so, Northrop argues, the agency should have conducted a new round of discussions and allowed the protester to submit a revised proposal.  We find no merit to this argument.

Where an agency engages in discussions with an offeror, it must afford all offerors remaining in the competition an opportunity to engage in meaningful discussions. FAR § 15.306(d)(1); Presidio Networked Solutions, Inc., et al., B-408128.33 et al., Oct. 31, 2014, 2014 CPD ¶ 316 at 8.  The FAR requires agencies conducting discussions with offerors to address, “[a]t a minimum . . . deficiencies, significant weaknesses, and adverse past performance information to which the offeror has not yet had an opportunity to respond.”  FAR § 15.306(d)(3).  Discussions occur when an agency indicates to an offeror aspects of its proposal that could be altered or explained to materially enhance the proposal’s potential for award or to obtain information from the offeror that is necessary to determine the proposal’s acceptability, and provides an opportunity to submit a revised proposal.  Raytheon Co., B-404998, July 25, 2011, 2011 CPD ¶ 232 at 5.  As our Office has explained however, an agency’s request for and acceptance of information that relates to offeror responsibility, rather than proposal evaluation, does not constitute discussions and thus does not trigger the requirement to hold discussions with other competitive range offerors.  General Dynamics-Ordnance & Tactical Sys., B-295987, B‑295987.2, May 20, 2005, 2005 CPD ¶ 114 at 10.

The RFP included attachment J-9, an acquisition risk questions form, and stated that the forms “must be completed by all Offerors and subcontractors.”  RFP § L.22 at 72.  The security evaluation factor was to be evaluated on a pass/fail basis, and the RFP advised that “this evaluation includes responses to the Acquisition Risk questionnaire (Attachment J-9).”  Id. § M-5 at 85.  As relevant here, form J-9 included a key management and personnel list (KMPL), which required information about citizenship and clearance for certain company employees.  Id. § L.22 at 72; id., Attach. J-9, at 4.  The security evaluation factor stated that offerors were required to demonstrate that they met the following three requirements:  (1) that the offeror was a U.S. contractor, (2) the offeror has a facilities clearance, and (3) proposed staff supporting the O&M task order have security clearance.  Id. § M-5 at 85.

DHS’s initial evaluation for the security evaluation factor found that each offeror’s proposal merited a pass rating.  AR, Tab H, Competitive Range Determination, at 4.  During discussions, the agency requested that Raytheon and Northrop provide missing J-9 forms for certain of their subcontractors.  AR, Tab O.3, Security Evaluation Memorandum, at 4-5.  The agency found that Raytheon’s FPR provided a J-9 form for one of its proposed subcontractors, but omitted the KMPL portion of the form.  Id. at 5.  The agency found that Northrop’s FPR also omitted a form J-9 for its largest proposed subcontractor, and instead provided alternative forms of information which omitted responses to certain parts of the form.  Id.  Despite these omissions, the agency’s evaluation of FPRs again found that all offerors’ proposals merited a pass rating for the security factor.  AR, Tab H, Security Evaluation Report, Aug. 31, 2015, at 1.  On September 2, 2015, the agency requested that Raytheon provide the omitted KMPL information for its proposed subcontractor.  AR, Tab O.3, Security Evaluation Memorandum, at 6.  Raytheon provided the KMPL information, as requested.  Id.

Northrop argues that the RFP required offerors to submit J-9 forms for all proposed subcontractors, and that because Raytheon failed to provide complete information for one of its proposed subcontractors, its proposal should have been rejected as technically unacceptable.  The protester contends, therefore, that the agency’s request for the missing KMPL information for Raytheon’s proposed subcontractors was necessary to find its proposal technically acceptable, and that the request and acceptance of the KMPL information constituted unequal discussions.  The protester argues that it should have been provided an opportunity for a new round of discussions and an opportunity to submit a revised proposal.

First, we do not agree with the protester that Raytheon’s omission of the KMPL information clearly rendered the awardee’s proposal unacceptable.  As discussed above, the RFP required offerors to demonstrate that staff proposed for certain tasks under the O&M task order to be awarded with the contract had the appropriate security clearances.  RFP § M-5 at 85.  As the intervenor notes, its proposal did not propose any staff for this subcontractor for the O&M task, and instead proposed the subcontractor as a resource for “reachback,” or backup, capabilities.  AR, Tab G.1, Raytheon Proposal, Vol. 1, at E-48, Vol. 5, at E-54-55, E-60.  For this reason, the intervenor contends, the KMPL information requested by the agency was not necessary for or relevant to the security factor evaluation.  In this regard, DHS notes that Northrop’s own proposal stated that it would not submit any J-9 forms for any subcontractor that was not proposed for a role on the O&M task order.  See AR, Tab F, Northrop Proposal, Vol. I, Attach B, at 1.  The agency explained that although it found that both Northrop and Raytheon’s proposals were missing information from their proposed subcontractor’s J-9 forms, the agency was able to conclude that the proposals passed the three requirements of the security factor.  AR, Tab O.3, Security Evaluation Memorandum, at 5‑8; see RFP § M-5 at 85. 

Thus, to the extent Northrop’s argument that the agency conducted unequal discussions is predicated on its interpretation of the RFP as requiring a J-9 form for all proposed subcontractors as a requirement for a pass rating under the security subfactor, neither the RFP, nor the protester’s interpretation of the RFP as evidenced by its own proposal, support this view.[18]  Moreover, the record supports the agency’s interpretation of the RFP to the extent that its evaluation found all offerors’ proposals acceptable under the security factor evaluation even before offerors were requires to submit missing J-9 forms during discussions.  See AR, Tab H, Competitive Range Determination, at 4. 

In any event, DHS explains that it requested the KMPL information for Raytheon’s proposed subcontractor in connection with the agency’s pre-award responsibility determination.  AR, Tab O.3, Security Evaluation Memorandum, at 6; COS at 9.  In this regard, the agency notes that the KMPL portion of form J-9 includes information about the identity, citizenship, and security clearance status of the company’s key management personnel.  AR, Tab O.3, Security Evaluation Memorandum, at 2.  The agency explains that this information was reviewed as part of the agency’s responsibility determination, and was not considered as part of the evaluation of Raytheon’s proposal for the security evaluation factor.  Id. at 9.  As discussed above, exchanges with an offeror that relate solely to its responsibility do not constitute discussions that trigger the requirement to hold discussions with other competitive range offerors.  General Dynamics-Ordnance & Tactical Sys., supra.  On this record, we find no basis to conclude that the agency conducted unequal discussions with Raytheon.

The protest is denied.

Susan A. Poling
General Counsel

---