Insight Technology Solutions, Inc.

DOCUMENT FOR PUBLIC RELEASE
The decision issued on the date below was subject to a GAO Protective Order. This version has been approved for public release.

Decision

Matter of: Insight Technology Solutions, Inc.

File: B-420543; B-420543.2

Date: May 27, 2022

DIGEST

1. Protest that requirement to possess capability maturity model integration (CMMI) level 3 certification is unduly restrictive of competition is denied where the requirement is reasonably related to the agency’s needs.

2. Protest of requirement that offerors submit evidence of CMMI level 3 certification at the time of proposal submission, rather than at the time of award or performance, is sustained where the requirement exceeds the agency’s reasonable needs.

Insight Technology Solutions, LLC, of Bowie, Maryland, protests the terms of request for proposals (RFP) No. C‑88259‑SB, issued by the Department of Homeland Security, U.S. Immigration and Customs Enforcement (ICE) for level 1 call center support services for the agency’s student and exchange visitor program (SEVP). Insight contends that the solicitation’s requirement that the awardee possess a capability maturity model integration (CMMI) level 3 certification at the time of award is unduly restrictive of competition.

We sustain the protest.

BACKGROUND

On December 21, 2021, the agency issued the solicitation to firms holding contracts under the National Institutes of Health’s chief information officer-solutions and partners 3 small business (CIO-SP3 SB) governmentwide acquisition contract (GWAC). Agency Report (AR), Tab 10, RFP at 1; Contracting Officer’s Statement (COS) at 9.[1] The RFP contemplated the issuance of a task order, on a best‑value tradeoff basis, for a 12-month base period and four 12-month option periods, to provide level 1 call center support services in support of the agency’s SEVP Response Center (SRC).[2] RFP at 1. The RFP initially set January 12, 2022, as the deadline for the receipt of proposals. Id. at 2.

The RFP was issued as part of a two-phase procurement. In phase I, the agency provided what it characterized as a “Phase I Opt-In Solicitation,” including a draft performance work statement (PWS), to firms holding a CIO-SP3 SB contract. AR, Tab 7, Phase I RFP at 1; COS at 3.[3] The phase I RFP required interested firms to affirmatively respond that they wished to participate in phase II by October 22, 2021. Phase I RFP at 2‑3. Firms that failed to affirmatively opt in by the October 22 deadline would not be allowed to participate in phase II.[4] Id.

For phase II, the RFP established that the agency would conduct an initial evaluation of proposals considering two evaluation factors, certifications and experience, and then perform a “down-select” to a maximum of four “best-suited” proposals to continue to phase III and be considered for award. RFP at 8‑9. In phase III, the agency was to evaluate the remaining proposals considering two additional evaluation factors: technical capability and price. Id. at 3, 13‑14.

The initial RFP required that offerors possess a CMMI level 1 or greater certification at the time of proposal submission. Id. at 7-8; AR, Tab 11, PWS at 7. Offerors were required to submit any questions regarding the solicitation by January 4, 2022. RFP at 2. On January 7, the agency responded to questions submitted by potential offerors and issued amendment A000001 to the RFP. AR, Tab 19, RFP amend. A000001; COS at 10. Amendment A000001 revised the RFP’s CMMI certification requirement to require that offerors demonstrate CMMI level 3 or greater certification at the time of proposal submission.[5] Id. at 5‑6. Amendment A000001 also extended the deadline for receipt of proposals to January 19. Id. at 2.

As relevant here, the RFP provided that the agency would evaluate proposals under the certifications factor to determine whether they met the solicitation’s certification requirements on an acceptable/unacceptable basis. AR, Tab 25, RFP amend. A000002 at 8. Specifically, the RFP provided that an offeror’s proposal would be assessed a rating of “acceptable” if the “proposal reflects that the Prime Offeror has the required certifications . . . and that the certifications are current and valid at time of proposal submission.” Id. Proposals that did not demonstrate that the prime offeror possessed the required certifications at the time of proposal submission would be rated “unacceptable” under the certifications factor. Id. Only proposals rated “acceptable” under the certifications factor would be further evaluated and eligible for award. Id.

On January 18, Insight filed an agency-level protest challenging the CMMI certification requirement as unduly restrictive of competition and arguing that offerors were not given a reasonable opportunity to respond to the amended solicitation. COS at 15. On February 17, the agency denied Insight’s agency-level protest. Id. On February 18, Insight filed the instant protest with our Office.

DISCUSSION

Insight first alleges that there is “no reasonable basis” for the agency to require a CMMI level 3 or greater certification for this requirement.[6] Comments at 6. Insight objects to the agency’s analysis of the certification levels at issue as “[v]ague and [u]nsupported,” arguing that the agency report contains “no actual analysis” of the “necessity of CMMI level 3 in the context of the current work.” Id. at 9.

The agency responds that the CMMI certification requirement is not unduly restrictive of competition because it reasonably represents the agency’s actual needs. Memorandum of Law (MOL) at 12‑16. The agency argues that CMMI level 3 or greater certification is necessary because the call center requirement is constantly evolving and the PWS requires the contractor to recommend and participate in process improvements and system upgrades.[7] Id. at 13‑14. In this regard, the agency maintains that CMMI level 3 or greater certification results in higher quality identification and resolution of process issues when compared to level 1 or level 2. Id. at 15; COS at 16.

A contracting agency has the discretion to determine its needs and the best method to accommodate them. Chromalloy San Diego Corp., B-416990.2, Jun. 3, 2019, 2019 CPD ¶ 188 at 5. Where a protester challenges a specification or requirement as unduly restrictive of competition, the procuring agency has the responsibility of establishing that the specification or requirement is reasonably necessary to meet the agency’s needs. Remote Diagnostic Techs., LLC, B‑413375.4, B‑413375.5, Feb. 28, 2017, 2017 CPD ¶ 80 at 3‑4. We examine the adequacy of the agency’s justification for a restrictive solicitation provision to ensure that it is rational and can withstand logical scrutiny. AAR Airlift Grp., Inc., B‑409770, July 29, 2014, 2014 CPD ¶ 231 at 3.

The record demonstrates that the agency first explained its decision to adopt the more stringent CMMI certification requirement on January 10, in response to potential offerors’ questions. COS at 12‑13; AR, Tab 24, Jan. 10 Responses to Offeror Questions at 1. In this response, the agency specifically noted that it understood CMMI level 3 certification to indicate that a firm would provide higher quality identification and resolution of process issues when compared to those certified at CMMI level 2 or level 1 and stated that CMMI level 3 certification results in a firm’s processes being managed more proactively. AR, Tab 24, Jan. 10 Responses to Offeror Questions at 1. The agency further stated that the call center requirement is “constantly evolving” and CMMI level 3 or greater would be needed so that standards, process descriptions, and procedures were better tailored to the agency’s individual requirements. Id.

In response to the protest, the contracting officer reiterates this justification, arguing that CMMI level 2 “[does] not allow for process improvements” and is often reactive to events. COS at 16. The contracting officer maintains that CMMI level 3 process descriptions and procedures allow “process improvements by identifying, analyzing, and improving upon existing business processes within an organization.” Id. Also, as noted above, in its memorandum of law, the agency pointed to several requirements in the PWS mandating the contractor recommend and participate in process improvements and system upgrades. MOL at 13‑14.

Insight does not meaningfully dispute that the CMMI level 3 or greater certification indicates a firm is superior at identifying and resolving process issues compared to a firm certified at CMMI level 1 or level 2, or that the PWS includes requirements to recommend and participate in process improvements and system upgrades. Instead, the protester refers to the agency’s analysis as “[v]ague and [u]nsupported” and objects to several other justifications for the CMMI level 3 requirement offered by the agency in its final decision in response to Insight’s agency-level protest. Id. at 6-8.

We find Insight’s arguments and objections to the agency’s stated need for CMMI level 3 or greater certification unpersuasive. In this regard, the protester’s characterizations and objections to the agency’s arguments and justifications do not explain why the process-based justification proffered by the agency in the contemporaneous record and again in the agency report fails to provide a rational basis to require CMMI level 3 or greater certification.[8] Id. The agency states that its call center requirement is “constantly evolving” and CMMI level 3 would be needed so that standards, process descriptions, and procedures were better tailored to the agency’s individual requirements. The protester has not established that the agency’s justification does not reasonably support its needs.

In sum, we see no basis to object to the agency’s justification for the inclusion of the CMMI level 3 or greater certification requirement. On this record, we find the agency’s justification reasonable and the CMMI level 3 or greater certification requirement to be reasonably necessary to meet the agency’s needs. Accordingly, the protester’s disagreement does not render the agency’s judgment unreasonable.[9] Omnicell, Inc., B‑417941, Dec. 16, 2019, 2019 CPD ¶ 423 at 4. As a result, we deny this ground of protest.

The protester also contends that the RFP requirement for each offeror to demonstrate its CMMI certification at the time of proposal submission exceeds the agency’s needs. Protest at 13‑14; Comments at 11. In this regard, the protester argues that the agency has not demonstrated that it needs the superior management processes that CMMI level 3 or greater certification allegedly ensures until contract performance. Comments at 11; Protester’s Supp. Brief at 4‑5.

“An agency’s otherwise legitimate requirements regarding an offeror’s demonstrated ability to meet contract requirements may not generally be applied at a point in time prior to when such qualifications become relevant.” USA Jet Airlines, Inc.; Active Aero Group, Inc., B‑404666, Apr. 1, 2011, 2011 CPD ¶ 91 at 5 (citing LBM Inc., B‑286271, Dec. 1, 2000, 2000 CPD ¶ 194 at 4). When such a challenge to the timing of a certification requirement is raised, our Office will sustain a protest where the justifications provided by an agency do not support requiring that mandatory industry certifications be held at the time of proposal submission. Id. at 5.

In its memorandum of law, the agency contends that requiring offerors to possess CMMI level 3 or greater certification at the time of proposal submission is necessary here because the agency has to verify compliance with this material requirement and “cannot risk not having the certifications at the time of award.” MOL at 20. The agency argues that not verifying certifications as of the time of proposal submission would put the agency “at the mercy of a certification process” and states without explanation that this could create uncertainty due to the uncertain timing for obtaining certification. Id.

The agency’s stated reasons do not support requiring CMMI level 3 or greater certification at the time of proposal submission. As noted above, the agency justified the use of CMMI level 3 or greater certification by stating that such certification indicates a firm would provide higher-quality identification and resolution of process issues, and pointing to several PWS requirements mandating the contractor recommend and participate in process improvements and system upgrades. COS at 12‑13, 16; MOL at 13‑14. Our review of the record reveals nothing in either the proffered advantages of CMMI level 3 certification or the PWS requirements that would make the mere possession of CMMI level 3 or greater certification relevant before the start of contract performance, much less before award. Further, the agency’s arguments regarding the timing of the certification process do not provide a basis to deny the protest grounds here. See USA Jet, supra, at 5 (“[t]he fact that a diligent prospective offeror could face a lengthy process to obtain a[n] [industry] certification . . . does not mean that the requirement must be met when proposals are due”).

Despite this, the agency maintains that the current certification requirement is reasonable because the agency needs it to “obtain[] an objective measure of the Offeror[s’] capabilities and to evaluate the Offeror[s’] ability to provide high quality services.” Agency’s Supp. Brief at 1. In support of its argument, the agency cites to our decision, KPaul Properties, LLC, B‑419893, B‑419893.6, Sep. 15, 2021, 2021 CPD ¶ 317, arguing that in that decision, our Office found that the agency reasonably sought “an objective measure of the offeror’s quality management processes” and concluded that the “agency therefore [was] using the certifications . . . as part of its evaluation of the offeror’s ability to provide high quality services.” Agency’s Supp. Brief at 1‑2 (citing KPaul Properties, supra at 3).

The agency’s reliance on KPaul here is misplaced. The language ICE cites from the KPaul decision is not a stand-alone proposition that a procuring agency can require offerors to possess industry certifications at the time of proposal submission by merely stating that they are being used as an objective evaluation requirement. Rather, the specific language ICE cites above are concluding sentences that follow our Office’s discussion in KPaul about how the agency had sufficiently demonstrated that its certification requirement was relevant at the time of proposal submission due to the specific facts presented in that protest. Taking the cited language outside the context of the specific facts presented in that decision, as the agency’s argument would have us do, would unreasonably expand the analysis and conclusions of the decision.

Specifically, in KPaul, the agency sought to award multiple indefinite-delivery, indefinite-quantity contracts for information technology (IT) value-added reseller services, which the agency identified as a key resource for procuring IT hardware. KPaul, supra at 2, 5. The agency represented that it needed the required certification in place before proposal submission to provide “assurance against supply chain vulnerabilities” so that the IT equipment the agency planned to buy--presumably some of which would already have been purchased by an offeror and moved through its supply chain before contract award--would not be “compromised by vulnerabilities or . . . bad actors.” Id. at 5. Our Office concluded that the agency’s explanation reasonably supported requiring offerors to have the mandatory certification at the time of proposal submission. Id.

Here, unlike in KPaul, the agency has neither specifically expressed concern about any supply chain vulnerabilities[10] nor, more broadly, otherwise pointed to any service required by the solicitation that would make possessing CMMI level 3 or greater certification relevant between the time of proposal submission and the time of award. Despite the agency arguing that the certification is necessary at the time of proposal submission in order for the agency to perform “its evaluation of the offeror’s ability to provide high quality services,” the agency has not explained why its objective evaluation of this certification on an acceptable/unacceptable basis would need to happen until, at the earliest, immediately before award.[11] See Agency’s Supp. Brief at 1‑2.

In sum, the agency has not provided a reasonable basis to support requiring CMMI level 3 or greater certification at the time of proposal submission. Accordingly, we sustain the protest that offerors possess a CMMI level 3 or greater certification at the time of proposal submission here.

RECOMMENDATION

We recommend that ICE review its needs; after conducting that review, amend the solicitation to allow offerors to provide CMMI level 3 or greater certification at the time of award or performance, which ever best meets the agency’s needs; and, that ICE reopen the competition and allow offerors to submit new or revised proposals. We also recommend that Insight be reimbursed the reasonable costs of filing and pursuing its protest, including attorneys’ fees. The protester should submit its certified claim for costs, detailing the time expended and costs incurred, directly to the contracting agency within 60 days after receipt of this decision. 4 C.F.R. § 21.8(f)(1).

The protest is sustained.

Edda Emmanuelli Perez
General Counsel