Network Security Systems Plus, Inc.

B-416755: Dec 6, 2018

Additional Materials:

Contact:

Ralph O. White
(202) 512-8278
WhiteRO@gao.gov

Kenneth E. Patton
(202) 512-8205
PattonK@gao.gov

 

Office of Public Affairs
(202) 512-4800
youngc1@gao.gov

Network Security Systems Plus, Inc. (NSSPlus), of Falls Church, Virginia, protests the issuance of a task order to AbleVets, LLC, of Chantilly, Virginia, under task order request for proposals (RFP) No. N65236-18-R-3086, issued by the Department of the Navy, Space and Naval Warfare Systems Command (SPAWAR), for cyber security service provider (CSSP) vulnerability analysis and audit support. NSSPlus, the incumbent contractor, challenges the evaluation of technical and cost proposals, and contends that the Navy's best-value tradeoff decision was unreasonable.

We deny the protest.

DOCUMENT FOR PUBLIC RELEASE
The decision issued on the date below was subject to a GAO Protective Order. This redacted version has been approved for public release.

Decision

Matter of:  Network Security Systems Plus, Inc.

File:  B-416755

Date:  December 6, 2018

Michael J. Schrier, Esq., and Matthew A. Freeman, Esq., Duane Morris LLP, for the protester.
Jeffrey S. Robinette, Esq., Jill K. McDowell, Esq., and Jason P. Matechak, Esq., Impresa Legal Group, for AbleVets, LLC, the intervenor.
David White, Esq., and Mark S. Christopher, Esq., Department of the Navy, for the agency.
Paula J. Haurilesko, Esq., and Laura Eyester, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision.

DIGEST

1.  Protest that the agency misevaluated the awardee’s proposal is denied, where the agency reasonably considered information within the evaluation team’s personal knowledge concerning dates of performance.

2.  Protest that the agency conducted a faulty cost realism analysis is denied, where the record shows that the agency reasonably considered the awardee’s forward pricing rate proposal and supporting documentation.

DECISION

Network Security Systems Plus, Inc. (NSSPlus), of Falls Church, Virginia, protests the issuance of a task order to AbleVets, LLC, of Chantilly, Virginia, under task order request for proposals (RFP) No. N65236-18-R-3086, issued by the Department of the Navy, Space and Naval Warfare Systems Command (SPAWAR), for cyber security service provider (CSSP) vulnerability analysis and audit support.  NSSPlus, the incumbent contractor, challenges the evaluation of technical and cost proposals, and contends that the Navy’s best-value tradeoff decision was unreasonable.

We deny the protest.

BACKGROUND

The RFP, issued on April 20, 2018, was set aside for small business holders of the Navy’s Seaport-e multiple award indefinite-delivery, indefinite-quantity contracts, and contemplated the issuance of a cost-plus-fixed-fee/level-of-effort task order for vulnerability analysis and audit support for the SPAWAR Systems Center Atlantic’s CSSP.  Agency Report (AR), Tab 2, RFP (conformed), at 2;[1] Contracting Officer’s Statement/Memorandum of Law (COS/MOL) at 1.  The RFP contemplated a 1-year base period of performance and two 1-year option periods.  RFP at 4. 

The RFP stated that a task order would be issued to the offeror whose proposal was determined to provide the best value to the government, considering technical capability and cost/price.  Id. at 95.  The RFP advised offerors that the technical capability factor was significantly more important than the cost/price factor.  Id.

The RFP stated that the government would evaluate each offeror’s (prime contractor and significant subcontractors) technical capability based on corporate experience.  Id. at 96.  Significant subcontractors were defined as a subcontractor or intercompany work agreement team member that will be performing at least 20 percent of the total proposed labor hours.  Id. at 88.  The RFP instructed offerors to complete ‟reference information sheets” to submit data on at least one but no more than five current, relevant contracts or task orders performed by the offeror and each proposed significant subcontractor.[2]  Id. at 88-89.  The RFP stated that if an offeror failed to include the minimum number of current and relevant contract references for both the prime and each significant subcontractor, the proposal would be rated unacceptable under the technical capability factor, rejected, and ineligible for award.  Id. at 97-98.

The technical capability factor consisted of three subfactors:  (1) demonstrating experience developing customized Security Incident and Event Management (SIEM) tools; (2) demonstrating a minimum of two examples of the offeror’s experience supporting collaboration between Department of Defense (DOD) CSSPs and DOD Cyber Red teams (supporting collaboration subfactor),[3] and (3) demonstrating experience developing insider threat programs for DOD CSSP requirements in accordance with DOD Directive 5205.16.  Id. at 96-97.  The RFP stated that the first subfactor was significantly more important than the other two subfactors, and that the second subfactor was more important than the third.  Id. at 97.

With respect to the supporting collaboration subfactor, the RFP required offerors to provide the following in their examples of supporting collaboration between DOD CSSPs and DOD Cyber Red teams:

  1. Identification of the specific accredited DoD Cyber Red Team and CSSP involved[]
  2. An overview of the specific test case (include what was tested:  people, processes or technology)
  3. A description of how the red team established deconfliction processes and procedures and subsequently executed the test
  4. A description of the result of the testing.  The description shall include, if applicable, any lessons learned or resultant changes to the CSSP which may include changes to technology, processes or personal. 

Id. at 97.

The RFP stated that each offeror’s cost proposal would be evaluated using price analysis and cost realism analysis.  Id. at 98.  The RFP stated that price analysis would be used to determine if the offered price is fair and reasonable, without evaluating the offeror’s separate cost elements.  Id.  The RFP also stated that the cost proposal would be evaluated for realism--more specifically, to assess the degree to which:  (1) the offeror’s proposed labor rates reflect the ability to provide the services at the offered cost; and (2) the proposed indirect rates are realistic in the context of the offeror’s business model/situation, historical rates, and any verifiable pricing information.  Id.  To that end, the RFP required offerors to submit copies of correspondence from the Defense Contract Audit Agency (DCAA) or the Defense Contract Management Agency (DCMA), and attachments, regarding the most recent approval of rates and/or systems, such as forward pricing rate agreements, provisional billing rates, and accounting systems approval, if applicable.  Id. at 79.  The RFP also required offerors to submit any updated forward pricing information that had been submitted to DCAA or DCMA for review.  Id.

The Navy received four proposals, including proposals from NSSPlus and AbleVets.  AR, Tab 4, Business Clearance Memorandum, at 11.  The SEB identified strengths and weaknesses in the offerors’ proposals, and assigned adjectival ratings, as follows:[4]

 

NSSPlus

AbleVets

TECHNICAL CAPABILITY

OUTSTANDING

OUTSTANDING

Demonstrating Experience Developing Customized SIEM Tools

Outstanding

Outstanding

Demonstrating Experience Supporting Collaboration Between DOD CSSPs and DOD Cyber Red Teams

Good

Good

Demonstrating Experience Developing Insider Threat Programs for DOD CSSP requirements in accordance with DOD Directive 5205.16

Good

Good

TOTAL EVALUATED COST

$72,080,207

$64,419,759


Id. at 12, 38.

NSSPlus submitted one reference information sheet with its proposal addressing its experience as the prime contractor on the incumbent contract.  See AR, Tab 8, NSSPlus’ Technical Proposal, at 1-2.  The SEB identified one strength and one weakness in NSSPlus’ proposal, and assigned NSSPlus’ proposal a good rating under the supporting collaboration subfactor.  AR, Tab 3, SEB Report, at 17.  With respect to the weakness, the SEB concluded that NSSPlus’ proposal did not describe or demonstrate familiarity with the required deconfliction processes.  Id.  The SEB noted that the proposal vaguely referenced blue team reporting to U.S. Cyber Command,[5] but concluded that this was not the required notification for deconfliction of red team activity.  Id.

AbleVets submitted two reference information sheets with its proposal--one addressing its experience on a contract performed for the Department of Veterans Affairs and one addressing the experience of its significant subcontractor under the incumbent contract.  See AR, Tab 11, AbleVets’ Proposal, at 1‑2, 5-6.  As relevant here, the reference information sheet for the significant subcontractor identified the performance period for work performed on the incumbent contract as July 10, 2017 to March 10, 2018.  Id. at 6.  AbleVets submitted two examples relating to the reference information sheet concerning the performance of its significant subcontractor under the incumbent contract.  AbleVets’ proposal stated that the first example was performed during the third and fourth quarters of 2017 and that the second example was performed during the second quarter of 2017.  Id. at 8-9.  The SEB accepted AbleVets’ two examples and identified two strengths in AbleVets’ proposal related to the experience of the firm’s subcontractor.  AR, Tab 3, SEB Report, at 8 (citing AR, Tab 11, AbleVets’ Proposal, at 8-9).  The SEB assigned AbleVets’ proposal a good rating under the subfactor.  Id.

The Navy evaluated NSSPlus’ and AbleVets’ cost proposals for realism.  The agency reviewed the offerors’ proposed labor categories to ensure that they were consistent with the solicitation requirements and reviewed supporting information provided for the labor rates.  See e.g., AR, Tab 4, Business Clearance Memorandum, at 21, 30.  The agency concluded that NSSPlus did not adequately support all of its labor rates and adjusted some of them upward.  Id. at 30-31.  The agency also concluded that some of the labor rates for AbleVets’ proposed subcontractors were not supported and also adjusted them upward.  Id. at 29. 

With respect to indirect rates, NSSPlus proposed lower rates than the provisional billing rates that it provided with its cost proposal.  Id. at 31.  Because NSSPlus did not provide its calculations for the lower indirect rates, the Navy was unable to rely on the rates and adjusted the rates to the provisional billing rates.  Id.  AbleVets proposed indirect rates in accordance with its 2018 forward pricing rate proposal and provided its supporting data.  Id. at 21; AR, Tab 11, AbleVets’ Proposal, at 14, 33.  Because AbleVets proposed indirect rates for a location not included in its forward pricing rate proposal, the Navy evaluated the supporting documentation and concluded that the rates were calculated using the same methodology that AbleVets used to calculate its forward pricing rate proposal.  AR, Tab 4, Business Clearance Memorandum, at 21.  The Navy accepted AbleVets’ proposed indirect rates, but adjusted some of the subcontractor rates.  Id.

As a result of the cost realism analysis, the Navy adjusted NSSPlus’ proposed costs upward by $3,443,302, to $72,080,207.  Id. at 19.  The Navy adjusted AbleVets’ proposed costs upward by $45,590, to $64,419,759.  Id.

The source selection authority (SSA) reviewed the SEB report and cost/price evaluations before conducting the tradeoff analysis.  AR, Tab 4, Business Clearance Memorandum, at 38.  With respect to the first and most important technical subfactor, the SSA concluded that, although both NSSPlus’ and AbleVets’ proposals received an outstanding rating, AbleVets’ additional strength based on its experience with the development of a health monitoring system provided additional merit.  Id. at 39.  With respect to the second subfactor, supporting collaboration, the SSA concluded that AbleVets’ experience in supporting collaboration between DOD CSSPs and DOD cyber red teams was more valuable than NSSPlus’ experience, given the two strengths assigned to AbleVets’ proposal as compared to the one strength and one weakness assigned to NSSPlus’ proposal.  Id. at 40.  With respect to the third subfactor, the SSA concluded that, although both NSSPlus’ and AbleVets’ proposals received strengths, AbleVets’ proposal received an additional, ‟standout” strength that rendered AbleVets’ experience to be more valuable.  Id.  As a result, the SSA determined that AbleVets was the technically superior offeror and represented the best value to the government in light of NSSPlus’ higher price and selected AbleVets for award.  Id. at 41.

After a debriefing, NSSPlus protested to our Office.[6]

DISCUSSION

NSSPlus challenges the evaluation of proposals under the supporting collaboration subfactor of the technical capability factor, the realism of AbleVets’ proposed costs, and the best-value tradeoff analysis.  We have considered all of NSSPlus’ arguments, and although we address only a portion of the arguments, we find no basis to sustain the protest.

Supporting Collaboration Subfactor

NSSPlus argues that the Navy misevaluated AbleVets’ proposal under the supporting collaboration subfactor of the technical capability factor.  NSSPlus contends that the Navy erroneously concluded that AbleVets provided two current, relevant examples of supporting DOD CSSPs and DOD cyber red teams.  Protester Comments at 3.  In this regard, NSSPlus argues that one of the examples AbleVets provided of its corporate experience was performed outside the contract period of performance listed on the reference information sheet and therefore was invalid.  Id. at 5.  NSSPlus states that the Navy excluded one of its examples because it was performed outside the period of performance identified in the reference information sheet and therefore the Navy also must exclude AbleVets’ example.  Id. at 7.

The Navy states that, although AbleVets’ proposal indicated that the example was performed during the second quarter of 2017, the SEB chair was involved in the work performed and knew that the work actually occurred in August 2017 and thus was performed within the contract period of performance set forth in the reference information sheet and properly considered.[7]  Supp. COS/MOL at 8, 10.  The Navy also states that, under these circumstances, the agency may reasonably rely on personal knowledge with respect to the date the work was performed.  Id. at 11.

In reviewing protests of awards in a task order competition, we do not reevaluate proposals but examine the record to determine whether the evaluation and source selection decision are reasonable and consistent with the solicitation’s evaluation criteria, and applicable procurement laws and regulations.  Vector Planning & Servs., Inc., B-415005, Nov. 8, 2017, 2017 CPD ¶ 360 at 5.  A protester’s disagreement with the agency’s judgment, by itself, is not sufficient to establish that an agency acted unreasonably.  Id.

We find no basis to object to the Navy’s evaluation of AbleVets’ proposal under the supporting collaboration subfactor.  The SEB chairperson stated that he participated in the event related to AbleVets’ second example and therefore had personal knowledge that the event occurred in August 2017 and therefore was within the time frame stated in the reference information sheet.  AR, Tab 13, Decl. of SEB Chair, at 3.  The SEB chair also explained that the event was originally scheduled for April 2017, but was rescheduled several times and ultimately conducted in August 2017.  Id. at 4-5.  Our decisions have explained that an agency may consider experience information known to the agency and not found in the firm’s proposal.  See, e.g., SNAP, Inc., B-409609, B‑409609.3, June 20, 2014, 2014 CPD ¶ 187 at 8; Nuclear Prod. Partners, LLC; Integrated Nuclear Prod. Sols. LLC, B-407948 et al., Apr. 29, 2013, 2013 CPD ¶ 112 at 20 (no logical basis to preclude agency from considering ‟close at hand” information in evaluating an offeror’s corporate experience).  Here, the Navy reasonably used the personal knowledge of the SEB chair to determine that AbleVets’ second example occurred within the time frame identified in the reference information sheet.  Therefore, we find no basis to sustain the protest.[8]

NSSPlus also argues that the solicitation contained a latent ambiguity with respect to offerors providing a description of how the red team established deconfliction processes and procedures under the supporting collaboration subfactor of the technical capability factor.  Protester Comments at 8-14.  NSSPlus contends that, had the RFP been clearer with respect to deconfliction, it would have provided additional information in its proposal that would have resulted in a strength ‟over and above” those assigned to AbleVets’ proposal and would not have been assessed a weakness.  Id. at 14.

We need not address this protest allegation.  Even if we agreed with NSSPlus that the solicitation contained a latent ambiguity, the protester has not adequately shown that it would be prejudiced by the alleged error.  Prejudice is an essential element to every viable protest, and where an agency’s improper actions did not affect the protester’s chances of receiving award, there is no basis for sustaining the protest.  STG, Inc., B‑415580.4, B-415580.5, July 5, 2018, 2018 CPD ¶ 232 at 8. 

Here, because we find no merit to the protester’s challenge to the agency’s evaluation of AbleVets’ proposal under the supporting collaboration subfactor and NSSPlus has not challenged the evaluation of proposals under the most important subfactor,[9] the record shows that AbleVets’ proposal would still be considered technically superior and lower-priced than NSSPlus’ proposal.  In this regard, with respect to the first and most important technical subfactor, the SSA concluded that AbleVets’ additional strength based on its experience with the development of a health monitoring system provided additional merit.  AR, Tab 4, Business Clearance Memorandum, at 39.  With respect to the third subfactor, the SSA concluded that AbleVets’ proposal received an additional, ‟standout” strength that rendered AbleVets’ experience to be more valuable.  Id. at 40.  As a result, the SSA determined that AbleVets was the technically superior offeror and represented the best value to the government in light of NSSPlus’ higher price and selected AbleVets for award.  Id. at 41.

Therefore, we see no reasonable possibility that NSSPlus would suffer any prejudice as a consequence of the alleged ambiguity.  See STG, Inc., supra (protester not prejudiced by alleged evaluation errors where its proposal would remain lower technically rated and higher priced).

Cost Realism

NSSPlus contends that the Navy’s use of AbleVets’ forward pricing rate proposal to conduct the cost realism analysis of AbleVets’ proposed costs is unreasonable.  Protester Comments at 18.  NSSPlus also contends that the agency engaged in disparate treatment through its adjustment of offerors’ cost/price proposals.  Id. at 17.  NSSPlus argues that the agency considered the baseline cost proposals for AbleVets and NSSPlus on an equal basis, even though AbleVets’ proposed rates were based on a forward pricing rate proposal that was not audited by DCAA, whereas NSSPlus’ proposed rates were based on its established provisional billing rates.  Id.  In this regard, the protester maintains that its provisional billing rates are significantly more reliable than the information in the forward pricing rate proposal that AbleVets submitted.  Id. at 18.

The Navy states that it conducted a proper cost realism analysis of AbleVets’ proposed costs and did not engage in disparate treatment.  Supp. COS/MOL at 24.  The Navy states that the differences in cost adjustments reflect each offeror’s substantiation of their costs.  COS/MOL at 35-36.  The Navy states that AbleVets supported its direct and indirect rates, and where its subcontractors did not support labor rates, the agency used labor rates for each labor category that it calculated based on labor rates from its independent government estimate, offerors’ proposals, and proposals from recent, similar procurements.  See id. at 35-36 (quoting AR, Tab 4, Business Clearance Memorandum, at 17). 

When an agency evaluates proposals for the award of a cost-reimbursement contract or task order, an offeror’s costs are not dispositive because, regardless of the costs proposed, the government is bound to pay the contractor its actual and allowable costs.  Federal Acquisition Regulations (FAR) §§ 16.505(b)(3); 15.305(a)(1); Exelis Sys. Corp., B-407673 et al., Jan. 22, 2013, 2013 CPD ¶ 54 at 7 (discussing FAR part 15 cost realism standards in a FAR part 16 task order procurement).  Consequently, an agency must perform a cost realism analysis to determine the extent to which an offeror’s proposed costs are realistic for the work to be performed.  FAR §§ 15.404-1(d)(1), 16.505(b)(3); Imagine One Tech. & Mgmt., Ltd., B-412860.4, B-412860.5, Dec, 9, 2016, 2016 CPD ¶ 360 at 14.  An agency’s cost realism analysis requires the exercise of informed judgment, and we review an agency’s judgment in this area only to see that the cost realism analysis was reasonably based and not arbitrary.  Engility Corp., B‑413120.3 et al., Feb. 14, 2017, 2017 CPD ¶ 70 at 18.  The analysis need not achieve scientific certainty; rather, the methodology employed must be reasonably adequate and provide some measure of confidence that the agency’s conclusions about the most probable costs for an offeror’s proposal are reasonable and realistic in view of other cost information reasonably available to the agency at the time of its evaluation.  Id. at 18-19.

The record shows that the Navy’s cost realism analysis was reasonable.  The Navy’s cost analyst reviewed AbleVets’ direct labor rates, noting that the offeror developed labor rates using payroll data and salary survey data, which it provided in its proposal, and found them realistic.  AR, Tab 4, Business Clearance Memorandum, at 21.  The Navy reviewed AbleVets’ indirect rates and analyzed the differences between the proposed rates and those provided in its forward pricing rate proposal.  Id.  In conducting its analysis, the Navy relied on the forward pricing rate proposal and the supporting documentation AbleVets provided.  AR, Tab 19, Decl. of Cost Analyst, at 2.  The Navy also reviewed the indirect rates proposed by AbleVets’ proposed subcontractors and adjusted the rates where they were unsupported.  See, e.g., AR, Tab 4, Business Clearance Memorandum, at 23, 29.  NSSPlus has identified no specific aspect of AbleVets’ proposed costs was unrealistic; instead, NSSPlus expresses disagreement with the Navy’s conclusion that AbleVets’ lower prices were realistic. 

Additionally, NSSPlus has not demonstrated that the agency engaged in disparate treatment.  The record shows that, where each offeror provided supporting documentation, the Navy accepted the proposed costs.  See e.g., id. at 31.  Based on the record before us, we find no basis to conclude that the agency’s analysis was unreasonable.  Accordingly, we deny this protest ground.

Tradeoff Decision

NSSPlus also argues that the Navy’s best-value tradeoff decision was unreasonable.  Protester Comments at 19.  However, this argument is predicated on NSSPlus’ contentions that the agency erred in its evaluation of proposals under the supporting collaboration subfactor of the technical capability factor and conducted a faulty cost realism analysis.  Id.  As discussed above, there is no merit in these contentions.  Therefore, on this record, we find no basis to question the agency’s best-value tradeoff decision.  See SupplyCore, Inc., B-411648.2, B-411648.3, Feb. 21, 2017, 2017 CPD ¶ 72 at 17.

The protest is denied.

Thomas H. Armstrong
General Counsel



[1] In several agency report exhibits, the original page numbering for the documents is different from numbers assigned to the same documents by the agency.  Where documents in the agency report have differing numbering, we cite to the numbers the agency assigned to the documents.

[2] The RFP defined ‟current” as having been performed within three years of the date the RFP was issued; ‟relevant” was defined as a contract and/or task order similar to the requirements of the RFP.  RFP at 88. 

[3] A ‟DOD Cyber Red team” is a National Security Agency and U.S. Strategic Command certified team that challenges/assesses a DOD organization’s cyber (and sometimes physical) security by assuming an adversarial role and conducting covert and/or overt cyberattacks to evaluate network defenses and identify vulnerabilities/weaknesses.  AR, Tab 7, Decl. of Selection Evaluation Board (SEB) Chair, at 3.

[4] The RFP stated that an outstanding rating means that the proposal indicates exceptional experience with the solicitation’s evaluation requirements and contains multiple strengths, and that the risk of unsuccessful performance is very low.  RFP at 96.  A good rating means that the proposal indicates thorough experience with the solicitation’s evaluation requirements and contains at least one strength, and that risk of unsuccessful performance is low.  Id.

[5] A ‟blue team” refers to a DOD accredited CSSP.  AR, Tab 7, Decl. of SEB Chair, at 3.

[6] The task order at issue is valued in excess of $25 million.  Accordingly, our Office has jurisdiction to consider NSSPlus’ protest.  10 U.S.C. § 2304c(e)(1)(B).

[7] The Navy also states that, because NSSPlus was involved in the event, the protester was aware that the time frame cited in AbleVets’ proposal was incorrect.  Supp. COS/MOL at 15 n.8.

[8] In its supplemental comments, NSSPlus argues that the record provides no evidence that AbleVets’ significant subcontractor actually participated during the event in question.  Protester Supp. Comments at 6 n.1.  Under our Bid Protest Regulations, protests based on other than solicitation improprieties must be filed within 10 days of when the protester knew or should have known their basis.  4 C.F.R. § 21.2(a)(2).  Here, because NSSPlus knew on October 1, 2018, that AbleVets used that event--in which NSSPlus participated--as an example, but did not challenge the significant subcontractor’s participation until October 18, we dismiss the protest ground as untimely.  Id.; see Dynamic Security Concepts, Inc., B-416013, B-416013.2, May 15, 2018, 2018 CPD ¶ 186 at 5.

[9] In its initial protest, NSSPlus challenged the Navy’s evaluation of proposals under the least important subfactor, Protest at 12, NSSPlus subsequently withdrew the protest grounds.  Comments at 1.

Jan 17, 2019

Jan 16, 2019

Jan 15, 2019

Looking for more? Browse all our products here