BEAT, LLC

Decision

Matter of:  BEAT, LLC

File:  B-418235; B-418235.2

Date:  January 30, 2020

DIGEST

1.  Protest that the agency unreasonably evaluated protester’s proposal is denied where the record shows that the evaluation was consistent with the solicitation’s evaluation criteria.

2.  Protest that the agency should have referred a nonresponsibility determination to the Small Business Administration under certificate of competency procedures is denied where the agency did not effectively evaluate the protester as nonresponsible but rather simply identified aspects of the protester’s proposal as weak under the evaluation criteria.

3.  Protest challenging the cost realism evaluation is denied where the record shows that agency reasonably determined that protester’s estimated costs were unrealistically low.

Business Enabled Acquisition & Technology, LLC (BEAT), of San Antonio, Texas, protests the award of a task order contract to Sentar, LLC, of Baltimore, Maryland, under request for proposals (RFP) No. N6523619R3507, issued by the Department of the Navy, Naval Information Warfare Center Atlantic (NIWC), for cybersecurity risk management operations support.  BEAT alleges that the Navy unreasonably evaluated its proposal, failed to refer a nonresponsibility determination to the Small Business Administration (SBA) under certificate of competency procedures, and improperly adjusted its proposed costs.

We deny the protest.

BACKGROUND

On April 3, 2019, the Navy issued the RFP to procure cybersecurity risk management operations support services for the Defense Health Agency, Information Services Division.[1]  Combined Contracting Officer’s Statement and Memorandum of Law (COS/MOL) at 2; AR, Tab 2, RFP at 8.  The RFP was issued against the Navy’s SeaPort Next-Generation (NX-G) multiple-award, indefinite-delivery, indefinite‑quantity (IDIQ) contract.  COS/MOL at 3.  The RFP contemplated the award of a performance based cost-plus-fixed-fee, level-of-effort, and cost-reimbursement task order to be performed over a 1‑year base period and three 1-year option periods.  AR, Tab 2, RFP at 4-7, 86.

Award would be made on a best-value tradeoff basis, considering cost and non-cost factors.  AR, Tab 2, RFP at 96.  Non-cost factors included gate criteria, technical capability, and management plan.  Id.  The gate criteria assessed, on a pass or fail basis, whether each offeror had at least one year experience collecting and reporting required information.  Id. at 90, 96.  Proposals receiving a passing score for the gate criteria factor were evaluated under the technical capability and management plan factors.  Id. at 96-97.  The tradeoff decision would consider the technical capability, management plan, and cost factors; in making the tradeoff decision, the RFP specified that the non-cost factors were significantly more important than the cost factor, and that the technical capability factor was more important than the management plan factor.

The technical capability factor (i.e., factor B) required the agency to assess each offeror’s corporate experience in an enterprise‑level environment under four subfactors.  AR, Tab 2, RFP at 97-98.  Subfactor B1 required offerors to demonstrate experience developing, maintaining, and updating risk posture assessments; providing oversight and compliance reporting for the Cybersecurity Vulnerability Management program; and providing risk mitigation strategies relative to the assessments (greater than 50,000 server and workstation assets).  Id. at 98.  Under subfactor B2, the agency would evaluate each offeror’s experience developing risk management framework (RMF) documentation.  Id.  Under subfactor B3, the agency would evaluate each offeror’s experience maintaining and enhancing security postures using a variety of software applications.  Id.  Under subfactor B4, the agency would evaluate each offeror’s experience analyzing and detecting cyber security events.  Id.  The RFP specified that subfactors B1 and B2 were of equal importance, and were significantly more important than subfactors B3 and B4.  Id. at 98.

For the cost factor, each offeror was required to submit its costs using the labor categories and labor hours prescribed in the pricing model.  AR, Tab 2, RFP at 99.  The Navy would assess whether each offeror’s costs were realistic for the work to be performed.  Id.  The RFP advised that proposed costs may be adjusted based on the results of the cost realism evaluation.  Id.

Seven offerors, including BEAT and Sentar, submitted proposals by May 7, 2019, the close of the solicitation period.  AR, Tab 5, Business Clearance Memorandum (BCM), at 14.  The Navy’s evaluation produced the following relevant results:

	BEAT	Sentar
Gate Criteria	Acceptable	Acceptable
Technical Capability	Acceptable	Good
Subfactor B1	Marginal	Outstanding
Subfactor B2	Acceptable	Outstanding
Subfactor B3	Acceptable	Good
Subfactor B4	Outstanding	Acceptable
Management Plan	Acceptable	Good
Total Proposed Cost	$123,984,682	$164,439,205
Total Evaluated Cost	$141,418,972	$165,079,879

Id. at 14, 17.  Based on the evaluation results, the source selection authority (SSA) identified Sentar’s proposal as offering the best value to the agency.  When comparing BEAT’s and Sentar’s proposals, the SSA explained that Sentar’s proposal offered the better value because, despite being higher-priced, the additional benefits offered by Sentar’s proposal warranted the cost premium.  Id. at 45-51.  Specifically, the SSA noted that Sentar offered “thorough experience” in providing risk posture assessments and developing RMF, the two most important technical capability subfactors, and a stronger staffing plan under the management plan factor.  Id.  Following its debriefing, BEAT filed this protest with our Office. [2]

DISCUSSION

BEAT raises various challenges to the Navy’s evaluation and source selection decision.  We have reviewed all of them and find no basis to sustain the protest.  We discuss BEAT’s principal allegations below, but note at the outset that, in reviewing protests challenging an agency’s evaluation of proposals, our Office does not reevaluate proposals or substitute our judgment for that of the agency; rather, we review the record to determine whether the agency’s evaluation was reasonable and consistent with the solicitation’s evaluation criteria, as well as applicable statutes and regulations.  AT&T Corp., B‑414886 et al., Oct. 5, 2017, 2017 CPD ¶ 330 at 6.

Evaluation of BEAT’s Technical Proposal

BEAT challenges the agency’s evaluation of its proposal under subfactor B1 of the technical capability factor.  Protester’s Comments and Supp. Protest at 3.  BEAT argues that the assignment of a marginal rating was unreasonable because, contrary to the evaluation, its proposal demonstrated experience providing risk posture assessments.[3]  Id. at 3-8.  The Navy responds that BEAT’s proposal lacked details substantiating its experience or relating its experience to the solicitation requirements.  COS/MOL at 25‑34.

As noted above, subfactor B1 required offerors to demonstrate experience developing, maintaining, and updating risk posture assessments; providing oversight and compliance reporting for the Cybersecurity Vulnerability Management program; and providing risk mitigation strategies relative to the assessments within an enterprise-level environment (i.e., greater than 50,000 server and workstation assets).  The Navy assigned BEAT’s proposal one significant weakness under this subfactor; the Navy determined that BEAT’s proposal failed to demonstrate detailed experience with developing, maintaining, or updating risk posture assessments, or detailed experience with providing risk mitigation strategies relative to the assessments.  AR, Tab 3, SEB Report, at 9-10.  The Navy specifically noted that, while BEAT’s proposal referenced duties relevant to performing risk posture assessments and providing risk mitigation strategies, BEAT nevertheless failed to describe actual instances (i.e., what the agency referred to as amplifying details) where it performed those functions.  Id. at 10.

Based on our review of the record, we find the agency’s evaluation to be reasonable because BEAT’s proposal does not describe actual instances where it provided risk posture assessments.  BEAT’s proposal generally references risk posture assessment functions it performed on prior contracts.  For example, one of BEAT’s referenced contracts shows that it provided supporting documents for risk assessment, used agency guidance to implement compliance tools/policies to conduct threat and vulnerability assessments, and, upon request, performed vulnerability audits and recommended risk mitigation strategies.  AR, Tab 10, BEAT’s Proposal, at 8-9.  Another of BEAT’s referenced contracts shows how it performed vulnerability scanning and scans of infrastructure support.  Id. at 12.  BEAT’s other referenced contract shows how it provided program oversight, risk posture reporting, compliance review, and risk mitigation strategy.  Id. at 20.  Critically important, nowhere does BEAT describe specific threats that it identified or specific policies that it recommended or implemented.  Thus, we find the agency’s evaluation reasonable because, while BEAT may have broadly explained its risk posture assessment experience, it did not describe any particular instances of this experience.

Further, although BEAT argues that it elaborated on its risk posture assessment experience when it described how it led a government agency through the RMF process, BEAT’s proposal does not describe how it performed risk posture assessment functions as part of that process; instead, BEAT’s proposal shows that it led a government agency through RMF steps one through six, including maintenance of the current network and systems certification.  AR, Tab 10, BEAT’s Proposal, at 9.  Significantly, this experience does not describe how BEAT incorporated vulnerability management data or facilitated the risk management process as part of the RMF.  Moreover, while BEAT argues that the Navy should have recognized that RMF experience necessarily included conducting risk posture assessments, it was BEAT’s responsibility to demonstrate precisely how its experience satisfied or exceeded the RFP’s requirements.  See IPNetwork Solutions, Inc., et al., B‑408232 et al., July 25, 2013, 2013 CPD ¶ 187 at 8 (“Because an agency’s evaluation is dependent on the information provided in a proposal, it is the offeror’s responsibility to submit an adequately written proposal for the agency to evaluate.”).  Accordingly, we deny this allegation because our review confirms that the agency’s evaluation was consistent with the information detailed in BEAT’s proposal.[4]

BEAT also argues that the Navy should have assigned its proposal a rating higher than marginal under subfactor B1 (experience providing risk posture assessments) because the Navy is very familiar with the firm’s and its subcontractor’s experience in this area since the firm and its subcontractor have provided these services for the agency on prior contracts.  Protest at 18-19.  We deny this protest allegation because an agency is not required to import information from other sources that was not provided in the proposal.  Cybermedia Techs., Inc. d/b/a CTEC, B‑413156.25, Apr. 6, 2017, 2017 CPD ¶ 116 at  5, n.2.  Instead, it was BEAT’s responsibility to articulate its experience with sufficient detail to allow for meaningful review.  Id.

Certificate of Competency Procedures

BEAT argues that the Navy effectively made a nonresponsibility determination when assigning its proposal a marginal rating for subfactor B1 because, under that subfactor, the agency evaluated a traditional responsibility criterion (i.e., experience).  Protester’s Comments and Supp. Protest at 9-12.  Since it is a small business, BEAT argues that the Navy should have referred the matter to the SBA under its certificate of competency (COC) procedures.  The Navy responds that referral under COC procedures was unnecessary because it did not make a nonresponsibility determination but rather comparatively evaluated BEAT’s proposal.  COS/MOL at 37‑40.

Contracting officers evaluate prospective contractors to determine their responsibility, or, their capability to perform the work.  Federal Acquisition Regulation (FAR) § 9.103(b).  Relevant to the instant protest, COC referrals to SBA are required where contracting officers refuse to consider a small business concern for award after evaluating the concern’s offer on a non­‑comparative basis (e.g., pass or fail) under a traditional responsibility type evaluation factor.  13 C.F.R. § 125.5(a)(2)(ii). 

Contrary to the protester’s position, we do not find that the Navy refused to consider BEAT’s proposal for award.  The Navy included BEAT’s proposal in its tradeoff analysis and compared the quality of BEAT’s proposal against the quality of the other offerors’ proposals.  AR, Tab 5, BCM, at 45.  Additionally, the Navy compared BEAT’s proposal against Sentar’s proposal under each of the technical capability and management plan subfactors.  Id. at 45-49.  While BEAT may assert that the Navy rated its proposal on a pass or fail basis because the marginal rating curtailed its chance of receiving award, an agency’s determination that a proposal is weak relative to the other offerors does not amount to a nonresponsibility determination.  Compare B & W Service Indus., Inc., B‑224392.2, Oct. 2, 1986, 86-2 CPD ¶ 384 at 4 (agency was not required to refer a proposal under COC procedures when it determined that the proposal was weak compared to other offerors under the evaluation factors) with Phil Howry Co., B‑291402.3, B-291402.4, Feb. 6, 2003, 2003 CPD ¶ 33 at 5-6 (agency was required to refer a proposal under COC procedures when it refused to consider proposal for award because the offeror was evaluated as not possessing the requisite experience).  Accordingly, we deny this allegation because the Navy did not make a nonresponsibility determination and was not required to refer BEAT’s proposal under COC procedures.

Cost Realism

BEAT argues that the Navy unreasonably evaluated its proposed costs.  BEAT primarily asserts that the Navy should not have upwardly adjusted its proposed costs to account for subcontractor administration and material handling costs.  Protest at 20-21.  The Navy responds that the upward adjustment was reasonable because BEAT’s estimated costs did not account for those allowable costs.  COS/MOL at 48-49.

When an agency evaluates a proposal for award of a cost-reimbursement contract, an offeror’s proposed costs are not dispositive because, regardless of the costs proposed, the government is bound to pay the contractor its actual and allowable costs.  FAR §§ 15.305(a)(1), 15.404-1(d).  Consequently, an agency must perform a cost realism analysis to determine the extent to which an offeror’s proposed costs are realistic for the work to be performed.  FAR § 15.404-1(d)(1).  An agency is not required to conduct an in-depth cost analysis, or to verify each and every item in assessing cost realism; rather, the evaluation requires the exercise of informed judgment by the contracting agency.  Tyonek Global Servs., LLC; Depot Aviation Sols., LLC, B‑417188.2 et al., Oct. 4, 2019, 2019 CPD ¶ 354 at 19.  Because the agency is in the best position to make the cost realism determination, our review is limited to determining whether its cost evaluation was reasonably based and not arbitrary.  ABSG Consulting, Inc., B‑407956, B‑407956.2, Apr. 18, 2013, 2013 CPD ¶ 111 at 7. 

Under this standard, we have reviewed the Navy’s cost realism evaluation, and see no basis to conclude that the upward adjustment here was unreasonable.  In its pricing model, BEAT proposed to recover subcontractor administration and materials handling costs using a specific indirect rate; however, BEAT’s pricing model included a [DELETED] percent rate, indicating that BEAT would recover these costs through an alternate method.  AR, Tab 6, BEAT’s Cost Proposal, at 122.  Indeed, BEAT’s cost narrative suggested that BEAT would recover subcontractor administration and materials handling costs through the general and administrative (G&A) rate.  Id. at 8 (“BEAT does not add a [DELETED].”).

The record shows that the Navy contacted the Defense Contract Audit Agency (DCAA) regarding BEAT’s proposed costs; DCAA explained that BEAT’s G&A rate does not incorporate subcontractor administration or materials handling as part of its G&A rate.  AR, Tab 5, BCM, at 31; Tab 12, Decl. of Cost Analyst, at 2‑3.  Thus, based on the information available, the Navy reasonably adjusted BEAT’s proposed costs upward because its estimated costs did not capture the subcontractor administration or materials handling costs through either a specific indirect rate or through the G&A rate.

BEAT also argues the Navy improperly adjusted its subcontractor and materials handling costs because those costs were capped in its proposal.  We deny that allegation.  According to BEAT, subcontractor and materials handling costs were capped at [DELETED] costs because its proposal stated that BEAT “does not add a [DELETED].”  See Protester’s Comments and Supp. Protest at 15.  We do not find that position persuasive.  The protester focuses on only half of the sentence in its proposal and ignores that the entirety of the sentence; specifically, the entire sentence provides that the proposed cost is recovered through the G&A rate (i.e., “BEAT does not add a [DELETED]”).  AR, Tab 6, BEAT’s Cost Proposal, at 6.  We also disagree that BEAT’s use of a [DELETED] percent indirect rate communicated a cost cap because using that rate, without any accompanying statement, does not unequivocally convey that intention; rather, it simply shows that BEAT did not seek to recover these costs by applying a specific indirect rate.  In any event, we consider it BEAT’s responsibility to convey clearly its intention to cap its costs as part of its duty to submit a well‑written proposal.  See Mission 1st Grp., Inc., B‑414378.9, Feb. 12, 2019, 2019 CPD ¶ 80 at 4-5 (agency was not required to infer protester’s proposed costs from an inadequately detailed proposal).  Accordingly, we deny this protest allegation.

BEAT also complains that the amount of the Navy’s upward adjustment was unreasonable.  The record shows that the Navy captured BEAT’s subcontractor administration and materials handling costs by applying BEAT’s G&A rate of [DELETED] percent to its other direct costs and subcontractor costs.  AR, Tab 5, BCM, at 31; Tab 12, Decl. of Cost Analyst, at 3.  This increased BEAT’s total proposed costs by $[DELETED] million.  Id.

In BEAT’s view, the adjustment was unreasonable because the Seaport NX-G contract contains a maximum pass-through rate of eight percent.  According to BEAT, this provision means that the Navy should have applied an eight percent indirect rate, as opposed to BEAT’s full G&A rate.  Protester’s Comments and Supp. Protest at 18.  Thus, BEAT argues that its total evaluated costs should have only been increased by approximately $[DELETED] million. Protester’s Supp. Comments at 19.

Significantly, BEAT raised this concern during its written debriefing when it inquired whether the Navy considered the maximum pass-through rate in conducting the cost realism analysis.  AR, Tab 9, BEAT’s Debriefing at 3.  Prior to responding (and before the filing of the instant protest), the agency recalculated BEAT’s estimated costs using the maximum pass-through rate, and determined that BEAT’s costs would be increased by $[DELETED] million (i.e., total cost of $132,987,240).  Id. at 4.  Based on that determination, the Navy responded to BEAT that “even if the government utilized the 8% pass through rate in the cost realism evaluation, the difference in the evaluated costs would not have affected the best value determination.”  Id.  As a result, we conclude that the Navy effectively reevaluated BEAT’s proposed costs using the maximum pass-through rate before the protest was filed, and determined that BEAT still did not offer the best value.

To the extent BEAT complains that the reevaluation was unreliable because it was performed as part of the debriefing and was not memorialized as part of the contemporaneous record in an amended source selection decision, we do not find the protester’s position persuasive.  See Protester’s Comments and Supp. Protest at 17-21.  First, we note that BEAT’s argument takes issue with the form of the agency’s reevaluation rather than the substantive determination that Sentar’s proposal represented the better value even with the additional $[DELETED] million price advantage.  We know of no requirement that an agency amend its source selection decision to memorialize a determination, which was documented in the written debriefing.

Second, and more importantly, we are not persuaded that the reevaluation was unreliable.  The SSA’s declaration shows that, after receiving BEAT’s debriefing question, she asked a cost analyst to perform a new evaluation of BEAT’s G&A rate accounting for the alleged maximum pass-through rate.  AR, Tab 11, Decl. of SSA at 1.  The SSA then assessed whether the cost savings made BEAT’s proposal the better value.  Id.  Although BEAT’s total evaluated costs decreased by $[DELETED] million, the SSA concluded that Sentar’s proposal represented the better value because it offered much more advantageous experience and a superior management plan.  Id.; AR, Tab 9, BEAT’s Written Debriefing, at 4.  Thus, the SSA’s reevaluation reflects the SSA’s fair and considered judgment, which are the hallmarks of a rational evaluation and source selection process.  See Simborg Development, Inc., B‑283538, Dec. 7, 1999, 2000 CPD ¶ 12 at 3 (“The protester’s position is based on the incorrect view that post-protest documentation can never constitute adequate support for an award decision.  While we generally accord greater weight to contemporaneous evidence, we will consider post‑protest explanations that provide a rationale for contemporaneous conclusions, so long as those explanations are credible and consistent with [the] contemporaneous record.”); cf. Native Resource Development Co., B‑409617.3, July 21, 2014, 2014 CPD ¶ 217 at 7 (GAO accords lesser weight to reevaluations prepared in the heat of the adversarial process because they do not represent the fair and considered judgment of the agency).  Accordingly, we deny this protest allegation because the Navy already determined that applying the maximum pass-through rate did not change its best-value tradeoff results.

Source Selection Decision

Finally, BEAT argues that the source selection decision was unreasonable because it was predicated on multiple errors in the evaluation process.  BEAT argues that the tradeoff analysis was flawed because the Navy unreasonably assigned BEAT’s proposal a marginal rating under subfactor B1, and because the Navy improperly conducted its cost realism evaluation.  Id. at 23.  We dismiss both of these allegations because they are derivative of the protester’s challenge to the agency’s technical and cost evaluation.  Safeguard Base Operations, LLC, B‑415588.6, B‑415588.7, Dec. 14, 2018, 2018 CPD ¶ 426 at 4 (derivative allegations do not establish independent bases of protest).

The protest is denied.

Thomas H. Armstrong
General Counsel

---