Inmarsat Government, Inc., of Reston, Virginia, protests the terms of request for proposals (RFP) No. HC1013-20-R-0001, which was issued by the Defense Information Systems Agency (DISA) to procure worldwide commercial broadband satellite services for the Department of the Navy, Military Sealift Command. This procurement is known as the Commercial Satellite Services Contract, or CSSC II, and is a follow-on contract to a similar contract, CSSC I, on which Inmarsat is the incumbent contractor. Inmarsat contends that the agency has failed to remediate the harm resulting from DISA's inadvertent release of Inmarsat's CSSC I pricing in the draft RFP for CSSC II. Inmarsat also asserts that the agency's decision to exclude past performance from the evaluation factors for this solicitation was unreasonable.
DOCUMENT FOR PUBLIC RELEASE
The decision issued on the date below was subject to a GAO Protective Order. This redacted version has been approved for public release.
Matter of: Inmarsat Government, Inc.
File: B-419583; B-419583.2
Date: May 21, 2021
Paul R. Hurst, Esq, Caitlin Conroy, Esq., Fred Geldon, Esq., and John William Toth, Esq., Steptoe & Johnson LLP, for the protester.
Anthony J. Balestreri, Esq., Defense Information Systems Agency, for the agency.
Stephanie B. Magnell, Esq., and Evan C. Williams, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision.
1. Protest that the agency failed to sufficiently mitigate the competitive harm from the inadvertent release of the protester’s incumbent pricing for its non-commercial solution is sustained, where the released pricing was detailed and recent, and the agency’s remedial efforts were minimal.
2. Protest that the agency failed to sufficiently mitigate the harm caused by the release of pricing for commercial satellite bandwidth transmission services is denied, as the inadvertently released pricing was limited in scope and not recent.
3. Protest that the agency unreasonably decided not to include past performance as an evaluation factor in the solicitation is denied, where the protester has not shown that the agency’s decision was unreasonable.
Inmarsat Government, Inc., of Reston, Virginia, protests the terms of request for proposals (RFP) No. HC1013-20-R-0001, which was issued by the Defense Information Systems Agency (DISA) to procure worldwide commercial broadband satellite services for the Department of the Navy, Military Sealift Command. This procurement is known as the Commercial Satellite Services Contract, or CSSC II, and is a follow-on contract to a similar contract, CSSC I, on which Inmarsat is the incumbent contractor. Inmarsat contends that the agency has failed to remediate the harm resulting from DISA’s inadvertent release of Inmarsat’s CSSC I pricing in the draft RFP for CSSC II. Inmarsat also asserts that the agency’s decision to exclude past performance from the evaluation factors for this solicitation was unreasonable.
We sustain the protest in part and deny the remainder.
On July 22, 2016, DISA awarded CSSC I, a 5-year indefinite-delivery, indefinite-quantity contract to Inmarsat after a 2015 protest with our Office. Through CSSC I and, subsequently CSSC II, the agency intends to acquire “worldwide commercial telecommunications services, to include satellite capacity in C, Ku, Ka, and/or X-band, for mobile and fixed satellite transceivers on manned and unmanned maritime, airborne, and ground platforms, as well as commercial teleport (CT) services, backhaul connectivity, monitoring and control, and operations.” RFP at 8. The infrastructure used by the CSSC includes mobile and fixed satellite transceivers on maritime, airborne and ground platforms, as well as CT services, backhaul connectivity, operations, monitoring, and control. Id.
This protest involves the inadvertent disclosure of pricing information contained in the draft RFP. By way of background, on the predecessor CSSC I contract Inmarsat provides both bandwidth and non-bandwidth services under a variety of detailed contract line item numbers (CLINs). In the CSSC II acquisition, the agency is again purchasing bandwidth and non-bandwidth services under a largely identical CLIN structure.
On September 21, 2020, DISA posted a pre-solicitation announcement for the CSSC II procurement to the federal procurement website at beta.SAM.gov. AR, Tab 14, Federal Business Opportunities Timestamp History at 2, 4. This pre-solicitation announcement included the draft solicitation. Id. at 2.
The draft solicitation included a Microsoft Excel workbook that offerors would use to calculate their fixed prices for commercial satellite services, including line-item pricing for non-bandwidth services and bandwidth services  AR, Tab 11, Draft RFP at 4; AR, Tab 11A, Draft RFP Pricing Workbook. The draft solicitation pricing workbook included 16 visible tabs (or worksheets) to assist offerors in calculating fixed line item prices for CSSC II, including 3 tabs with completion instructions, a pricing summary, a list of the non‑bandwidth CLIN prices, and 12 tabs corresponding to various bandwidths in different geographic coverage areas. Id. Also visible was a tab named “assumptions and methodologies,” which presented DISA’s method for preparing the independent government cost estimate (IGCE) for the CSSC II procurement. AR, Tab 11A, Draft RFP Pricing Workbook, Tab Assumptions and Methodologies. This worksheet lists many of the data sources for the IGCE, specifically listing Inmarsat’s CSSC I contract as a data source for the bandwidth pricing. Id., cell A33.
When DISA posted the draft solicitation, in addition posting the IGCE methodology the agency also inadvertently included Inmarsat’s incumbent pricing data that was used in formulating the IGCE. In addition to the 16 visible tabs, the draft solicitation pricing workbook also included 19 tabs that were not initially visible. These hidden tabs could be revealed by right-clicking on any visible tab name to access a drop down menu and selecting the “unhide” option from that menu. AR, Tab 11A, Draft RFP Pricing Workbook.
Within the 19 hidden tabs, there were 14 tabs corresponding to the historical prices and purchased volume of various transmission bandwidths. See id. Upon examination, many of these tabs appear to reveal some of Inmarsat’s historical bandwidth pricing. For example, the historical price for X-band transmission in the [DELETED] region in 2018 is the same as Inmarsat’s price for the [DELETED] region in the same time period. Compare AR, Tab 11A, Draft RFP Pricing Workbook, Tab X-band Hist[orical Rates], cell [DELETED] ($[DELETED]) with AR, Tab 7A, Inmarsat Revised Pricing Schedule, Region [DELETED], cell [DELETED] ($[DELETED], the price for [DELETED). Similarly, the disclosed historical pricing for military Ka-band in the [DELETED] region is almost identical to Inmarsat’s pricing. Compare AR, Tab 11A, Draft RFP Pricing Workbook, Tab Ka-band (Mil[itary]) Hist[orical Rates], cell [DELETED] ($[DELETED]) with AR, Tab 7A, Inmarsat Revised Pricing Schedule, Tab Region [DELETED], cells [DELETED] (($[DELETED], i.e., the price for military Ka-band satellite services for [DELETED]), and id., Tab Region [DELETED] (same, cells [DELETED]). However, for most of the bandwidth pricing, the data source or sources are not immediately apparent.
The remaining 5 hidden tabs involved non-bandwidth services called: “Sheet 1” (which consisted of the first five CLINs and 22 subCLINs of Inmarsat’s non-bandwidth pricing); labor; terrestrial; teleport and installation; and webtool. AR, Tab 11A, Draft RFP Pricing Workbook. Many of these 5 non-bandwidth tabs identified an Inmarsat contract such as CSSC I as their data source. See id., Tab Teleport and Installation, cell D7 (showing the price for “Setup MRC [monthly recurring cost]”); id.,Tab Webtool, cells E2:F6 (showing prices on the CSSC I contract and on Inmarsat’s contract to provide commercial satellite services to the United States Marine Corps).
The hidden tab “Sheet 1” states that it used the “actual” prices from the CSSC I contract and publishes Inmarsat’s CLIN-by-CLIN non-bandwidth pricing, including operational support, terrestrial circuits, information assurance, and GFE [government-furnished equipment] installation, for both monthly recurring costs (MRC) and non-recurring costs (NRC). Id., Tab Sheet 1; see also AR, Tab 4, Inmarsat CSSC I Pricing Proposal. Also, the non-bandwidth CLIN structure of Sheet 1 is identical for CLINs 0391-0395 (and subsequent years, and including 22 sub-CLINs) between Inmarsat’s CSSC I pricing, the pricing disclosed on the hidden tab “Sheet 1,” and the non-bandwidth CSSC II pricing. Compare AR, Tab 4, Inmarsat CSSC I Pricing Proposal, with AR, Tab 11A, Draft RFP Pricing Workbook, Tab Sheet 1, with AR, Tab 11A, Draft RFP Pricing Workbook, Tab Sheet 1, Non-Bandwidth.
On the morning of September 22, i.e., the day after DISA issued the draft solicitation, Inmarsat notified DISA of the release of Inmarsat’s detailed pricing information. Protest at 10-11. Shortly thereafter, DISA removed the draft solicitation (with the Excel workbook) from the beta.SAM.gov website. AR, Tab 14, Federal Business Opportunities Website Timestamp History at 2, 4.
On September 25, Inmarsat wrote to DISA identifying the improperly-released information and asked DISA to investigate the circumstances of the release and any resulting competitive harm. Protest, exh. J, Inmarsat Ltr. to DISA, Sept. 25, 2020. The agency acknowledges that third-party “aggregators” likely collected the draft solicitation prior to its removal from the federal business opportunities website. Tr. at 128:9-19. Due to this possibility, the agency concluded that “there was just no way to contain” or limit the circulation of the draft solicitation, including the pricing workbook. Id. Thus, the agency took no steps to do so beyond removing the draft solicitation from the federal business opportunities website. Id. at 128:13. Instead, the agency decided to “do our investigation as [if] the draft was there for industry’s benefit” because “we didn’t want to inadvertently point more people to that data at that time.” Id. at 128:16-17; 129:9-10.
In addition to the pricing issue, the record shows that the agency was also continuing to consider how to structure its evaluation. On November 20, DISA finalized a determination and findings (D&F) to waive consideration of past performance as an evaluation factor. AR, Tab 17, D&F Past Performance Waiver. The agency concluded that all potential offerors “have satisfactory performance utilizing the Contractor Performance Assessment Reporting System (CPARS), with no differentiation across performance elements.” Id. at 2; see also tr. at 140:20-22 (where the contracting officer confirmed that there is no difference in past performance ratings between potential offerors on the CSSC II contract).
On December 18, DISA published the solicitation for CSSC II. RFP at 1. The solicitation contemplated the award of a contract with a 10-year period of performance. Within these 10 years, the solicitation anticipated a 3-year base period of performance, three 2-year options, and one 1-year option. Id. at 3. The maximum contract value is anticipated to be $979,000,000. Id.
In accordance with the procedures of Federal Acquisition Regulation (FAR) part 15, the CSSC II award will be made to the offeror whose proposal represents the overall best value considering two factors: technical/management approach and cost/price. Id. § M1.1.2. As mentioned above, past performance was not included as an evaluation factor in the procurement. See id. The technical/management approach factor consists of four subfactors: global network infrastructure, space segment, management approach, and cyber security. Id. § M2.2. The four subfactors are of equal importance and, when combined, are significantly more important than cost/price. Id. § M2.1. DISA will assign combined technical/risk ratings to each subfactor, but those ratings “will not be rolled up into an overall rating for the Technical/Management Approach Factor.” Id. The global network infrastructure subfactor addresses non-bandwidth functions; the space segment subfactor addresses bandwidth functions; and the subfactors for management approach and cyber security address both bandwidth and non-bandwidth functions. Tr. at 13:18-14:2.
For the cost/price evaluation, offerors were to enter their fixed unit prices on a pricing worksheet. Id. § L5.1.2. The total evaluated price (TEP) of each proposal was to be the sum of an offeror’s prices for two pricing scenarios. Id. § M2.4. The TEP used agency-provided quantities for each scenario. Id.
The two pricing scenarios that comprise the TEP are scenario 1, which includes bandwidth pricing for all option periods, and scenario 2, which includes the non-recurring costs only for 6 months of non-bandwidth CLINs. Id. In more detail, scenario 1 consists of 34 CLINs per contract period, for the life of the contract, where each CLIN is a particular transmission bandwidth and quantity in a specific geographic region. AR, Tab 23A, RFP Section B Pricing Worksheet, Tab Scenario 1. The scenario 1 bandwidth pricing sought includes military Ka-band and X-band, i.e., the same bandwidths as those for which Inmarsat’s pricing was accidentally released with the draft solicitation. Id.
Scenario 2 consists of 8 CLINs for various non-recurring costs such as operations support and standing up the webtool and the commercial teleports. Id., Tab Scenario 2. Scenario 2 only asks offerors to price the first 6 months of non-recurring costs; it does not ask offerors to establish their prices for monthly recurring costs. Id. The agency will evaluate all CLINs, including the pricing not included in either scenario, for completeness, reasonableness and balance. Id.
As relevant to this protest, the solicitation includes an organizational and consultant conflict of interest (OCCI) clause as follows:
An inadvertent release of data was posted with the draft RFP on September 21, 2020, and due to the unreliability of this data, each Offeror shall provide a statement, to be contained in the Contracts Documentation Volume, to state the following:
I certify to the best of my knowledge, information, and belief after a diligent inquiry, that our company has not depended on or utilized any data for proposal preparation that was inadvertently released with the draft RFP on September 21, 2020.
If the offeror believes that no OCCI exists, the OCCI response shall set forth sufficient details to support such a position. If an offeror believes that an actual or perceived OCCI does exist on this procurement, the offeror shall submit an OCCI plan with the proposal, explaining in detail how the OCCI will be mitigated and/or avoided.
Id. § L2.1.7.
In addition to publishing the solicitation on December 18, DISA also responded to Inmarsat’s request for an investigation of the draft solicitation data release, asserting that “(1) no PIA [Procurement Integrity Act] violation occurred and (2) the disclosure did not harm the integrity of the procurement process.” AR, Tab 16, DISA Ltr. to Inmarsat, Dec. 18, 2020, at 2. DISA acknowledged that the agency had “inadvertently” disclosed certain of Inmarsat’s CSSC I CLIN pricing and other pricing information, but concluded that no competitor would be able to use the data to “reverse-engineer” Inmarsat’s successful solution to CSSC I. Id. DISA also asserted that changes made to the structure of the non-bandwidth contract line item numbers (CLINs) between the draft solicitation and the RFP rendered the inadvertently-released non-bandwidth information “no longer competitively useful.” Id. at 3. DISA also made several changes to the non‑bandwidth CLINs that are discussed in detail further below. Compare AR, Tab 16, DISA Ltr. to Inmarsat, Dec. 18, 2020; with AR, Tab 23A, RFP Pricing Workbook, Tab Non‑Bandwidth Pricing.
On January 26, 2021, a firm that is a competitor of Inmarsat’s and potential offeror on the CSSC II procurement wrote to DISA, advising the agency that it had located the draft solicitation pricing workbook hidden tabs. AR, Tab 24, Competitor Ltr. to DISA. The competitor alerted DISA that the employee who opened the hidden tabs was concerned that the worksheets contained Inmarsat’s proprietary information, and that the tabs also revealed the methodology and data used to calculate the IGCE. The competitor stated that the individuals who identified the information closed the document and removed it from the company’s server. Id. However, the competitor further explained that “out of an abundance of caution, [the competitor] firewalled off both employees from its proposal team for the CSSC II procurement[,]” thus suffering harm from the loss of two key team members. Id. The competitor expressed frustration that DISA had not advised the market of the inadvertent disclosure, especially given “the extraordinary competitive utility of the information.” Id. Finally, the competitor, noting the prejudice to “honest offerors” who would have taken similar steps as itself, asked DISA to either substantially amend the solicitation or cancel it. Id. at 3.
On February 10, Inmarsat filed this protest with our Office. On April 19, our Office held a telephonic hearing, taking testimony from two witnesses: the DISA contracting officer for CSSC II and a program analyst with the Commercial Satellite Communications Solutions Branch of the United States Space Force.
Inmarsat argues that the agency has failed to mitigate the competitive harm caused by the accidental release of both its bandwidth and non-bandwidth pricing. Inmarsat also asserts that the agency improperly decided not to provide for a past performance evaluation in the solicitation. In response, the agency contends that there is no competitive harm to the protester arising from the disclosures in the draft solicitation because the information is not competitively useful. DISA also argues that past performance historically has not affected the outcome of procurements for satellite bandwidth transmission services and that past performance is therefore not a necessary evaluation factor in this procurement.
For the reasons below, we conclude that Inmarsat was competitively harmed by DISA’s release of its non-bandwidth pricing and sustain the protest on this basis. We also conclude that Inmarsat was not competitively harmed by the release of its bandwidth pricing, and that the agency had a reasonable basis not to evaluate past performance in this solicitation.
Disclosure of Inmarsat’s Non-Bandwidth Pricing
Inmarsat first argues that it was competitively prejudiced by DISA’s release of Inmarsat’s non-bandwidth CSSC I pricing. In response, the agency contends that the non-bandwidth CLINs have undergone “substantial edits” since the release of the draft solicitation that render Inmarsat’s released non‑bandwidth CSSC I prices not competitively useful. Contracting Officer’s Statement and Memorandum of Law (COS/MOL) at 26 (citing AR, Tab 15, CSSC Procurement Integrity D&F at 4). The agency also concluded that the information was not competitively useful because the data “wouldn’t allow someone to recreate” Inmarsat’s technical solution. Tr. at 36:1-3. As discussed in more detail below, based on the record here and on the testimony provided at the hearing, we find that the agency disclosed Inmarsat’s non-bandwidth pricing, and that the pricing released was comprehensive, detailed, and recent. While the agency raises several arguments that the pricing released is not competitively useful, we do not find these arguments persuasive.
The disclosure of proprietary or source selection information to an unauthorized person during the course of a procurement is improper. 41 U.S.C. § 2102; FAR 3.104; Lion Vallen, Inc., B-418503, B-418503.2, May 29, 2020, 2020 CPD ¶ 183 at 5; S&K Aerospace, LLC, B-411648, Sept. 18, 2015, 2015 CPD ¶ 336 at 8. Where an agency inadvertently discloses an offeror’s proprietary information, the agency may choose to cancel the procurement if it reasonably determines that the disclosure harmed the integrity of the procurement process. Kemron Envtl. Servs., Inc., B-299880, Sept. 7, 2007, 2007 CPD ¶ 176 at 2. Where an agency chooses not to cancel the procurement after such a disclosure, we will sustain a protest based on the improper disclosure only where the protester demonstrates that the recipient of the information received an unfair advantage, or that the protester was otherwise competitively prejudiced by the disclosure. See Gentex Corp.-Western Ops., B-291793, et al., Mar. 25, 2003, 2003 CPD ¶ 66 at 7-9 (finding no competitive prejudice where agency promptly recalled the inadvertent disclosure, reviewed proposals for use of inadvertently disclosed material, and found no evidence that awardee had used protester’s material in its proposal).
Section 9.505(b)(1) of the FAR provides that an unfair competitive advantage exists where a contractor competing for award of any federal contract possesses proprietary information that was obtained from a government official without proper authorization. Accordingly, an unfair competitive advantage is presumed to arise where an offeror possesses competitively useful nonpublic information that would assist that offeror in obtaining the contract, without the need for an inquiry as to whether that information was actually of assistance to the offeror. L-3 Servs., Inc., B-400134.11, B-400134.12, Sept. 3, 2009, 2009 CPD ¶ 171 at 17 n.19 (citing Aetna Gov’t Health Plans, Inc.; Foundation Health Fed. Servs., Inc., B-254397.15 et al., July 27, 1995, 95-2 CPD ¶ 129 at 17 n.16; Health Net Fed. Servs., LLC, B-401652.3, B-401652.5, Nov. 4, 2009, 2009 CPD ¶ 220 at 28 n.15.
For example, we have found that where a firm may have gained an unfair competitive advantage through its hiring of a former government official, the firm can be disqualified from a competition based upon the appearance of impropriety which is created by this situation, even if no actual impropriety can be shown, so long as the determination of an unfair competitive advantage is based on facts and not on mere innuendo or suspicion. International Res. Grp., B-409346.2, et al., Dec. 11, 2014, 2014 CPD ¶ 369 at 7; Health Net Fed. Servs., LLC, supra at 28.
Here, there is no dispute that DISA inadvertently released Inmarsat’s non-bandwidth pricing for CSSC I in the draft solicitation. The non-bandwidth pricing released was detailed, comprehensive, and in many cases represented Inmarsat’s current prices for those services. After being alerted to this release, the program analyst and the contracting officer decided that because the draft solicitation had likely been captured on third-party aggregator websites, there was no way to limit the circulation of Inmarsat’s pricing. Tr. at 128:13. Faced with this scenario, DISA took no steps to restrict the distribution of Inmarsat’s pricing other than taking the draft solicitation off of the government’s portal for posting business opportunities. Although the agency made some changes to the non-bandwidth CLIN structure, as discussed further below we do not find that these changes were sufficient to mitigate the competitive harm caused by the release of Inmarsat’s non-bandwidth pricing.
As an initial matter, Inmarsat argues that the representation offerors are currently required to make under RFP section L2.1.7, i.e.,the OCCI representation quoted above, fails to mitigate the harm to Inmarsat. Protest at 25-28. The agency did not respond to this argument in either the agency report or the post-hearing comments. See generally COS/MOL, Agency Post-Hearing Comments.
At the hearing, the contracting officer testified that the OCCI representation in RFP section L2.1.7 is not intended to address any possible harm caused by the release of Inmarsat’s information. Tr. at 136:9-18. Rather, the representation is intended to prevent offerors from being led astray by the released information. Id.; see also id. at 133:3-5 (“[W]e wanted to make sure [to potential offerors] that it was clear that we found that information not competitively useful.”). The agency explained that, while it saw no competitive value in the released information, it nevertheless wanted offerors to avoid using the information, as such reliance could lead to a proposal where the price was too low for the technical solution proposed. Tr. at 133:13-16; see also id. at 136:13-14. Because DISA does not consider the representation in RFP section L2.1.7 to be part of its mitigation efforts to address the possible consequences of the release of Inmarsat’s information, we conclude that DISA does not ask offerors to make any relevant representation regarding their use of Inmarsat’s inadvertently-released information. Thus, we do not further evaluate section L2.1.7 for its effectiveness in such mitigation or consider the protest grounds challenging the effectiveness of the representations.
Changes to the Non-Bandwidth CLINs
DISA contends that the changes to the non-bandwidth CLINs render the released pricing information not competitively useful. COS/MOL at 55-69. Inmarsat asserts that the changes are not substantive and fail to mitigate the harm of the release of Inmarsat’s detailed non-bandwidth pricing.
Where an agency modifies the terms of a solicitation to address an unfair competitive advantage or disadvantage, we will review whether the agency reasonably found that the revised terms mitigated the concern. S&K Aerospace, LLC, supra at 7-10 (finding that the amendments to the solicitation decreased the competitive harm to the protester stemming from the release of the protester’s information and, along with other actions, mitigated the competitive harm).
Between the release of the draft solicitation and the final solicitation, DISA made several changes to the non-bandwidth CLINs. The agency described these as follows:
Separate CLINs X0391AC and X0391AD [now subCLINs under 0289] have been created for the Webtool, so it is no longer included in CLINs X391AA and X391AB [same] for Operations Support.
CLINs X392XX [now 0291] were revised to remove the associations between commercial teleports (CTs) and NDPs [Navy Designated Points of Presence] to allow increased scalability of the ground architecture and better pricing transparency.
CLINs X393XX [now 0292] were revised to include per unit throughput rates and estimated quantities.
CLINs X394XX [now 0293] for Information Assurance were renamed to “Cybersecurity/ATO [authority to operate]” to more accurately reflect the tasks to be completed. Navy cybersecurity policy and standards were also updated in the PWS and differ from those in SBS005 [i.e., the CSSC I contract], and the actual cost of implementation will depend heavily on the offeror’s unique solution.
CLIN X0395 [now 0291] has been revised to be a cost CLIN and a plug number will be provided.
AR, Tab 15D, Space Force Pricing Analyst Decl. to CSSC II Procurement Integrity D&F at 2-3; see also AR, Tab 16, DISA Ltr. to Inmarsat, Dec. 18, 2020; AR, Tab 23A, RFP Pricing Workbook, Tab Non-Bandwidth Pricing.
Overall, given the similarities between CSSC I and CSSC II in terms of non-bandwidth services sought, we conclude that these changes are minor or cosmetic. In other words, we find that these solicitation changes do not address the competitive harm caused by the release of Inmarsat’s non-bandwidth pricing. Our rationale for this conclusion is set forth in more detail below.
As an initial matter, we agree that changing CLIN 0395 to a cost CLIN and using a plug number--the final item in the list set forth above--remediates the harm from the release of Inmarsat’s pricing for this CLIN, because the price for this CLIN is no longer at the discretion of the offeror. However, the renaming of CLIN 0394 and its subCLINs fails to address the harm resulting from the release of prices because renaming the CLIN, without more, is a superficial change, rather than a substantive change. Further, the agency has not adequately shown how updated information security standards address the harm of this release or renders the information not competitively useful. In this regard, the agency has not shown that the standards are different in terms of implementation cost from the standards in place during CSSC I.
Furthermore, despite the increases in the scale for the ground architecture and other solicitation requirement in the CLINs under 0392, the agency released Inmarsat’s prices for the quantities for the same items purchased under CSSC I. Compare AR, Tab 11A, DRFP Pricing Workbook, Sheet 1, cells F10, F15 with AR, Tab 7A, Inmarsat Revised Pricing Schedule, Tab Non-Bandwidth, cells F11, F16 and all option years. Indeed, consistent with the increases in scale for both CLINs 0393 and 0392, the agency applied the same 30 percent across-the-board price increase to these CLINs that it applied to all other non-bandwidth CLINs to calculate the IGCE. AR, Tab 11A, Draft RFP Pricing Workbook, Sheet 1, cells H4:I37 (all under the header “New solution premium 30%, Base year”).
We find that potential offerors, like the agency, are likely able to compare the two contract statements of work, take Inmarsat’s non-bandwidth pricing, and scale up proportionally. In this regard, the agency confirmed that the increase in scale is related to increases in bandwidth volume and connection points. Tr. at 95:14-20. Accordingly, given the similarities in structure between the non-bandwidth services required under CSSC I and CSSC II, we do not find that the increases in scale diminish the competitive value of the released information or render it not competitively useful.
Finally, we conclude that removing the webtool function from the operational support subCLIN does not mitigate the competitive harm caused by the earlier release of the price for the subCLINs for the combined functions, as the agency argues. In this regard, while in CSSC II the webtool and operational support functions are in separate subCLINs, upon pricing, these subCLINs are added together as part the scenario 2 total. See AR, Tab 23A, RFP Pricing Workbook, Tab Scenario B, rows 6-7. In our view, there is no substantive difference here between the single combined CSSC subCLIN and the two separate subCLINs that are added together.
Not only is there no effective structural difference in the pricing, but the substantive webtool requirements in CSSC II are almost identical to those in CSSC I. See Protester Post-Hearing Brief, exh. 2, Comparison of CSSC I & CSSC II Webtools. On this point, DISA argues that the webtool is specific to an offeror’s technical solution, and thus not competitively useful if an offeror anticipates a different webtool solution. COS/MOL at 55-56 (citing AR, Tab 15D, Decl. of Space Force Program Analyst at 14‑15). This argument, however, fails to account for the fact that the CSSC II webtool description is detailed and not substantially different from the CSSC I webtool description, thus giving offerors Inmarsat’s price to accomplish these tasks on the previous contract. Furthermore, the agency disclosed Inmarsat’s webtool price not only for CSSC I, but also Inmarsat’s price for a webtool on another contract. AR, Tab 11A, Draft RFP Pricing Workbook, Tab Webtool, cells F2-F5.
The agency also asserts that “the single CLIN released in the worksheet is not the total cost for the webtool on that contract and it again cannot be used to determine the specific solution or any pricing methodologies.” AR, Tab 15D, Decl. of Space Force Program Analyst at 14. In fact, however, rather than the pricing methodology, Inmarsat’s actual prices for the webtools on these two contracts have been revealed, and thus potential offerors may know what Inmarsat will charge for completing the tasks provided in those solicitations. Indeed, by comparing the webtool descriptions and Inmarsat’s prices between the two requirements, offerors can break down the elements of Inmarsat’s pricing with even greater precision. On this basis, we conclude that the disclosure has resulted in competitive harm.
During the hearing, the agency explained that it estimates non-bandwidth services will constitute “five to ten percent” of the total contract value. Tr. at 18:16. In response, the protester points out that non-bandwidth services constituted approximately [DELETED] percent of the awarded price on CSSC I. Protester Post‑Hearing Comments at 18. The protester also asserts that the solution for the non‑bandwidth services will have an outsize impact on the CSSC II competition. Protester Post-Hearing Comments at 23 (citing the program analyst’s testimony, tr. at 15:1-2 (“that is the place where this contract will succeed or fail.”)). We agree with the protester that in this competition the solutions and prices for the non-bandwidth services are likely to provide a key basis for differentiating between proposals. This supports our conclusion that the accidental release of Inmarsat’s comprehensive prices for the non-bandwidth subCLINs, including some current prices, resulted in competitive harm to Inmarsat.
We have previously considered the scenario where there was an accidental release of protester information in hidden workbook tabs. In S&K Aerospace, LLC, our Office denied a protest involving the improper viewing of hidden tabs that contained the incumbent contractor’s cancellation fees for the base period of the contract. S&K Aerospace, LLC, B-411648, Sept. 18, 2015, 2015 CPD ¶ 336. However, the disclosure in S&K was very limited, and the agency took action to restrict its distribution. Specifically, the data was viewed by a single employee of the offeror, and the employee was promptly removed from the offeror’s proposal team and signed a non-disclosure agreement. Id. at 3, 8. In S&K, the agency also “‘scoured’ all [relevant agency] websites searching for any other proprietary information that might have been inadvertently disclosed.” Id. at 4. After finding another inadvertent disclosure, the agency also changed the solicitation’s method for calculating the cancellation fees and required offerors to certify that they were “not in possession of, nor have we accessed without authority from S&K Aerospace, any S&K Aerospace proprietary information.” Id. at 3. The agency also took other remedial measures. Our Office denied the protest, finding that the offeror had not demonstrated that it was competitively prejudiced by the disclosure. Id. at 8.
In contrast, the changes here are not sufficient for the agency reasonably to conclude that it has mitigated the risk. In this regard, the agency does not ask for a representation that would address the release of the data. Furthermore, the data release was not limited and there is no evidence that the agency intends to assess whether Inmarsat’s proprietary pricing data was used by an offeror.
“Staleness” of Pricing Data
In arguing that the release of Inmarsat’s non-bandwidth pricing was not competitively harmful, DISA also argues that the released prices were largely from 2016‑2017 and thus “stale.” Inmarsat disagrees, and argues that, for many CLINs, the pricing is current, i.e., Inmarsat continues to charge the price revealed in the draft solicitation.
There is no per se rule on the amount of time that renders information stale and therefore not competitively useful; however, we think that longer periods of time tend to support agency conclusions that information has become stale. IDS Int’l Gov’t Sers., LLC, B-419003, B-419003.2, Nov. 18, 2020, 2020 CPD ¶ 383 at 22.
In IDS, we denied a protest arguing that the protester had been harmed by a previous release of line-item prices. In that protest, the agency released data showing IDS’s monthly prices for performing specific categories of services at different locations. Id. at 19. While we found the disclosed data to be “stale,” we also noted that the agency previously took corrective action by cancelling the earlier solicitation and making a sole-source award to a subsidiary of the protester. Id. at 17-19. The protester thus alleged that other offerors retained an advantage for two procurements, despite the intervening award to its subsidiary.
Although several years have passed since Inmarsat proposed these prices, the protester contends there are several factors that make them still competitively useful for offerors in the instant procurement. We agree. First, the prices were released at the CLIN and subCLIN levels in a solicitation where the CLINs themselves were already quite detailed.
Next, most of the non-bandwidth prices remain current. In this respect, while the prices for the standup and monthly recurring subCLINs under CLIN 0391, Operational Support/Program Management/M&C varied somewhat in later years from the 2016 actual disclosed prices, the prices for the remainder of the CLINs remained the same. AR, Tab 7A, Inmarsat Update Pricing Schedule, Tab Non-Bandwidth. Accordingly, the disclosed prices for the majority of the non-bandwidth CLINs are Inmarsat’s current prices under the CSSC I contract. In sum, DISA inadvertently released Inmarsat’s detailed proprietary prices, many of which remain current. The changes to the solicitation’s structure are minor and are not sufficiently different to mitigate the harm caused by the release of pricing. Accordingly, we sustain this protest ground. See S&K Aerospace, supra at 8.
Disclosure of Inmarsat’s Bandwidth Pricing
Inmarsat next argues that although the record shows that only a small portion of its exact bandwidth pricing (as opposed to the non-bandwidth pricing discussed above) was released, the prices in the hidden tabs were very close to its released pricing, and thus, these prices as well were competitive useful. Comments at 7 (“[T]he disclosures varied by less than [DELETED] percent from Inmarsat’s actual bandwidth pricing for certain bands and regions.”). DISA contends that the pricing was an average of various unknown contracts and that Inmarsat’s pricing cannot be determined from the release.
As mentioned earlier, the disclosure of source selection information, including an offeror’s price, during the course of a procurement is improper and the agency may take remedial steps, including canceling the procurement, if it reasonably determines that the disclosure harmed the integrity of the procurement process. Ocean Ships, Inc., B‑401526.4, Apr. 21, 2010, 2010 CPD ¶ 106 at 4; Information Ventures, Inc., B‑241441.4, B-241441.6, Dec. 27, 1991, 91-2 CPD ¶ 583 at 4-5. Where an agency decides that no remedial steps are necessary, we will sustain a protest based on the improper disclosure only where the protester demonstrates that it was in some way competitively prejudiced by the disclosure. Ocean Ships, supra at 4 (denying protest in part due to the fact that “with limited exceptions, there was no disclosure of offerors’ specific prices in any of the challenged areas[.]”); Kemron Envtl. Servs., Inc., B-299880, Sept. 7, 2007, 2007 CPD ¶ 176 at 3 (denying protest where only 1 of 15 labor rates was released, and only 7 of 73 equipment prices were released).
The record shows that the agency released Inmarsat’s 2018 historical prices for X-band in the [DELETED] region and Ka-band (Mil) in the [DELETED] region. The agency also released the quantity ordered on the CSSC I contract in 2018 for these bandwidths. The bandwidth and region combinations are very limited in comparison to the comprehensive pricing offerors are to propose on the instant contract. See AR, Tab 23A, RFP Pricing Workbook.
Inmarsat contends that the other bandwidth prices released were--if not exact--still very close to its historical prices. Protest at 38. However, the contracting officer testified that the market for bandwidth services was “competitive,” tr. at 142:21-143:1, and that in her experience, the price variance between offerors for a particular combination of bandwidth, region, and time period was approximately “three to five percent.” Id. at 144:13-14.
Inmarsat disputes this conclusion, stating that “[p]utting aside the [DELETED] regions where the draft solicitation actually disclosed Inmarsat’s CSSC I prices for specific bands, a comparison of other regions and bands demonstrates that there is wide divergence between the prices disclosed in the [draft solicitation] and Inmarsat’s CSSC I prices.” Protester Post-Hearing Brief at 13. This statement is consistent with other testimony, which indicated that there is considerable market volatility. According to the contracting officer, prices for a particular bandwidth in a particular region could vary by “30 to 50 percent” based on “high demand in the area, or low availability, or . . . a particularly difficult use case, [such as] a very restricted coverage area or a need for something high-powered.” Tr. at 61:17-22; see also id. at 1-9.
We think that overall, the testimony and Inmarsat’s arguments show that, due to limited supply, the market for commercial satellite bandwidth is competitive and sensitive to demand for any particular combination of bandwidth and region at a particular time. On this record, we conclude that there is not sufficient evidence to show that Inmarsat’s bandwidth pricing was released generally, other than in those few instances where it is clear that Inmarsat’s 2018 bandwidth prices for certain regions were released. In addition, we agree with the agency that the revealed prices likely reflect an amalgamation of market prices. Given the apparent activity in this competitive market, the passage of time also rendered the 2018 prices stale. On this record, we do not find that the release of Inmarsat’s bandwidth pricing resulted in competitive harm to Inmarsat and deny this protest ground. Ocean Ships, supra at 4; Kemron Envtl. Servs., Inc., B‑299880, Sept. 7, 2007, 2007 CPD ¶ 176 at 3.
Lack of a Past Performance Factor
Lastly, Inmarsat contends that the agency improperly decided not to evaluate past performance, or to consider past performance as part of the agency’s best-value tradeoff decision. Comments at 29. As discussed below, we do not find that DISA unreasonably omitted past performance as an evaluation factor.
The determination of a contracting agency’s needs and the best method of accommodating them are matters primarily within the agency’s discretion. Data Monitor Sys., Inc., B-415761, Mar. 6, 2018, 2018 CPD ¶ 79 at 6; a protester’s disagreement with the agency’s judgment concerning the agency’s needs and how to accommodate them does not show that the agency’s judgment is unreasonable. Id. In this context, FAR section 12.206 provides in relevant part that past performance information should be considered in accordance with the procedures set forth in FAR subpart 15.3. Under FAR section 15.304(c)(3)(iii), past performance need not be evaluated if the contracting officer documents the reason why past performance is not an appropriate evaluation factor for the acquisition.
Here, DISA documented its determination and adequately explained why it concluded that evaluating past performance was not appropriate for this acquisition. AR, Tab 17, D&F Past Performance Waiver. Before issuing the solicitation, DISA concluded that there was no benefit to evaluating past performance in the CSSC II acquisition because “[d]ue to its oligopolistic industry, there are few Satellite owner/operator providers due to its high barrier to entry. When reviewing these interested sources, it was found that all providers have satisfactory performance utilizing the Contractor Performance Assessment Reporting System (CPARS), with no differentiation across performance elements.” AR, Tab 17, D&F Past Performance Waiver at 2. Accordingly, DISA found no benefit to the agency by including past performance as a “significant evaluation factor.” Id. In sum, DISA concluded that reviewing past performance information for communications services that are generally performed favorably was unnecessary and would not yield significant data for evaluative purposes. Id.
The protester has provided no basis for us to question the agency’s conclusion.
In this regard, although Inmarsat argues that the services contemplated by the solicitation should be considered, see Comments at 28-31, such arguments in essence represent disagreement with the agency’s determination, and therefore do not provide us with a basis to sustain the protest. Accordingly, we deny the protest allegation. See Data Monitor Sys., Inc., supra at 7.
In light of our discussion above, we conclude that the disclosure of Inmarsat’s detailed and recent non-bandwidth pricing resulted in competitive harm. Accordingly, we recommend that the agency either cancel the solicitation or substantially revise it so that the harm resulting from the disclosure can be mitigated. We also recommend that Inmarsat be reimbursed its costs of filing and pursuing the protest, including reasonable attorneys’ fees. 4 C.F.R. 21.8(d)(1). Inmarsat’s certified claims for such costs, detailing the time expended and costs incurred, must be submitted directly to the agency within 60 days after receipt of this decision. 4 C.F.R. 21.8(f)(1).
The protest is sustained in part and denied in part.
Thomas H. Armstrong
 See Intelsat Gen. Corp., B‑412097, B‑412097.2, Dec. 23, 2015, 2016 CPD ¶ 30.
 C, Ka, Ku, and X-band are bandwidths within the microwave band of the electromagnetic spectrum. Intelsat Gen. Corp., supra at 2 n.2.
 Citations to the RFP are to the conformed copy of the solicitation at tab 23 of the agency report (AR). Although there were amendments to the solicitation between its December 18 issuance and this protest, the history of those changes is not relevant to the protest.
 The spreadsheet was prepared by employees of Booz Allen Hamilton, as subcontractor to the prime contractor Competitive Range Solutions. Hearing Transcript (Tr.) at 24:15-17; 28:3-4. These contractors were overseen by United States Space Force employees, including the program analyst who testified at the GAO hearing described in further detail below. Tr. at 30:13-18.
 The assumptions and methodologies tab explains some of the underlying IGCE calculations. AR, Tab 11A, Draft RFP Pricing Workbook, Tab Assumptions and Methodologies, cell A33; cells A58:A68. For example, “non[-]recurring costs were given a multiplier of 3.5 to reflect increase in teleport locations from 2 to 7” and the number of full-time equivalent personnel (FTEs) was specified by job title. Id., cells A64:A68. There is no protest ground related to the agency’s publication of this methodology.
 The worksheet usually references the CSSC I contract by the number “SBS0005.” See, e.g.,AR, Tab 11A, Draft RFP Pricing Workbook, Tab Assumptions and Methodologies, cell A33.
 Microsoft Excel contains a function that permits a user to “hide” a tab by right-clicking on the tab and selecting “hide” from the menu. When a tab is created, the default status is that the tab is visible. Therefore, a user must use the “hide” function to hide the tab.
 Bandwidth pricing refers to a price for a specific combination of bandwidth, geographic region, transmission volume, duration, and contract performance period. Tr. at 11:12-12:2; see also, e.g.,AR, Tab 11A, Draft RFP Pricing Workbook, Tab Region [DELETED]. Non‑bandwidth pricing refers to the prices for all other items and services purchased under the contract. AR, Tab 11A, Draft RFP Pricing Workbook, Tab Non‑Bandwidth.
 While almost all of the data comes from Inmarsat’s CSSC I price proposal, two of the draft solicitation Sheet 1 CLINs, 0391AA (Operational Support MRC) and 0391AB (Operational Support NRC), were not identical to the CLINS from Inmarsat’s initial CSSC I price proposal. However, they are identical to the same CLINs in Inmarsat’s modified revised prices for the CSSC I contract. Compare AR, Tab 11A, Draft RFP, Section B Pricing Workbook, Tab Sheet 1, cells E4 ($69,560) and F5 ($723,032) with, respectively, AR, Tab 7A, Inmarsat Pricing Schedule Modification 0004, Tab Non‑Bandwidth, cells [DELETED].
 As used by the parties, “aggregators” are non-governmental websites that aggregate information released on the government’s portal for posting business opportunities. See, e.g., Protest at 15. While DISA chose not to contact any of these entities to request that they remove the draft solicitation from their websites, Inmarsat was able to contact several of them and request that the draft solicitation pricing workbook be removed. Id. at 16-17 n.14. However, Inmarsat’s actions were not sufficient to completely prevent access to the improperly-released draft solicitation pricing workbook. See AR, Tab 26, Competitor Ltr. to DISA, Jan. 26, 2021.
 Scenario 2 includes the costs for commercial teleport standup, including installation of GFE, but the ordering quantity is zero meaning that, as a practical matter, these costs are not included in an offeror’s TEP. AR, Tab 23A, RFP Pricing Workbook, Tab Scenario 2.
 Inmarsat raises other collateral arguments. Although they have all been considered, none provides an independent basis to sustain the protest.
 At this time, DISA was aware of the firms that would likely submit offers for the CSSC II requirement. Not only was the CSSC II solicitation substantially similar to the solicitation for CSSC I, the procurement competed in 2016, but as discussed in more detail above, in developing the CSSC II solicitation the agency conducted market research in assessing the need for a past performance evaluation and concluded that there were only a few potential competitors. AR, Tab 17, D&F Past Performance Waiver at 2. Thus, at the time of the release of the draft solicitation, DISA had decided which firms were likely to compete under the CSSC II solicitation.
 The program analyst also testified that Inmarsat’s released CSSC I prices are not competitively useful because in the solicitation for CSSC II “[w]e are looking at price reasonableness. If someone came in excessively low because their entire goal was to beat the price, we would consider that to be a risk. We could potentially consider that pricing to be unreasonable. . . .” Tr. 92:16-20 (emphasis added). However, the purpose of a price reasonableness review is to determine whether the prices offered are too high, as opposed to too low. See FAR 15.404-1(b); EFW, Inc., B-412608, B‑412608.2, Apr. 7, 2016, 2016 CPD ¶ 304 at 13-14; Sterling Servs., Inc., B-291625, B‑291626, Jan. 14, 2003, 2003 CPD ¶ 26 at 3. Conversely, a price realism review is to determine whether prices are too low, such that there may be a risk of poor performance. EFW, Inc., supra at 11, citing FAR 15.404-1(d)(3). Despite the program analyst’s testimony, and the testimony of the contracting officer cited above, the solicitation does not contain a price realism provision. See generally RFP.
 The current version of the solicitation renumbers the non-bandwidth CLINs from those used in the draft solicitation and the first version of the solicitation released on December 18, 2020. See AR, Tab 23A, RFP Pricing Workbook, Tab Scenario 2.
 [DELETED]. RFP at 14.
 E.g., the value in the draft solicitation Ka-band (Mil) historical value is 501 MHz. AR, Tab 11A, Draft RFP Pricing Workbook, Tab Ka-band (Mil) Hist, cell D2. The multiplier is 2.5. Id., Tab Assumptions and Methodologies, cell A33. The value of 501 MHz divided by 2.5 is 200.5. Inmarsat [DELETED]. Protest at 13.