CIYIS, LLC

Decision

Matter of: CIYIS, LLC

File: B-423146.2

Date: November 17, 2025

Christian Y. Sellu for the protester.
Tracey L. Ferguson, Esq., Department of the Navy, for the agency.
Heather Weiner, Esq., and Jennifer D. Westfall-McGrail, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision.

DIGEST

Protest challenging agency evaluation of protester's technical proposal is denied where the record reflects that the evaluation was reasonable and consistent with the terms of the solicitation.

DECISION

CIYIS, LLC, a small business of Atlanta, Georgia, protests the decision of the Department of the Navy, Naval Information Warfare Center Pacific, not to award CIYIS a contract under request for proposals (RFP) No. N66001-24-R-0048, for information technology (IT) services. The protester challenges the agency's evaluation of its technical proposal.

We deny the protest.

BACKGROUND

Using the procedures of Federal Acquisition Regulation (FAR) part 15, the Navy issued the RFP on September 20, 2024, as a small business set-aside, seeking proactive and enhanced services for Microsoft products and cloud services. Agency Report (AR), Tab 1, RFP at 27. The solicitation contemplated award of multiple fixed-price, indefinite-delivery, indefinite-quantity (IDIQ) contracts for an ordering period of five years. AR, Tab 1, RFP, amend. 0002 at 180.[1]

The RFP provided that proposals would be evaluated using a three-step methodology: step one (evaluation of acceptability),[2] step two (evaluation of three factors--technical, organizational experience, and past performance), and step three (the source selection decision). Id. The solicitation explained that to be considered technically acceptable for step two, a proposal must receive a rating of at least acceptable for the technical and organizational experience factors, and a rating of neutral confidence, satisfactory confidence, or substantial confidence for the past performance factor. Id. The RFP provided for award to all responsible offerors submitting technically acceptable proposals whom “the Contracting Officer has no reason to believe would be likely to offer other than fair and reasonable pricing.”[3] Id. at 180. In addition, the solicitation advised that, in making the award decisions, the agency would not perform a tradeoff analysis. Id. at 180, 183.

As relevant to the protest, under the organizational experience factor, the RFP required offerors to complete and submit an organizational experience matrix to indicate the breadth, depth, and relevance of their organizational experience in six key areas. Id. at 139.

The agency received proposals from sixteen offerors, including CIYIS. COS/MOL at 5; AR, Tab 4, Business Clearance Memorandum (BCM) at 272. After evaluating proposals, the Navy assigned the following ratings to CIYIS's proposal:[4]

	CIYIS
Acceptability of Offer	Acceptable
Technical	Acceptable
Organizational Experience	Unacceptable
Past Performance	Neutral Confidence

AR, Tab 4, BCM at 279.

Under the organizational experience factor, CIYIS's proposal was assigned one weakness, two significant weaknesses, and three deficiencies. AR, Tab 3, Source Selection Evaluation Board (SSEB) Report at 261-264. Based on this assessment, the agency found that CIYIS's proposal was unacceptable for this factor, noting that the “overall depth of involvement across the Government's Key Area requirements does not meet [the] requirements of the solicitation.” Id. at 264. Due to the unacceptable rating for the organizational experience factor, the agency concluded that it could not award a contract to CIYIS.[5] AR, Tab 4, BCM at 272-273.

The Navy posted notification of its award decision on June 27, 2025. COS/MOL at 1. After requesting and receiving a debriefing that concluded on July 15, 2025, CIYIS filed this protest with our Office. AR, Tab 5, Notice of Award and Debrief.

DISCUSSION

CIYIS challenges the Navy's evaluation of CIYIS's organizational experience as unacceptable. Specifically, the protester argues that the agency's evaluation was unreasonable because it was based on an improper application of the RFP's recency criteria and was not conducted in accordance with the terms of the solicitation. For the reasons discussed below, we find the protester's arguments provide no basis to sustain the protest.[6]

The evaluation of an offeror's proposal is a matter within the agency's discretion. National Gov't Servs., Inc., B-401063.2 et al., Jan. 30, 2012, 2012 CPD ¶ 59 at 5. In reviewing protests challenging an agency's evaluation of proposals, our Office does not reevaluate proposals or substitute our judgment for that of the agency but rather examines the record to determine whether the agency's judgment was reasonable and in accord with the stated evaluation criteria and applicable procurement laws and regulations. Veterans Evaluation Servs., Inc. et al., B-412940 et al., July 13, 2016, 2016 CPD ¶ 185 at 6. A protester's disagreement with the agency's judgment in evaluating proposals or in its determination of the relative merit of competing proposals, without more, does not establish that the evaluation was unreasonable. Id. at 8-9.

Organizational Experience

As noted above, the agency assessed one weakness, two significant weaknesses, and three deficiencies to the protester's proposal under the organizational experience factor, which resulted in a rating of unacceptable for this factor. Specifically, the agency assigned the deficiencies and weaknesses because CIYIS's proposal failed to demonstrate breadth and depth of involvement within each key area as required by the RFP. AR, Tab 3, SSEB Report at 264. The protester challenges all three weaknesses and three deficiencies, and in each instance, alleges that the agency misunderstands its proposal or that its experience complied with the RFP's requirements. The agency responds that it carefully considered CIYIS's proposal and assessed each weakness and deficiency in accordance with the RFP evaluation criteria and applicable laws and regulations. COS/MOL at 7. Based on our review, we find the protester's arguments unavailing. We discuss two representative examples below.

As relevant to the protest, under the organizational experience factor, the RFP required offerors to complete and submit an organizational experience matrix, provided with the solicitation as attachment 1. RFP, amend. 0002 at 139. The solicitation explained that, using the matrix, offerors were to indicate the breadth, depth, and relevance of their organizational experience, since January 1, 2019, in the following six key areas: (1) business applications, (2) data and artificial intelligence (AI), (3) digital and app innovation, (4) infrastructure, (5) modern work, and (6) security. Id.

In completing the organizational experience matrix, the RFP instructed offerors to provide at least one reference for work performed by the prime contractor, no more than one reference per subcontractor, and no more than five references total. Id. For each reference provided, offerors were to prepare and submit a reference information sheet in accordance with the instructions on the sheet. Id. As relevant here, block 17 of the reference information sheet, which was included as attachment 2 to the RFP, required that offerors provide, for each reference, a summary description of the contract work, not to exceed three additional single-sided pages in length for each cited reference. Id. The solicitation specified that, in completing the summary descriptions of contract work, offerors must explain the relevance of each cited reference with respect to one or more of the key areas. Id. In this regard, the RFP provided that, in completing the summary descriptions of contract work, offerors were to “clearly format the response to separate the discussion for each [k]ey [a]rea.” Id. The solicitation cautioned that offerors should “not provide a consolidated response for multiple key areas.” Id.

With regard to the evaluation of organizational experience, the RFP explained that “[e]xperience is the opportunity to learn by doing” and that an offeror's “organizational experience is relevant when it has been confronted with the kinds of challenges it will likely face under the contract contemplated by this RFP.” Id. at 181. The solicitation provided that the agency would evaluate “the breadth, depth and relevance of offeror organizational experience,” since January 1, 2019, “in the [k]ey [a]reas identified.” Id. The RFP noted that relevance “may include, but is not limited to, similarity to work contemplated under the RFP with respect to complexity, length of performance, number of tasks, scope, type of work, and value.” Id. The solicitation stated that offerors “need not address all [of the] [k]ey [a]reas in the summary description of each reference,” but that “[f]or evaluation purposes, ratings may be maximized” for offerors that cite “organizational experience references that collectively demonstrate maximum breadth and depth of relevant experience in the [k]ey [a]reas.” Id. at 139, 182. The solicitation further noted that in evaluating the offeror's experience in each individual key area, “the Government will consider only the text designated in response to [b]lock 17 of the [r]eference [i]nformation [s]heet for that particular [k]ey [a]rea.” Id.

CIYIS's organizational matrix identified two contract references. AR, Tab 2(b), CIYIS Proposal at 240. The first is a contract with the Army, with a period of performance ending February 28, 2019, which CIYIS indicated provides relevant experience to the first four key areas. Id. at 240-243. The second reference is a contract with the Department of Energy, with a period of performance from May 16, 2023, to September 29, 2023, which CIYIS indicated provides relevant experience to the first, fifth, and sixth key areas. Id. at 240, 244-246.

Key Area 2 (Data and AI)

As noted above, the agency assessed a deficiency to the protester's proposal under the organizational experience factor for key area 2--data and AI (Azure, Copilot, etc.).[7] AR, Tab 3, SSEB Report at 263. With regard to the key areas, the performance work statement (PWS) included the following requirements: IT strategic enterprise architecture and planning support, architecting and deploying core enterprise infrastructure technologies support, enterprise application development project services support, collaboration design and deployment of enterprise information services support, enterprise suite design and deployment services support, cyber security services, cyber security incident response, datacenter management and data insights, cloud management and secure infrastructure, and AI and other emerging technologies. AR, Tab 1, RFP amend. 0002, at 158-159.

As relevant here, CIYIS indicated in its proposal that only its first reference supported key area 2. AR, Tab 2(b), CIYIS Proposal at 240. In the corresponding reference information sheet, CIYIS included one paragraph addressing key area 2. Id. In evaluating CIYIS's proposal, the agency noted that CIYIS “cites only a single, extremely limited example of relevant [d]ata [and] AI experience.” AR, Tab 3, SSEB Report at 263 (citing AR, Tab 2(b), CIYIS Proposal at 242). The agency found CIYIS's “proposal as limited to only architecting/design activities,” which the agency explained, “materially fails to provide insights into the many other aspects of this Key Area.” Id. In addition, the agency noted that CIYIS's “depth of involvement with this Key Area . . . was limited to only 2-months of in-scope work as per [the] Government's recency requirements.” Id. Accordingly, the agency assessed a deficiency. Id.

The protester disagrees with the agency's evaluation, asserting that the “agency's dismissal of [its] work as ‘limited to architecting/design activities' . . . fails to recognize the scope and impact of CIYIS'[s] Enterprise Architecture work as it relates to the PWS 4.0 activities such as:” IT strategic enterprise architecture and planning support, architecting and deploying core enterprise infrastructure technologies support, cloud management and secure infrastructure, and AI and other emerging technologies. Protest at 7; Comments at 11-12. The protester also contends that by finding CIYIS's depth of involvement with the key area “was limited to only 2-months of in-scope work,” the agency applied the RFP's recency criteria “inconsistently and arbitrarily.” Protest at 4.

The agency responds that CIYIS's proposal “provided only limited information to support its experience and never stated in its proposal how its activities related to the PWS[.]” COS/MOL at 9. The agency states that “CIYIS' proposal was limited, without detail, and stated little beyond high level information about what it did under [r]eference 1 under [k]ey [a]rea 2.” Id. The agency explains that “CIYIS did not detail its activities and offered no experience where it implemented or deployed what was ‘architeched/designed.'” Id. With regard to the recency criteria, the agency maintains that it properly noted that both of the references submitted by CIYIS were of limited duration in accordance with the RFP. COS/MOL at 14.

Based on our review, we find nothing unreasonable regarding the agency's assessment of the deficiency. Although the protester contends that the evaluators improperly found that its experience was “limited to architecting/design activities” because the agency “fail[ed] to recognize the scope and impact of CIYIS' [e]nterprise [a]rchitecture work as it relates to [four listed] PWS 4.0 activities[,]” the protester did not explain in its proposal or demonstrate how the cited experience showed experience in those PWS areas. Protest at 7. It is an offeror's responsibility to submit a well-written proposal, with adequately detailed information that clearly demonstrates compliance with the solicitation requirements and allows for meaningful review. MIG Constr. Partners, B‑419818.4, B-419818.9, May 24, 2022, 2022 CPD ¶ 120 at 5. To the extent the protester intended to show that its contract work demonstrates experience with regard to particular PWS requirements, it was incumbent upon the protester to include that information in its proposal. The protester failed to do so here.

We also find nothing unreasonable regarding the agency's application of the RFP's recency criteria. As noted above, the RFP established that work performed before January 1, 2019, would not be considered. AR, Tab 1, RFP, amend. 0002 at 181 (“This evaluation will consider the breadth, depth and relevance of offeror organizational experience since 01 January 2019 in the Key Areas identified in the Submission of Proposals section.”). The RFP also explained that “[r]elevance may include, but is not limited to, similarity to work contemplated under the RFP with respect to complexity, length of performance, number of tasks, scope, type of work, and value.” RFP at 181 (emphasis added). The record reflects that the two references provided by CIYIS were of limited duration. AR, Tab 2(b), CIYIS Proposal at 241 (reflecting for reference 1 a start date of August 11, 2017, and end date February 28, 2019); id. at 244 (reflecting for reference 2 a start date of May 16, 2023, and an end date of February 29, 2024). As mentioned above, in evaluating CIYIS's reference 1 experience for key area 2, the agency found that CIYIS's “depth of involvement with this Key Area . . . was limited to only 2-months of in-scope work as per [the] Government's recency requirements.” Id. While the protester argues that the agency's evaluation in this regard was unreasonable because “[n]o minimum duration was defined in the solicitation,” Comments at 8, we find nothing improper or inconsistent regarding the agency's assessment that CIYIS's “depth of involvement with this Key Area . . . was limited to only 2-months of in-scope work as per [the] Government's recency requirements.” AR, Tab 3, SSEB Report at 263. The protester's disagreement with the evaluation, without more, is not sufficient to render the evaluation unreasonable.

Key Area 6 (Security)

The agency also assigned a deficiency to CIYIS's proposal for its organizational experience with regard to key area 6--security (Defender, Entra, Intune, etc.).[8]

CIYIS indicated in its proposal that only its second reference supported key area 6, and the protester provided two sentences in its reference information sheet to demonstrate its experience in this area. AR, Tab 2(b), CIYIS Proposal at 240, 246.

In evaluating the protester's proposal, the agency found that CIYIS “cites only a single, extremely limited example of relevant Microsoft Security experience.” AR, Tab 3, SSEB Report at 264 (citing AR, Tab 2(b), CIYIS Proposal at 246). The evaluators stated that they “find [CIYIS's] involvement in this Key Area as extremely limited in both breadth and depth within the scope of Microsoft Security products and services, specifically only within the narrow field of identity management and authentication controls, and only for performing functional and technical architecture design and assessment.” Id. The agency concluded that CIYIS's proposal “materially fails to provide insights into the many other aspects of Microsoft Security” and “[f]urthermore, [CIYIS's] depth of involvement within this Key Area as listed in [its] Reference [No.] 2, was limited to less than 10-months of in-scope work as per Government's recency requirements.” Id. As such, the agency assessed a deficiency for this key area. Id.

The agency further explained in response to the protest that “[s]ecurity is an integral piece throughout Microsoft products, and yet CIYIS provided such limited information to demonstrate its experience in this area.” COS/MOL at 11. In this regard, the agency states that CIYIS should have had “much more to say [about security] as it permeates the entire process[;] however, “[i]n its proposal, CIYIS stated it ‘identified' things but never provided the solution or any work it performed to implement or deploy proposed solutions.” Id. (citing AR, Tab 2(b), CIYIS Proposal at 246).

In response, the protester asserts that its proposal also addressed “business process analysis, capability needs, and requirements definition in the integration with existing identity systems and the [agency] network.” Protest at 8. The protester contends that the “agency's dismissal of this work as limited to ‘identity access management' ignores its relevance to activities in PWS 4.0,” such as: IT strategic enterprise architecture and planning support, architecting and deploying core enterprise infrastructure technologies support, cyber security services support, cloud management and secure infrastructure, and AI and other emerging technologies. Id. at 8-9; Comments at 17-18.

Based on our review, we find nothing unreasonable regarding the agency's evaluation of the deficiency. The agency found that the information provided in CIYIS's proposal was insufficient to adequately demonstrate experience with the security key area. While the protester points to its proposal generally and asserts that the agency should have found that its proposal demonstrated experience with particular PWS activities, CIYIS did not state in its proposal how its activities related to the PWS. AR, Tab 2(b), CIYIS Proposal at 246. Nor does the protester provide any explanation in its protest as to how its experience related to the PWS activities. Protest at 8-9; Comments at 17-18. As previously referenced, it is an offeror's responsibility to submit a well-written proposal, with adequately detailed information that clearly demonstrates compliance with the solicitation requirements and allows for meaningful review. MIG Constr. Partners, supra. Here, the agency had no obligation to infer details of CIYIS's experience that CIYIS did not describe in its proposal. The protester's disagreement with the evaluation, without more, is not sufficient to render the evaluation unreasonable.

Ultimately, the agency concluded that CIYIS's proposal was unacceptable under the organizational experience factor because the “overall depth of involvement across the Government's Key Area requirements does not meet the requirements of the solicitation.” AR, Tab 3, SSEB Report at 264. As the agency points out in response to the protest, “while the RFP allowed the offeror to append up to three single-spaced pages to each contract reference to provide a summary description of the contract work explaining its relevance with respect to one or more of the [k]ey [a]reas,” CIYIS “submitted only about one and a half pages for its first contract reference” and “just one page and four lines” for its other reference. COS/MOL at 6; AR, Tab 2(b), CIYIS Proposal at 240-246. The agency found that “[w]hile [CIYIS] does demonstrate some very limited experience in the Key Areas being evaluated, the breadth of that technical capability is extremely limited[.]” Id. The agency found that, “[as] a result, . . . [CIYIS's] [o]rganizational [e]xperience carries an unacceptable risk due to the combination of three [d]eficiencies[,] two [s]ignificant [w]eaknesses, and one [w]eakness, which significantly increases the risk of unsuccessful performance when providing services outside their limited, highly-focused experiences[.]” Id. In response to the protest, the agency further explains that “[i]n summary, CIYIS[‘s] proposal did not provide sufficient information to explain the breadth, depth and relevance of its experience in each of the six Key Areas,” but instead, “CIYIS' proposal presented high level information, lacked detail, and focused on planning stages with no information about how CIYIS implemented or deployed what it had planned.” COS/MOL at 7. The protester has failed to demonstrate that the agency's evaluation was unreasonable or not in compliance with the solicitation or applicable procurement regulations.

The protest is denied.

Edda Emmanuelli Perez
General Counsel

---