G2 Ops, Inc.

DOCUMENT FOR PUBLIC RELEASE

The decision issued on the date below was subject to a GAO Protective Order. This version has been approved for public release.

Decision

Matter of: G2 Ops, Inc.

File: B-423967

Date: February 13, 2026

Jon Levin, Esq., Womble Bond Dickinson (US) LLP, for the protester.
Daniel R. Forman, Esq., and James G. Peyster, Esq., Crowell & Moring LLP, for Amazon Web Services, Inc., the intervenor.
Anthony J. Balestreri, Jr., Esq., and Maurice R. Griffithe, Esq, Defense Information Systems Agency, for the agency.
Janis R. Millete, Esq., and John Sorrenti, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision.

DIGEST

1. Protest that the agency was required to issue the protester a follow-on Small Business Innovative Research (SBIR) phase III contract on a sole-source basis is denied because such action is not required where the agency was not pursuing production of the technology developed by the SBIR awardee under its prior awards, and did not otherwise seek to further use the technology.

2. Protester is not an interested party to challenge the issuance of a sole-source task order under a multiple-award indefinite-delivery, indefinite-quantity (IDIQ) contract when the protester does not hold one of the IDIQ contracts.

DECISION

G2 Ops, Inc., a women-owned small business of Virginia Beach, Virginia, protests the issuance of a task order to Amazon Web Services (AWS) of Seattle, Washington, under request for proposals (RFP) No. HC105025F0049, issued by the Defense Information Systems Agency (DISA) on behalf of its mission partner Naval Sea Systems Command (NAVSEA) for “lift and shift” cloud migration services under the Joint Warfighting Cloud Capability (JWCC), multiple-award, indefinite-delivery, indefinite-quantity (IDIQ) contract. The protester asserts that the sole-source award to AWS is improper because the requirement uses G2 Ops Small Business Innovation Research (SBIR) technologies, which requires the agency to instead make a follow-on SBIR phase III award to G2 Ops.

We deny the protest in part and dismiss it in part.

BACKGROUND

The SBIR program is designed to increase the participation of small business concerns in federally funded research or research and development (R/R&D). See SBIR Program Act of 1982, 15 U.S.C. § 638 (the “SBIR statute”). The program has three phases. Under phase I, firms competitively apply for an award to test the scientific, technical, and commercial merit and feasibility of a concept. 15 U.S.C. § 638(e)(4)(A). If this is successful, a firm may be invited to apply for a phase II award to further develop the concept. Id. § 638(e)(4)(B). Under SBIR phase III, an agency may issue a phase III SBIR award for “work that derives from, extends, or completes efforts made under prior funding agreements under the SBIR program[.]”[1] 15 U.S.C. § 638(e)(4)(C).

On May 11, 2021, G2 Ops received a SBIR phase III contract to “utilize advancements in Embedded Cyber Resiliency technology” for NAVSEA. Agency Report (AR), Tab 1, G2 Ops, SBIR Phase III Award at 1;[2] Comments at 8-9. Part of this contract included general support for NAVSEA's cloud environment that G2 is still providing to the agency. AR, Tab 2, SBIR Phase III Statement of Work at 15-16; Protest at 1.

This protest involves the agency's procurement of services to move from NAVSEA's existing cloud environment to the Bluewater secure cloud computing architecture (SCCA) under the JWCC contract. Contracting Officer's Statement and Memorandum of Law (COS/MOL) at 3-4. The agency explains that the purpose of the JWCC contract is to move from the “legacy contractor-operated environment . . . and into the Government-engineered Bluewater cloud ecosystem.” Id. at 6. To that end, from June 2024 to April 2025, the agency conducted market research to identify potential providers for the required “lift-and-shift” cloud migration services. AR, Tab 4, Market Research Report at 2-3. As part of its research, the agency reviewed previous results for similar services, relevant databases, and information provided by agency advisors with expertise in cloud security requirements. COS/MOL at 11-12; see AR, Tab 4, Market Research Report at 2-3. In addition to reviewing capability statements by JWCC contract holders, the agency considered alternative sources including other DISA contract vehicles and government-wide acquisition contract vehicles. See AR, Tab 4, Market Research Report at 3. Based on market research, the agency determined that AWS, as one of the JWCC IDIQ contractors, was the only firm that could provide the “lift-and-shift migration approach” without “significant redevelopment of existing systems.” See id.

The agency then prepared a justification and approval (J&A) for the proposed sole-source task order to AWS under the JWCC. See AR, Tab 5, J&A. The J&A relied on the authority provided by 10 U.S.C. § 3204(a) and Federal Acquisition Regulation (FAR) section 16.505(b)(2)(i)(B). Under 10 U.S.C. § 3204(a), an agency can limit competition if the agency's requirements are only available for one responsible source and FAR section 16.505(b)(2)(i)(B) sets forth an exception to the fair opportunity requirement for competition among multiple award IDIQ contract holders where only one of the multiple awardee contractors is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.[3] Id. at 2. In this regard, the agency explained that AWS is the only JWCC cloud service provider capable of performing the required transition of the cloud environment without “operational risk” or “mission degradation.”[4] Id. at 4.

On Sept. 18, the agency issued the task order to AWS, under the JWCC multiple-award, IDIQ contract. COS/MOL at 15; AR, Tab 7, Task Order Award at 1.

On Sept. 26, G2 Ops filed this protest.[5]

DISCUSSION

G2 Ops asserts that the agency's issuance of a task order to AWS on a sole-source basis is improper because the requirement here uses G2 Ops-derived technology that the protester provided under a previous SBIR phase III award. Protest at 1-2. As a result, the protester contends that the agency is required to instead award G2 Ops a sole-source follow-on contract. See Protest at 1-2; Comments at 2. Specifically, the protester claims that it developed the technology being procured, and that the requirement uses a “G2 Ops-engineered, SBIR-protected system” built under its phase III contract.[6] Protest at 1. The protester also contends that the agency's J&A does not support the decision to issue a sole-source task order to AWS. Id. at 2.

The agency responds that its sole-source award to AWS is proper because the agency does not “seek[] further development of [G2 Ops'] SBIR protected technologies or innovations[.]” COS/MOL at 22. Specifically, the new task order requirement does not seek to “further develop any of G2 Ops' modeling and documentation automation technologies[.]” Id.

Challenge to the Sole-Source Task Order

To implement the SBIR program, the Small Business Administration has promulgated the SBIR/STTR [Small Business Technology Transfer] Program Policy Directive through notice and comment rulemaking. See 84 Fed. Reg. 12794-849 (Apr. 2, 2019). As relevant here, the policy directive states as follows regarding phase III work:

(c) Phase III. Phase III refers to work that derives from, extends, or completes an effort made under prior SBIR/STTR Funding Agreements, but is funded by sources other than the SBIR/STTR programs.

SBIR/STTR Policy Directive § 4(c)(1).

The policy directive further establishes the requirements for the competition of phase III awards, in particular, where agencies “pursue R/R&D or production of technology developed under the SBIR/STTR program [it] shall issue Phase III awards relating to the technology, including sole source awards, to the Awardee that developed the technology under an SBIR/STTR award, to the greatest extent practicable, consistent with an Agency's mission and optimal small business participation.” Id. §§ 4(c)(3) and 4(c)(7). In this regard, the policy directive implements the SBIR statute which states:

To the greatest extent practicable, Federal agencies and Federal prime contractors shall— (A) consider an award under the SBIR program or the STTR program to satisfy the requirements under sections 3201 through 3205 of title 10 and any other applicable competition requirements; and (B) issue, without further justification, Phase III awards relating to technology, including sole source awards, to the SBIR and STTR award recipients that developed the technology.

15 U.S.C. § 638(r)(4).

Our Office analyzed this language in a previous decision and found that the policy directive's preference for an SBIR phase III award applies when the agency “specifically ‘pursue[s] the R/R&D or production of technology developed under the SBIR/STTR program'” and therefore applies only when the agency “seeks the specific technology developed by the SBIR awardee under its prior awards.” PublicRelay, B-421154, B-421154.2, Jan. 17, 2023, at 7-8.

In response to G2 Ops' protest, the agency submitted a declaration from the deputy chief information officer (CIO) and program manager for NAVSEA's Bluewater cloud program in which the deputy CIO addresses G2 Ops' existing SBIR contracts and the agency's new requirement at issue here. COS/MOL at 4; AR, Tab 12, Decl. of Deputy CIO. The deputy CIO explains that G2 Ops' SBIR work involved embedded cyber resiliency technology that included modeling techniques, baseline and change management to track engineering and cybersecurity requirements in model files, and cybersecurity risk assessment, among other things. AR, Tab 12, Decl. of Deputy CIO at 1-2. The deputy CIO further asserts that G2 Ops' “SBIR-protected technology relates solely to modeling artifacts, documentation automation, and model-based risk analytics” and that it did not involve development of cloud architectures, SCCA baselines, or operational configurations of NAVSEA's cloud environment. Id. at 2. The deputy CIO states that G2 Ops did not create the NAVSEA cloud environment, and the general cloud support it provided under its SBIR contract was not subject to “SBIR protection” because it was not part of G2 Ops' embedded cyber resiliency technology. Id. at 2, 7.

The deputy CIO explains that the scope of the task order issued to AWS involves the transition, or “lift and shift” from legacy requirements to a new cloud environment, Bluewater, which is the agency's “new cloud ecosystem.” Id. at 3. The deputy CIO explains that Bluewater is a government-developed, government-owned SCCA that replaces the existing legacy cloud environment that was configured by a different contractor and operated by G2 Ops under its SBIR contract. Id. The agency states that the Bluewater SCCA contains no SBIR configurations or SBIR-protected technology and specifically does not use G2 Ops' alleged SBIR-protected technology. Id. In addition, the agency explains that the task order work “does not describe or require use of G2 Ops' SBIR-derived modeling tools or any SBIR-protected technology.”[7] Id. The agency further reiterates that “[n]othing from G2 Ops' [prior SBIR contract] is used, referenced, or replicated when moving to the JWCC contract.” Id. at 7. Ultimately, the agency contends there is no transfer of G2 Ops' SBIR data or replication of SBIR configurations, and no G2 Ops' technology under the new system. Id. at 5.

The protester raises two main arguments in response to the agency. First, the protester alleges that the Bluewater cloud has not received an authorization to operate and therefore is not deployable, which demonstrates that the agency is “not lifting and shifting to an approved environment, but to something that does not yet exist.” Comments at 4-7. Second, the protester takes issue with the agency's characterization of its prior work on SBIR contracts and contends that it performed much more comprehensive work on those contracts. Id. at 7-12.

With respect to the first argument, the protester contends that the declaration from the deputy CIO is inconsistent with the J&A with regard to the status of the Bluewater SCCA. In this regard, G2 Ops points to statements in the J&A explaining that Bluewater is the Navy's “designated modernization framework” and that “[s]upport structures are being established for the new Bluewater environment[.]” Comments at 5 (quoting AR, Tab 5, J&A at 2, 3). The protester argues that these statements show that Bluewater is a “system in progress” that does not have authority to operate. In contrast, according to G2 Ops, only the deputy CIO “avers that Bluewater already exists as a stand-alone, authorized cloud system.” Id. The protester asserts that the post-hoc statements by the deputy CIO should be disregarded in favor of the contemporaneous statements in the J&A, and that because Bluewater is not yet operative, the agency is actually utilizing the existing system that includes G2 Ops' SBIR technology and data. Comments at 6-7.

On this record, we do not find that G2 Ops' argument regarding Bluewater's authorization status convincing. To begin with, there is nothing in the record to support the protester's argument that Bluewater does not have authority to operate. In this regard, the language in the J&A that the protester relies on does not, in our view, support its argument. The J&A statements that Bluewater is the modernization “framework” and that support structures are being established for Bluewater do not indicate that Bluewater does not exist or does not have authority to operate. Indeed, if support structures are being established for Bluewater, this suggests that the system exists and new structures are being developed to further support the system. In addition, nothing in the J&A speaks to Bluewater's authority to operate.

Moreover, even if Bluewater is not yet fully developed or does not have an authority to operate, G2 Ops has not contradicted the agency's explanation that nothing in work awarded to AWS involves the use of G2 Ops' SBIR technology. Accordingly, G2 Ops has not explained how the possibility that Bluewater is not fully developed means the agency is required to award the JWCC task order work to G2 Ops as a SBIR phase III contract.

G2 Ops next takes issue with the agency's characterization of G2 Ops' work on its prior SBIR contracts. The protester insists that it performed more than “document, modeling, and configuration management” and that its work involved “complex modeling, software scripting, and attack simulations.” Comments at 9, 10. G2 Ops maintains that its work resulted in a “G2-developed [e]mbedded [c]yber [r]esiliency-enhanced cloud environment” and that the agency's justifications for the sole-source award to AWS “inevitably make use [of] G2 technologies.” Id. at 10-12.

On our review of the record, we do not find that G2 Ops' explanation of its work on its prior SBIR contracts demonstrates that the agency was required to issue a SBIR phase III contract to the protester. As explained above, the agency has unequivocally stated that the Bluewater SCCA contains no SBIR configurations or SBIR-protected technology. The agency also asserted that it “has no need for G2 Ops alleged SBIR protected data or technology” and “no intention [to] provid[e] any SBIR-based data or technology to AWS, and AWS has no requirement to use or interact with [G2 Ops] data or technology to perform the work in the JWCC task order.” AR, Tab 12, Decl. of Deputy CIO at 1. The protester does not counter these specific statements but rather recounts the work it performed on its prior SBIR contracts without explaining the specific SBIR technology the agency is seeking for use in the JWCC task order. Instead, G2 Ops makes broad statements that the sole-source award must “make use” of G2 Ops' technologies or that the agency “continues to rely on a system with G2's data” and that the “existing system includes the data G2 developed[.]” Comments at 7-10.

On this record, G2 Ops' protest fails to establish that the task order at issue reflects the agency's pursuit of technology that was developed under G2 Ops' prior SBIR phase III award. Inkit Inc., B-423724, Sept. 9, 2025, at 5; PublicRelay, supra, at 9. More specifically, G2 Ops fails to provide meaningful discussion that connects its prior work and SBIR technology to the technology being acquired under the new task order at issue. Inkit Inc., supra. As a result, the protester has not demonstrated that the agency was required to award the work under the JWCC task order to G2 Ops as a SBIR phase III contract and therefore deny this protest ground.

Challenge to Justification for Exception to Fair Opportunity

The protester also contends that the sole-source award to AWS under the JWCC IDIQ contract is improper and based on a defective J&A that is dependent on flawed market research. Comments at 12-13. In this regard, G2 Ops alleges that the J&A is flawed because AWS is not the only capable source able to perform the work, rather, the protester asserts it is the incumbent “already performing the precise work[,]” specifically that it “possesses the unique configurations and proprietary knowledge to accomplish the transition efficiently and at lower risk and cost.” Protest at 2.

The agency contends that G2 Ops is not an interested party to challenge the JWCC task order because it is not a JWCC contract holder and furthermore defends that its J&A is “well[-]documented and supported by adequate market research.” COS/MOL at 23, 25. As stated, the agency awarded a task order to AWS, under an exception to the fair opportunity process where it determined that AWS was the only JWCC contractor capable of performing the transition of the cloud environment without “operational risk” or “mission degradation.” AR, Tab 5, J&A at 4.

Agencies that issue orders under multiple-award IDIQ contracts must provide all contract holders a “fair opportunity to be considered” for the issuance of all orders in excess of the simplified acquisition threshold. 10 U.S.C. § 2304c(b); FAR § 16.505(b)(1). In addition, all orders over the simplified acquisition threshold “shall be placed on a competitive basis,” following the procedures set forth in FAR section 16.505(b)(1). As discussed above, the agency issued a task order to AWS, under an exception to the fair opportunity process where it determined AWS was the only JWCC contractor capable of performing the transition of the cloud environment without “operational risk” or “mission degradation.” COS/MOL at 15; AR, Tab 7, Task Order Award at 1.

Under the bid protest provisions of the Competition in Contracting Act of 1984, only an “interested party” may protest a federal procurement. 31 U.S.C. § 3551(1)-(2). An interested party is an actual or prospective offeror whose direct economic interest would be affected by the award or failure to award a contract--or in this case, task order. 4 C.F.R. § 21.0(a)(1). If a protester does not hold the relevant IDIQ, it is not in line for issuance of a task order under that IDIQ contract. Inkit Inc., supra, at 4. In this respect, only IDIQ contract holders are interested parties to challenge the sufficiency of a sole-source task order. Id.

Here, G2 Ops does not hold the JWCC IDIQ contract under which the task order was issued. COS/MOL at 15. Accordingly, we conclude that G2 Ops is not an interested party to challenge the agency's sole-source task order to AWS under the JWCC IDIQ contract. This protest ground is dismissed.

The protest is denied in part and dismissed in part.[8]

Edda Emmanuelli Perez
General Counsel

---