G2 Ops, Inc.

DOCUMENT FOR PUBLIC RELEASE

The decision issued on the date below was subject to a GAO Protective Order. This version has been approved for public release.

Decision

Matter of: G2 Ops, Inc.

File: B-424013

Date: February 19, 2026

W. Brad English, Esq., Maynard Nexsen PC, for the protester.
Amy Laderberg O'Sullivan, Esq., Issac D. Schabes, Esq., and Emily P. Golchini, Esq., Crowell & Moring LLP, for Microsoft Corporation, the intervenor.
Anthony J. Balestreri, Jr., Esq., and Maurice R. Griffithe, Esq., Defense Information Systems Agency, for the agency.
Janis R. Millete, Esq., and John Sorrenti, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision.

DIGEST

1. Protest that the agency was required to issue the protester a follow-on Small Business Innovative Research (SBIR) phase III contract on a sole-source basis is denied because such action is not required where the agency was not pursuing production of the technology developed by the SBIR awardee under its prior awards, and did not otherwise seek to further use the technology.

2. Protest alleging that a proposed task order is outside of the scope of the underlying indefinite-delivery, indefinite-quantity (IDIQ) contract because the work relies on the protester's SBIR technology is denied where the record does not support a finding that the task order requires the use of the protester's technology.

DECISION

G2 Ops, Inc., a women-owned small business of Virginia Beach, Virginia, protests the issuance of a task order to Microsoft Corporation, of Redmond, Washington, under request for proposals (RFP) No. HC105025F0053, issued by the Defense Information Systems Agency (DISA), on behalf of its mission partner Naval Sea Systems Command (NAVSEA) for “lift and shift” cloud migration services. The task order was issued under the Department of Defense, Joint Warfighting Cloud Capability (JWCC), multiple-award, indefinite-delivery, indefinite-quantity (IDIQ) contract. The protester asserts that the sole-source award to Microsoft is improper because the requirement is dependent on G2 Ops' Small Business Innovation Research (SBIR) technologies and, as a consequence, the agency should have instead made a follow-on SBIR phase III award to G2 Ops.

We deny the protest.

BACKGROUND

The SBIR program is designed to increase the participation of small business concerns in federally funded research or research and development (R/R&D). See SBIR Program Act of 1982, 15 U.S.C. § 638 (the “SBIR statute”). The program has three phases. Under phase I, firms competitively apply for an award to test the scientific, technical, and commercial merit and feasibility of a concept. 15 U.S.C. § 638(e)(4)(A). If this is successful, a firm may be invited to apply for a phase II award to further develop the concept. Id. § 638(e)(4)(B). Under phase III, an agency may issue an award for “work that derives from, extends, or completes efforts made under prior funding agreements under the SBIR program[.]”[1] 15 U.S.C. § 638(e)(4)(C).

On May 11, 2021, G2 Ops received a SBIR phase III contract to provide “Embedded Cyber Resiliency” technology for NAVSEA. Agency Report (AR), Tab 1, G2 Ops, SBIR Phase III Award at 1;[2] Protest at 4. Part of this contract included general support for NAVSEA's cloud environment that G2 Ops is still providing to NAVSEA. AR, Tab 2, SBIR Phase III Statement of Work at 15-16; See Protest at 5.

This protest involves the agency's procurement of services to move from NAVSEA's existing cloud environment to the Bluewater secure cloud computing architecture (SCCA) pursuant to a task order issued under the JWCC contract. Contracting Officer's Statement and Memorandum of Law (COS/MOL) at 3-4. The agency explains that the purpose of the JWCC contract is to move from the “legacy contractor-operated environment . . . and into the Government-engineered Bluewater cloud.” Id. at 6. To that end, from January to August 2025, the agency conducted market research to identify potential providers for the required “lift-and-shift” cloud migration services. AR, Tab 4, Market Research Report at 2-4. As part of its research, the agency reviewed previous results for similar services, relevant databases, and information provided by agency advisors with expertise in cloud security requirements. COS/MOL at 14-16; see AR, Tab 4, Market Research Report at 1-3. In addition to reviewing capability statements by JWCC contract holders, the agency considered alternative sources including other DISA contract vehicles and government-wide acquisition contract vehicles. See AR, Tab 4, Market Research Report at 3. Based on market research, the agency determined that Microsoft, as one of the JWCC IDIQ contractors, was the only firm that could provide the “lift-and-shift migration approach” without “significant redevelopment of existing systems.” See id.

The agency then prepared a justification and approval (J&A) for the proposed sole-source task order to Microsoft under the JWCC. See AR, Tab 5, J&A. The J&A relied on the authority provided by 10 U.S.C. § 3204(a) and Federal Acquisition Regulation (FAR) section 16.505(b)(2)(i)(B). Under 10 U.S.C. § 3204(a), an agency can limit competition if the agency's requirements are only available from one responsible source and FAR section 16.505(b)(2)(i)(B) sets forth an exception to the fair opportunity requirement for competition among multiple award IDIQ contract holders where only one of the multiple awardee contractors is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized.[3] Id. at 2. In this regard, the agency explained that Microsoft is the only cloud service provider capable of performing the required transition of the cloud environment without “operational risk” or “mission degradation.”[4] Id. at 4.

On Sept. 22, the agency issued the task order to Microsoft, under the JWCC multiple-award, IDIQ contract.[5] COS/MOL at 18; AR, Tab 6, Task Order Award at 1. On Nov. 13, G2 Ops filed this protest.[6]

DISCUSSION

G2 Ops asserts that award to Microsoft is improper because the task order requirement here uses G2 Ops-derived technology that the protester provided under a previous SBIR phase III award. Protest at 11. As a result, the protester contends that the agency is required to instead award G2 Ops a sole-source follow-on contract. See id. The protester also contends that issuance of the task order to Microsoft is improper because the services are outside the scope of the JWCC IDIQ contract. Protest at 12-13; Comments at 20-21. We have reviewed the protester's allegations and find no basis to sustain the protest.[7]

Interested Party

As a preliminary matter, we address whether G2 Ops is an interested party to protest. Prior to the agency report due date, the agency and intervenor filed requests for dismissal. See generally Agency Req. for Dismissal; see also Intervenor Req. for Dismissal. Both argue that the protester is not an interested party because its licensing agreement to sell Microsoft Azure had expired, and that a licensing agreement was required in order to perform the work required by the task order. Intervenor Req. for Dismissal at 2-3. We reject this argument and find that G2 Ops is an interested party.

Under the bid protest provisions of the Competition in Contracting Act of 1984 (CICA), 31 U.S.C. §§ 3551-3557, only an “interested party” may protest a federal procurement. Our regulations implementing CICA define an interested party as an actual or prospective bidder or offeror whose direct economic interest would be affected by the award of a contract or the failure to award a contract. 4 C.F.R. § 21.0(a)(1). Determining whether a protester is interested involves consideration of a variety of factors, including the nature of issues raised, the benefit of relief sought by the protester, and the protester's status in relation to the procurement. Criterion Sys., Inc., B-419749 et al., July 21, 2021, at 5. A protester is not an interested party if it would not be in line for contract award were its protest to be sustained. Id.

In response to the dismissal requests, G2 Ops explains that Microsoft, the intervenor and recipient of the task order, refused to renew G2 Ops' reseller license for Microsoft Azure despite multiple requests from G2 Ops to renew the license. Comments at 5-6. G2 Ops asserts that it can nevertheless obtain a license from another reseller other than Microsoft. Id. at 7. G2 Ops also contends that if its protest is sustained, the agency would be required to make a good faith effort to negotiate and issue a sole-source phase III award to G2 Ops and therefore it is in line for award. Id. at 6-7.

Based on our review of the record, we deny the requests for dismissal and find that G2 Ops is an interested party. G2 Ops indicated its ability to secure a license from a source other than Microsoft. Furthermore, the protester is challenging the agency's determination not to issue the requirement as a phase III SBIR contract. See generally Protest. If the protest were to be sustained because the requirement should have been set-aside for G2 Ops as a phase III SBIR award, G2 Ops would necessarily be in line for award, and presumably could address any licensing requirement at that time. As such, we decline to dismiss the protest on the basis that the protester is not an interested party.[8]

Challenge to the Sole-Source Task Order

By way of background, to implement the SBIR program, the Small Business Administration has promulgated the SBIR/STTR [Small Business Technology Transfer] Program Policy Directive through notice and comment rulemaking. See 84 Fed. Reg. 12794-849 (Apr. 2, 2019). As relevant here, the policy directive states as follows regarding phase III work:

(c) Phase III. Phase III refers to work that derives from, extends, or completes an effort made under prior SBIR/STTR Funding Agreements, but is funded by sources other than the SBIR/STTR programs.

SBIR/STTR Policy Directive § 4(c)(1).

The policy directive further establishes the requirements for the competition of phase III awards. In particular, where an agency “pursue[s] R/R&D or production of technology developed under the SBIR/STTR program [it] shall issue Phase III awards relating to the technology, including sole source awards, to the Awardee that developed the technology under an SBIR/STTR award, to the greatest extent practicable, consistent with an Agency's mission and optimal small business participation.” Id. §§ 4(c)(3) and 4(c)(7). In this regard, the policy directive implements the SBIR statute which states:

To the greatest extent practicable, Federal agencies and Federal prime contractors shall— (A) consider an award under the SBIR program or the STTR program to satisfy the requirements under sections 3201 through 3205 of title 10 and any other applicable competition requirements; and (B) issue, without further justification, Phase III awards relating to technology, including sole source awards, to the SBIR and STTR award recipients that developed the technology.

15 U.S.C. § 638(r)(4).

Our Office analyzed this language in a previous decision and found that the policy directive's preference for an SBIR phase III award applies when the agency “specifically ‘pursue[s] the R/R&D or production of technology developed under the SBIR/STTR program'” and therefore applies only when the agency “seeks the specific technology developed by the SBIR awardee under its prior awards.” PublicRelay, supra.

Turning to the merits of the protest, G2 Ops explains that its protected SBIR work product is “being moved to Microsoft” in violation of the agency's “statutory and regulatory obligation to make a good faith effort to negotiate and issue a sole-source award to G2 [Ops].” Protest at 11. Specifically, the protester asserts that the cloud environment and its elements were developed and propriety to G2 Ops and “any ‘lift and shift' of the existing environment” copies and executes its SBIR-protected technology. Comments at 11.

The agency responds that its sole-source award to Microsoft is proper because the new task order requirement does not seek to “further develop any of G2 Ops' modeling and documentation automation technologies[.]” COS/MOL at 29. Furthermore, the agency submitted a declaration from the deputy chief information officer (CIO) and program manager for NAVSEA's Bluewater cloud program in which the deputy CIO addresses G2 Ops' existing SBIR contracts and the agency's new requirement at issue here. COS/MOL at 4; AR, Tab 12, Decl. of Deputy CIO. The deputy CIO explains that G2 Ops' SBIR work involved embedded cyber resiliency technology that included modeling techniques, baseline and change management to track engineering and cybersecurity requirements in model files, and cybersecurity risk assessment, among other things. AR, Tab 12, Decl. of Deputy CIO at 1-2. The deputy CIO further asserts that G2 Ops' “SBIR-protected technology relates solely to modeling artifacts, documentation automation, and model-based risk analytics” and that it did not involve development of cloud architectures, SCCA baselines, or operational configurations of NAVSEA's cloud environment. Id. at 2. The deputy CIO states that G2 Ops did not create the NAVSEA cloud environment, and the general cloud support it provided under its SBIR contract was not subject to “SBIR protection” because it was not part of the protester's embedded cyber resiliency technology. Id. at 2, 7.

The deputy CIO explains that the scope of the task order issued to Microsoft involves the transition, or “lift and shift” from legacy requirements to a new cloud environment, Bluewater, which is the agency's “new cloud ecosystem.” Id. at 3. The deputy CIO explains that Bluewater is a government-developed, government-owned SCCA that replaces the existing legacy cloud environment that was configured by a different contractor and operated by G2 Ops under its SBIR contract. Id. Moreover, the agency states that the Bluewater SCCA contains no SBIR configurations or SBIR developed technology and specifically does not use G2 Ops' alleged SBIR technology. Id. Specifically, the agency explains that the task order work “does not describe or require use of G2 Ops' SBIR-derived modeling tools or any SBIR-protected technology.” Id. The agency further reiterates that “[n]othing from G2 Ops' [prior SBIR contract] is used, referenced, or replicated when moving to the JWCC contract.” Id. at 7. Ultimately, the agency contends there is no transfer of G2 Ops' SBIR data or replication of SBIR configurations, and no G2 Ops' technology under the new system. Id. at 5.

In response, the protester asserts that the agency's declaration from the deputy CIO is a post-hoc statement that is inconsistent and unsupported by the contemporaneous record. Comments at 11. In this regard, the protester asserts that the agency failed to consider whether the task order at issue violated G2 Ops' SBIR rights or which portions of the “cloud environment were SBIR-protected” before the Microsoft task order was issued. Id. at 11-12. G2 Ops also takes issue with the agency's characterization of G2 Ops' work on its prior SBIR contracts. Id. at 13-16.

For example, the protester alleges that the declaration from the deputy CIO contains “several high[-]level technical arguments,” which are incorrect. Id. at 12. As support, G2 Ops relies on statements in its phase III contract. According to the protester, the statements demonstrate that G2 Ops currently performs work relevant to the task order at issue, explaining in part that it “engineered and implemented the legacy SCCA and Cloud Computing Security Requirements Guide controls”; architected and deployed multi-level ([impact level] IL2–IL6) cloud hosting environments; and “develop[ed] and operate[d] automation, monitoring, incident response, configuration management, and compliance workflows.” Id. at 13 (quoting AR, Tab 1, G2 Ops Phase III award at 15-17). The protester argues that these tasks, among others, show that it did more than manage systems and that its work is proprietary and protected SBIR technology. Id. at 14-16.

The protester also contends that the task order issued to Microsoft confirms that the work “necessarily copies” G2 Ops' SBIR-protected technology. Id. at 17. In this regard, the protester points to language in the task order that states the agency “[r]equire[s] current functions to be replicated (lift & shift) using JWCC offerings” and identifies several tasks that require the “replication” of the current cloud functions. Id. (quoting AR, Tab 7, Task Order). G2 Ops contends that this language confirms the task order “directs Microsoft to copy and use G2's proprietary and SBIR-protected technology.” Id. at 18.

On our review of the record, we do not find that G2 Ops' explanation of its work on its prior SBIR contracts demonstrates that the agency was required to award a SBIR phase III contract to the protester. Nor do we find that the various citations to descriptions of work requiring replication of current cloud functions from the task order demonstrate that Microsoft is directed to copy and use G2 Ops' SBIR technology in its performance of the task order work. See Comments at 18. Accordingly, we find that the protester has not established that the task order at issue reflects the agency's pursuit of technology that was developed under G2 Ops' prior SBIR phase III award. Inkit Inc., B-423724, Sept. 9, 2025, at 5; PublicRelay, supra at 9.

As explained above, the agency has unequivocally stated that the Bluewater SCCA contains no SBIR configurations or SBIR developed technology.[9] The agency also asserted that it “has no need for G2 Ops' alleged SBIR protected data or technology” and “no intention to provide any SBIR-based data or technology to Microsoft, and Microsoft has no requirement to use or interact with [G2 Ops] data or technology to perform the work in the JWCC task order.” AR, Tab 12, Decl. of Deputy CIO at 1. While the protester disputes the agency's specific statements, the protester has failed to persuasively demonstrate that the agency's representations are inaccurate, particularly, where the agency's representations are supported by the underlying language of the task order, which does not make any mention of the protester's technology. In sum, the protester has not demonstrated that the agency was required to award the work under JWCC task order to G2 Ops as a SBIR phase III contract and we therefore deny this protest ground.

Challenge to the Sole-Source Task Order Scope

The protester, which does not hold a JWCC IDIQ contract, argues that the type of services the agency seeks under the task order are outside the scope of Microsoft's underlying IDIQ contract. According to the protester, use of its “proprietary and SBIR-protected software and configurations” is beyond the scope of the JWCC contract. Protest at 13. In this regard, the protester asserts that offerors under the “JWCC contract could not have expected they would be asked to unlawfully implement, provide, and configure another contractor's custom built, proprietary, and SBIR-protected programs.” Comments at 20.

As explained above, the agency is not pursuing the production of specific technology developed by G2 Ops under its prior SBIR awards. Indeed, the agency has emphatically represented that the work under the task order does not require the use of any of G2 Ops' SBIR technology. Because G2 Ops has not shown that this is incorrect, there is no basis for the protester's argument that the work is outside the scope of the JWCC IDIQ contract.

The protest is denied.

Edda Emmanuelli Perez
General Counsel

---