Ares Enterprise, LLC

DOCUMENT FOR PUBLIC RELEASE

The decision issued on the date below was subject to a GAO Protective Order. No party requested redactions; we are therefore releasing the decision in its entirety.

Decision

Matter of: Ares Enterprise, LLC

File: B-424548; B-424548.2; B-424548.3

Date: September 3, 2026

Daniel J. Strouse, Esq., Pablo Nichols, Esq., Samuel Van Kopp, Esq., Anna Dichter, Esq., and Leslie A. Weinstein, Esq., Cordatis LLP, for the protester.
Victoria A. Moore, for Vision Information Technology Consultants LLC, the intervenor.
Erika Whelan Retta, Esq., and Isabelle P. Cutting, Esq., Department of the Air Force, the agency.
Paul N. Wengert, Esq., and Tania Calhoun, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision.

DIGEST

1. Protest that Federal Supply Schedule (FSS) order issued under blanket purchase agreement (BPA) exceeded the scope of the BPA is sustained where the record shows that the BPA described services in support of specific functions, but the order included services that were broader than and materially different from the scope of the BPA.

2. Protest that order issued under BPA exceeded the scope of the recipient vendor's FSS is sustained where the agency failed to validly determine that the order was within the scope of the vendor's contract and its labor categories.

DECISION

Ares Enterprise, LLC, of Fairfax, Virginia, a small business, protests the issuance of a Federal Supply Schedule (FSS) task order under the Enterprise Information Technology as a Service (EITaaS) Wave 1 Blanket Purchase Agreement (BPA) to Vision Information Technology Consultants LLC, of San Antonio, Texas, also a small business, under a solicitation issued by the United States Space Force,[1] for information technology services in support of the 61st Communications Squadron at Los Angeles Air Force Base (LAAFB), in El Segundo, California. Ares argues that the Space Force improperly placed the LAAFB order on a sole-source basis and that the order exceeds the scope of Vision's FSS contract and the EITaaS BPA.[2]

We sustain the protest.

BACKGROUND

Ares has performed information technology support services at LAAFB as a subcontractor to Trace Systems, Inc., which was the recipient of a task order issued on March 1, 2025, under the Army's Responsive Strategic Sourcing for Services indefinite-delivery, indefinite-quantity contract. Contracting Officer's Statement (COS) at 4 n.1. Although the term of that task order provided a base year and four option years, the agency did not exercise the first option year; instead, it awarded a series of 1-month bridge contracts to Trace, under which performance ended on May 31, 2026. Id.

The agency explains that the transition of work from Trace's contract to the EITaaS BPA follows a 2023 agency decision to transition all local information technology contracts providing field services to the EITaaS BPA. COS at 3 (citing Agency Report (AR), Tab 4, Memorandum from Air Force Deputy Chief Information Officer (June 9, 2023) at 1).

In planning the procurement, the agency's contracting officer's technical representative and the contracting officer reviewed the most recent update to the EITaaS BPA ordering guide, a July 2025 briefing from CACI about the BPA,[3] the views of the BPA contracting officer, and the views of a CACI official. Based on that review, they both determined that the agency's requirements were within the scope of the BPA. COS at 4-5; AR, Tab 7, Scope Determination Documents at 2 (Contracting Officer's Determination and Findings (May 21, 2026)). During the process, the contracting officer's technical representative (COTR) questioned whether two subjects (knowledge management functions and freedom of information/personally identifiable information/records management functions) were within the scope of the EITaaS BPA and was advised by both CACI and the BPA contracting officer that they were. Id. at 4 (Memorandum from COTR to Contracting Officer).

The agency explains that CACI selected Vision to submit a quotation for the LAAFB order because, under the EITaaS BPA procedures, “as CTA Lead, CACI receives solicitations and distributes them to CTA members that, in its determination, can best meet the stated requirements.” COS at 2. In that regard, the BPA ordering guide provides a list of the CTA lead duties, which includes that CACI will “[d]istribute solicitations to appropriate CTA Team Member(s) and consolidate [a] formal proposal submission” and then will “[c]onsolidate and submit proposal responses including CTA Team Members as applicable.” AR, Tab 5, EITaaS Ordering Guide (Mar. 8, 2024 revision) at 7.

On May 29, 2026, Space Force issued the order at issue (the LAAFB order) to Vision under the EITaaS BPA to provide services for a 9-month base period, and two 1-year options, plus a 6-month extension-of-services option under FAR 52.217-8. COS at 5; Memorandum of Law (MOL) at 3. Ares then filed this protest.

DISCUSSION

Ares contends that the LAAFB order exceeds the scope of both the EITaaS BPA and Vision's FSS contract. The agency argues that the protest should be dismissed as untimely and because Ares is not an interested party. We consider those arguments before turning to the merits of the protest.

Timeliness

Space Force argues that the protest is untimely because Trace had been told of the agency's intention to issue an order under the EITaaS BPA as early as March 1, but Ares did not file its protest until June 3, well beyond the 10-day timeliness requirement in our Bid Protest Regulations. Req. for Dismissal at 2-3 (citing 4 C.F.R. § 21.2(a)).

Ares acknowledges that by May 12 it had learned that Vision was working to recruit incumbent employees based on an expectation that the agency would issue an order to it under the EITaaS BPA, but also that the agency had delayed a decision to proceed until May 29. Protest at 4. Ares contends that it “learned from recruiters, which had begun reaching out to Ares employees on behalf of” Vision, that the agency “intended to place work” from the contract on which Ares was then performing onto a different contract vehicle. Opp. to Req. for Dismissal at 1-2. Ares explains that it learned on May 29 that the agency had, or would imminently, issue an order to Vision, so the firm filed an agency-level protest. Id. at 1-2. While the agency-level protest stated that Ares did not believe an order had been issued (thus it was arguably premature), the agency immediately denied Ares's protest and then proceeded to issue the order to Vision on May 29. COS at 6.

Contrary to the agency's view, Ares was not required to file a defensive protest based on secondhand information to challenge a contracting action that had not, in fact, occurred at that time. See, e.g., Ervin & Assocs., Inc., B‑278850, Mar. 23, 1998, at 7 (protest challenging task order as exceeding scope of underlying contract was not untimely even though protester received rumors of the order more than 10 days before the protest because “mere speculation or rumor provides no basis for questioning the propriety of a procurement”). Ares filed this protest with our Office on June 3, which is timely because it was filed within 10 days of the denial of the agency-level protest--and within 10 days of the issuance of the LAAFB order. 4 C.F.R. § 21.2(a)(2), (3).

Interested Party

The agency also argues that Ares's protest should be dismissed because the firm is not an interested party because it was not one of the EITaaS BPA team members.

Ares contends that it is an interested party to challenge the LAAFB order because its protest contends that the order is improper and beyond the scope of both the BPA and Vision's FSS contract. Ares also argues it could compete for the requirement if its protest were to be sustained because Space Force would have to consider a procurement that did not use the EITaaS BPA or Vision's FSS contract, and thus, would hold a competitive procurement under which Ares could compete.

Under the bid protest provisions of the Competition in Contracting Act, 31 U.S.C. §§ 3551-3557, only an “interested party” may protest a federal procurement. That is, a protester must be an actual or prospective bidder or offeror whose direct economic interest would be affected by the award of a contract or the failure to award a contract. Bid Protest Regulations, 4 C.F.R. § 21.0(a)(1). Determining whether a party is interested involves consideration of a variety of factors, including the nature of issues raised, the benefit or relief sought by the protester, and the party's status in relation to the procurement. RELM Wireless Corp., B-405358, Oct. 7, 2011, at 2.

Here, Ares is challenging whether the LAAFB order is within the scope of both Vision's BPA and its FSS contract and contending that if the protest is sustained then the LAAFB order is invalid and a competitive procurement will be required, under which Ares could compete. Protest at 11; Opp. to Req. for Dismissal at 5. Based on the issues raised and the relief sought, Ares is an interested party to pursue this protest. See Sigmatech, Inc., B-296401, Aug. 10, 2005, at 4 n.5 (protester that did not hold FSS contract was an interested party to challenge the propriety of agency's actions establishing an FSS BPA and placing orders under it).

Accordingly, we proceed with consideration of Ares's challenges to the scope of the order, first with respect to the scope of the EITaaS BPA, and then with respect to the scope of Vision's FSS contract.

Comparison of Scope of LAAFB Order to Scope of EITaaS BPA

Ares argues that the LAAFB order issued to Vision exceeds the scope of the EITaaS BPA's performance work statement (PWS). In particular, Ares argues that the order includes operation and maintenance of networks and systems, and mission-specific, system-specific engineering and development work, most of which is beyond the scope of the EITaaS BPA. In contrast, the firm argues, the scope of the EITaaS BPA is principally enterprise help desk services and end user device support. Protest at 7. As a result, the firm contends, the scope of the BPA does not include much of the scope of the order, including operations and maintenance of systems and infrastructure, cybersecurity and information security, information technology planning and management, electronic information systems support, short-term projects, and support for records management, among other things. Supp. Protest at 5-6; Protest at 8.[4]

The agency argues that it made a reasonable assessment that the services were within the scope of the EITaaS BPA, and that Ares's arguments are faulty both because it interprets the scope of the BPA too narrowly and depicts the scope of Vision's order too broadly. Correctly understood, the agency contends that the order issued to Vision is within the broad scope of the EITaaS BPA. MOL at 5-6. The contracting officer argues that most of the challenged work is within the scope of EITaaS BPA task areas 7.1, Enterprise Services; 7.2, End User Device; and 7.3, Protect. COS at 6-7. For the remainder of the challenged work, the contracting officer argues that individual tasks would be covered by EITaaS BPA task area 9 (engineering services) for electronic information support systems, task area 11 (transition services) for short-term projects and support of the contract writing system, and task area 14 (configuration management) for intelligence and threat support services. Id. at 7.

The Competition in Contracting Act generally requires “full and open competition” in government procurements, to be obtained through competitive procedures. 10 U.S.C. § 3201(a)(1); see also 41 U.S.C. § 3301. Where an agency uses the FSS program, it satisfies the requirement to obtain full and open competition, so long as the agency complies with the applicable procedures for its use. 10 U.S.C. § 3012(3). Among these, when an agency uses the FSS, it must order products and services that are available from the relevant contractor's FSS contract(s) and may not order non-FSS items (known as “open market” items).[5] RELX Inc., B-421597.2, B-421597.3, Nov. 17, 2023, at 5.

Where a protester challenges a task order as exceeding the scope of the contract or agreement under which the order is issued, our Office will review the record to determine “whether there is a material difference between the . . . order and the underlying BPA.” Vetterra, LLC, B-417991 et al., Dec. 20, 2019, at 6. The effort to assess whether differences are material is based on “reviewing the BPA as awarded” and “the terms of the delivery order.” Tempus Nova, Inc., B-412821, June 14, 2016, at 4. Our “overall inquiry is whether the order is of a nature which potential offerors [that would have competed for establishment of the BPA] reasonably would have anticipated.” Vetterra, LLC, supra at 6.

The EITaaS BPA included a PWS that described the intended purpose of the EITaaS BPA as a vehicle to provide “wave 1” of a set of services to:

transform End User Device services . . . . Services may also be required to develop new systems, consolidate and/or integrate systems, develop interfaces with other systems/services, and expand the existing systems to also support other [agency] mission areas.

AR, Tab 3, EITaaS BPA attach. 3, PWS at 5.

The PWS further described the wave 1 services as providing “a robust Enterprise IT Service Management (EITSM) platform, modernized End User Devices, Device Software, Device Management, and responsive and efficient Enterprise and Local Help Desk Services.” Id. at 8.

The PWS states that it “establishes the full scope of Wave 1,” which was depicted in an accompanying graphic and organized in a bulleted list, as follows:

• Enterprise Services
  • Service Desk and ITSM [information technology service management]
• End User Devices and Management
  • Computing Devices
  • Print
  • Voice Devices
  • Bring Your Own Approved Device (BYOAD)
• Protect
  • End User Device and Data Protection

Id. at 8-9.

The PWS provided narrative explanations of each task area (many of which were broken into further subdivisions) starting at section 7 of the document. The protest issues mainly arise with respect to the scope of task areas 7.1, 7.2, 7.3, 9, 11, and 14, which we summarize below as necessary background.

EITaaS task area 7.1 was labeled “enterprise services,” under which subtask 7.1.1, labeled “service desk and ITSM [information technology service management],” provided for the vendor to provide a “common set of productivity and collaborative services to support and bring value to” the agency's over 800,000 users, “agnostic of device, worldwide location, or time.” Id. at 9. To do so, the vendor would “manage all Wave 1 services and operate, maintain, and deploy processes and tools that conform to commercial best practices” by establishing an ITSM office. The functions of the ITSM office were listed as including areas such as planning and management of enterprise information technology and organizational change management “for Wave 1 service areas.” Id. at 9-10.

For example, under subtask 7.1.1.1, labeled “service desk,” the vendor would provide a single point of 24/7/365 IT service support “for all service issues (including end point devices)” Id. at 10. Subtask 7.1.1.2, labeled “field services,” required services that were distinguished from the service desk by field services constituting “Tier 2 services,”[6] in the form of “[o]n-site local field support providing touch labor and walk-in service.” Id. at 10-11. Subtask 7.1.1.3 provided for the vendor to institute a single, enterprise-wise solution for managing both classified and unclassified service requests, incidents, releases, problems, events, assets, configuration, knowledge, service levels, and similar needs, which the PWS contrasted with the agency's existing solutions, under which cyber weapons, programs, and user groups were managed separately. Id. at 11. Other enterprise services subtasks included providing rapid or automated incident response, and an information technology storefront. Id. at 12.

Task 7.2, “End User Device” covers services for “the fielding and management of . . . enterprise end user device solutions, such as computing, mobile, print, and voice solutions.” Id. at 13. The subtasks included developing a new secure device configuration baseline, provisioning and managing “government-issued laptops, mobile devices and smart devices,” and providing a storefront for agency commands to procure pre-configured devices. Id. 14. Other subtasks related to providing and managing printing capabilities, document scanning, copying, and faxing for classified and unclassified materials, as well as non-mobile voice communication devices for both classified and unclassified communications, and bring-your-own-approved-device support to allow access to agency resources through a user's personal device. Id. at 16-17.

Task 7.3, “Protect,” would include subtasks for services such as end user device and data protection and malware prevention, automated endpoint management, automated patching of devices, development of a vulnerability management solution, providing an automated threat detection and remediation solution, and applying encryption methods to protect data at rest on a device and during transmission. Id. at 19-24.

PWS task 9, engineering services, states that the vendor will provide engineering services “to perform support tasks not already defined” among the BPA tasks and contract line items. Id. at 26. The PWS stated that the specific requirements of such engineering tasks would be defined in individual task orders, but gave as three illustrations services to provide a “proof-of-concept” (described as a non-operational representation of a desired capability), a “prototype” (described as an incomplete project or product for testing purposes), or a “pilot” (described as a final product distributed only to limited users). Id. at 26-27. The PWS further stated that engineering services could also be used “to complete other tasks that would be defined by the Government at the BPA Order level, consistent with the allowable scope of the BPA.” Id. at 27.

PWS task 11, transition services, stated the importance of transition services to move from legacy solutions to the contractor's solution and noted the need for transition services to include ensuring an “effective transition-in and transition-out of other contractor and Government support,” while providing continued system operations, and preventing interruption or disruption of services. Id. at 27.

Finally, task 14, configuration management, consists of just three sentences, which direct the vendor to “uphold all [c]onfiguration [m]anagement disciplines,” to develop, implement and maintain configuration management processes across all aspects of the BPA, and to submit a configuration management plan. Id. at 28.

Ares challenges numerous provisions of the LAAFB order, each of which we address below.

LAAFB order PWS 2.4 -- Task Four: Network and System Operations & Maintenance

Ares argues that the LAAFB order improperly requires Vision to provide operation and maintenance of an extensive list of systems, networks, and infrastructure--albeit excluding those within scope of a separate contract held by CACI. Supp. Protest at 5; AR, Tab 8, LAAFB Order PWS at 21. Notwithstanding that exclusion, Ares argues that the order's requirements improperly require Vision to provide support services to “operate and maintain equipment and systems in a serviceable condition or to restore it to a serviceable condition to include identifying required parts to the Government, inspection, periodic testing, adjustment, and repair” for networks and systems identified in an accompanying appendix. Comments & Supp. Protest at 10-11. The firm's responsibilities are to include “check[ing] each network and system that is controlled by the [61st Communications Squadron] every business day morning and provid[ing] a status report.” Id. The covered systems and networks depicted include a Wi‑Fi network, external web servers, wide area networks, storage area networks, virtual desktops for non-classified and classified networks, backup power systems, and database, file, print, application, and web servers. Id. at 10 (citing AR, Tab 8, LAAFB Order PWS at 84 (PWS app. B, “Scope of Control” diagram)).

The contracting officer contends that PWS 2.4 of the LAAFB order is properly within the scope of EITaaS PWS 7.2 and 7.3. COS at 6, 8-10.[7] The agency contends that the scope of the EITaaS BPA “does not exclude any specific device or include a comprehensive list of IT components,” and therefore the order properly required Vision to provide services to operate and maintain anything that could be classified as “endpoints.” The agency reasons that the task thereby included support of the entire range of agency infrastructure. Id. at 9.

Our review of the record does not support the contracting officer's determination of the scope of the EITaaS BPA. EITaaS PWS tasks in paragraphs 7.2 and 7.3 provide for end user device support. End user devices are treated in EITaaS as falling into the categories of computing devices (subtask 7.2.1), printers (7.2.2), voice devices (7.2.3), and bring-your-own-approved-device items (7.2.4). AR, Tab 3, EITaaS BPA attach. 3, PWS at 13‑18. The EITaaS tasks under PWS 7.2 do not describe the operation and maintenance of underlying networks, systems, or enterprise infrastructure such as servers and storage area networks.

With regard to EITaaS PWS 7.3, our review shows that its scope again covers end user devices and protection of data in transit and at rest “on the user's devices (i.e., desktop, laptop, tablet, mobile phone, etc.),” along with services that allow such a device to be wiped or disabled remotely. Id. at 19. Even though EITaaS PWS 7.3 includes a subtask addressing “endpoint management,” that subtask involves the monitoring of and assessment of “all end user devices to include [bring-your-own-approved-device] as well as mobile and stateless devices,” but does not provide a basis to include broader responsibility network operations and maintenance. Id. at 20. To the contrary, PWS 7.3 expressly distinguishes its scope from broader network and system cybersecurity scope, stating that “Wave 1 will focus on the End User Device and Data Protection capability[,] with other service areas being provided in future waves.” Id. at 19 (emphasis added). The contracting officer's reading of the EITaaS PWS as including aspects of the LAAFB networks and systems such as servers and storage area networks is not consistent with the language of that subtask, which addresses support of end user devices and is, therefore, unreasonable. Consequently, our review shows that LAAFB PWS 2.4 is not within the scope of the EITaaS BPA.

LAAFB order PWS 2.5 -- Task Five: Cybersecurity

Next Ares challenges the scope of PWS 2.5 of the LAAFB order. That task requires Vision to provide continuous security, operational availability, and reliability of IT systems and equipment supporting the LAAFB mission, including assessment and authorization, responding to negligent classified information releases, training of support staff cybersecurity liaison, ports/protocols/services management, and numerous other subtasks. Ares contends none of these services are within the scope of the EITaaS BPA. Comments & 2nd Supp. Protest at 16-19.

The contracting officer explains that the agency is responsible for cybersecurity governance, while the services actually included in the LAAFB order are within the scope of EITaaS PWS 7.3. The contracting officer explains that PWS 2.5 of the LAAFB order provides that Vision will “augment[] the Government Base Cybersecurity Office (BCO) by providing Risk Management Framework (2.5.1) support, Computer Security (2.5.2), support[] the government's TEMPEST Program (2.5.3), participat[e] in the government's Information Assurance Program (IAP) [(]2.5.4[)], and support[] the base Communications Security (COMSEC) program (2.5.5).” COS at 11. Those requirements are within the scope of the EITaaS BPA, the contracting officer explains, because they “fall within the Protection [sic, Protect] portfolio of the EITaaS Wave 1 BPA at PWS . . . [regarding] security configuration management, vulnerability management, protected transit, and data protection” of EITaaS PWS 7.3. Id. at 11.

Our review of the record in this regard does not support the contracting officer's determination of the scope of the EITaaS BPA with respect to the cybersecurity task. As discussed above, the scope of EITaaS PWS 7.3 specifically relates to security involving end user devices (such as the requirements to ensure end user devices are configured and run properly within agency networks, services to scan end user devices, and services to support monitoring and assessment of end user device compliance). The EITaaS BPA tasks in PWS 7.3 that the agency cites do not provide for the broader cybersecurity-related services included in LAAFB PWS 2.5, which are not related to end user devices. As noted previously, the scope of EITaaS PWS 7.3 expressly notes that its scope addresses “End User Device and Data Protection capability” and that other service areas are to be addressed in subsequent BPA waves. AR, Tab 3, EITaaS BPA attach. 3, PWS at 19. In short, our review shows that LAAFB PWS 2.5 is not within the scope of the EITaaS BPA.

LAAFB order PWS 2.6 -- Task Six: Information Technology Planning and Support Services

Under task six, the LAAFB PWS specifies that Vision will provide technical expertise regarding multiple areas that include information technology requirements analysis, managing projects, installation records management, developing a “road map for future [information technology] requirements,” and providing technical solutions. AR, Tab 8, LAAFB PWS at 33. Ares argues that task six requires Vision to provide the agency with “base-level communications, program management and governance” rather than wave 1 end user device support. Ares acknowledges that the EITaaS BPA describes service desk and information technology service management functions that involve incident response, management of service requests, incidents, releases, problems, events, assets, configuration, knowledge, and service levels. Comments at 19 (citing AR, Tab 3, EITaaS BPA PWS at 11). Nevertheless, Ares argues that the EITaaS BPA PWS does not contemplate that the BPA would include providing information technology requirements analysis or technical solution development. Comments at 19.

The agency again argues that Ares mischaracterizes the scope of the LAAFB order. Contrary to the protester's depiction, the contracting officer explains that under task six, the agency retains “overall responsibility base-level communication planning.” COS at 12. Task six, the agency explains, requires Vision to “augment” the agency's work by validating new information technology requirements and developing technical solutions, managing and maintaining information system installation records, performing quality assurance functions, and planning and overseeing installations/modification of systems within the vendor's control. COS at 12 (citing AR, Tab 8, LSSFB Order PWS at 33-35).

The agency contends that the scope of task six is consistent with the EITaaS BPA tasks for enterprise services in PWS 7.1 and protection in PWS 7.3. In particular, the contracting officer argues that EITaaS PWS 7.1.1 provides for the vendor to provide a service desk and an information technology service management office. Then, within that requirement, 7.1.1.2 provides for the service desk to function as “the single point” of information technology support, and to “manage the full lifecycle of all incidents, problems, and service requests[,] including fulfillment, verification, and closure as well as interact/cooperate with existing help desks and service providers.” COS at 13 (quoting AR, Tab 3, EITaaS BPA PWS at 10). Further, the agency explains, the remaining elements of task six, under which Vision will provide both communications records management and quality assurance, are within the scope of EITaaS BPA PWS 7.3.1.10. Id. at 13-14.

Our review of the record shows that the LAAFB order identifies the general scope of task six as covering information technology requirements analysis, managing projects, providing installation records management, developing a roadmap for future information technology requirements, and providing technical solutions. AR, Tab 8, LAAFB Order PWS at 33. The subtasks under task six then provide that Vision would be appointed as the Cyberspace Infrastructure Planning System (CIPS)[8] monitor for the purposes of having Vision “oversee all new [information technology] requirement requests for LAAFB.” Id. In that role, the order goes on to specify that Vision will, for example, develop technical solutions with stakeholders, manage and maintain communications and information systems installation records, act as the quality assurance monitor for equipment, technical order management, corrosion prevention and control, and electrostatic discharge standards, and will review contracting statements of work and performance work statements “to ensure standard processes are followed.” Id. at 34.

The EITaaS BPA PWS does not provide a basis for the inclusion of the LAAFB order task six requirements. The scope of the enterprise services in the BPA, and particularly the service desk support under PWS 7.1, are described in terms of a service desk and an information technology service management office to respond to incidents, problems, and service requests.[9] Significantly, EITaaS BPA PWS 7.3.1.10 is organized under PWS 7.3.1, which establishes the scope of the subsidiary task elements as being connected to end user devices and associated data protection. BPA PWS 7.3.1.10 follows after requirements addressing the needs for the vendor's system to provide for protection of specific files and directories from modification, such as attempts to modify or terminate antivirus protections (PWS 7.3.1.7); protection of data at rest through encryption (PWS 7.3.1.8); and ensuring a capability to isolate an individual application from the operating system when necessary (PWS 7.3.1.9). AR, Tab 3, EITaaS BPA PWS at 23-24. Understood in that context, PWS 7.3.1.10 provides for the vendor's solution to “ensure confidentiality, integrity, and availability of information” both when moving across the agency's networks and resting within systems, by use of approved encryption. The language of the EITaaS BPA PWS does not support the agency's much broader construction of the BPA PWS tasks and, specifically, does not provide a basis for LAAFB order requirements for Vision to analyze new information technology requirements, or to develop appropriate technical solutions. Neither does the scope of the BPA anticipate providing services to manage and maintain information system installation records, performing quality assurance functions for equipment, ensuring compliance with corrosion prevention and control standards and electrostatic discharge limits, or reviewing contracting statements of work and performance work statements. Therefore, task six of the LAAFB Order improperly exceeds the scope of the EITaaS BPA.

LAAFB order PWS 2.7 -- Task Seven: Knowledge Management

Ares next challenges the inclusion of the knowledge management task in the LAAFB order. The order PWS provides that Vision will serve as the alternate base records manager, and as both the primary and alternate unit records managers for the 61st Communications Squadron. AR, Tab 8, LAAFB Order PWS at 37. The contractor is required to visit each of 44 unit-level records managers, train all records professionals within 3 months of appointment, develop publications, and monitor processing and reviews of publications and forms under applicable policies. Id. Under the Privacy Act functions, the contractor is tasked with being appointed as the unit privacy monitor for the 61st Communications Squadron, and with analyzing and processing breaches of personally identifiable information protections and related complaints and then determining the appropriate disposition. Id. The task also included advising on and preparing responses to Freedom of Information Act requests under government supervision, and assisting in developing, managing, and maintaining unit Sharepoint sites, including annual training for the knowledge managers. Id. at 38. Ares argues that the scope of the EITaaS BPA has no significant relationship to the scope of LAAFB order PWS 2.7. Comments & 2nd Supp. Protest at 21.

The agency argues that Ares overstates the scope of the records management task and ignores that the agency retains overall responsibility for knowledge management. COS at 14. The contracting officer explains that after reviewing the issue, the agency correctly determined that the knowledge management task was within EITaaS PWS 7.1.1.3, labeled information technology service management, and PWS 7.3.1.11, labeled data protection. Id. at 15.

We do not agree that the scope of knowledge management task seven is within the scope of the EITaaS BPA PWS, based on our review of the record here. First, BPA PWS 7.3.1.11 provides simply for the vendor to ensure that information on user devices will be retained until the device was decommissioned or the information was removed by designated agency officials, and to hold the corresponding records as provided in data retention policies. AR, Tab 3, EITaaS BPA attach. 3, PWS at 24. Paragraph 7.3.1.11 does not address providing broader knowledge management support. Neither does PWS 7.1.1.3 support the agency's position. It describes the agency's goal of a single, enterprise-wide ITSM solution that would allow the agency to “provide end-to-end management of service requests, incidents[,] releases, problems, events, assets, configuration, knowledge, service levels, etc.” Id. at 11. The PWS describes the solution in terms of implementation through appropriately secure cloud instances and “support[ing] cyber weapon systems, programs of record, and users as opposed to the current configuration where the [the agency] pays for multiple ticketing systems.” Id. at 12. In short, the EITaaS subtask has no similarity to the requirements of LAAFB task seven, which provides for Vision to provide support for much broader knowledge management functions (regardless of the fact that the agency itself retains overall responsibility). Therefore LAAFB PWS 2.7 is also not within the scope of the EITaaS BPA.

LAAFB order PWS 2.9 & 2.10 -- Task Nine: Electronic Information Systems Support and Task Ten: Short-Term Projects

Ares challenges the inclusion of tasks nine and ten[10] in the LAAFB order, arguing that the tasks require Vision to provide “operation, maintenance, enhancement, and development of enterprise applications, databases, SharePoint environments, Power Apps, scheduling systems, and other business applications… [and] includes software engineering functions such as coding, integration testing, version control, and development activities,” among other things. Supp. Protest at 5. Ares characterizes the elements of task nine first as requiring operations and maintenance, which it argues also exceeds the scope of the EITaaS BPA PWS under task nine for the same reasons that Ares argued regarding task four, discussed above. Comments & 2d Supp. Protest at 23. Regarding task ten, Ares argues that the LAAFB order provides for Vision to support short-term projects that amounts to “developing and implementing new requirements,” which the firm contends are also beyond the scope of the EITaaS BPA PWS. Id. at 24.

The firm notes that the LAAFB order PWS describes task nine as including process engineering, for which the PWS identifies three types: 1) maintenance, under which the vendor modifies an existing software product to correct faults, to improve functionality, or to adapt it to an environment; 2) enhancement, under which the vendor improves an existing software product to meet a new requirement, including associated testing; and 3) development, under which the vendor programs, documents, tests software; that is, to create a new software program. Comments & 2d Supp. Protest at 22 (citing AR, Tab 8, LAAFB Order PWS at 41). Ares argues that the order thus requires more than simply maintaining or enhancing the existing applications and business processes and, at a minimum, provides for Vision to develop and implement new applications to respond to new requirements. Ares notes that at least two such development requirements are identified in appendix I to the PWS as requiring development: a CIPS requirements tracker and a video teleconference/conference center service request application. Id. at 23 (citing AR, Tab 8, LAAFB Order PWS at 102 (app. I, “Space Systems Command Enterprise Information Systems Processes” table). The firm notes that the order also states that short-term projects under task ten could include “integrating tools,” “migrating the existing LAAFB network environment to another mandated environment,” and “developing/implementing new business processes to improve information management.” Id. at 24 (quoting AR, Tab 8, LAAFB Order PWS at 44). Ares argues that the requirement for Vision to develop applications and new business processes under tasks nine and ten are not contemplated by the EITaaS BPA PWS. Comments & 2d Supp. Protest at 23-25.

The contracting officer argues that the requirements under task nine fall within the scope of engineering services under EITaaS BPA PWS 9, while the requirements of task ten are within the scope of transition services under BPA PWS 11. COS at 7, 16‑17. The contracting officer contends that the requirements of the LAAFB order do not include “development of new business processes, applications, or major modifications of existing processes/applications.” COS at 16. Instead, the order provides for Vision to manage and maintain an existing platform and to maintain and enhance “existing applications and business processes” consistent with best practices. Id. The actual requirements of the order are within the scope of EITaaS BPA PWS enterprise services for the same reasons as explained regarding task six above, the contracting officer contends, or at most are covered as supporting engineering services described in EITaaS BPA PWS 9. Id.

In most respects Ares fails to show that LAAFB order PWS tasks nine and ten exceed the scope of the EITaaS BPA PWS. As noted above, BPA PWS 7.1 includes enterprise services that expressly include planning and management of enterprise information technology, and Ares does not show that the order requirements for operating, maintaining, and enhancing the agency's existing platform, existing applications, and business processes would exceed the scope of the BPA. However, the order PWS also identifies “development” as one of the three elements of process engineering, it then connects “development of business processes” to task 10, and it refers to the table in appendix I that identifies a need for development of a CIPS requirements tracker and a video teleconference/conference center service request application. AR, Tab 8, LAAFB Order PWS at 41-42, 102 (PWS app. I, “Space Systems Command Enterprise Information Systems Processes” table, lines 25, 30, 34). Whether arising under task nine or ten of the LAAFB order, the EITaaS BPA PWS does not anticipate for services in support of application development, which the order defines as “computer programming, documenting, testing, and bug fixing involved in creating applications and frameworks,” with the purpose of creating “a new software program” or a new version of existing software reflecting “major changes.” AR Tab 8, LAAFB Order PWS at 42.

Neither does the EITaaS BPA PWS 9, engineering services, or PWS 11, transition services, provide for the application development requirements to be included in the LAAFB order as the agency argues. The EITaaS BPA PWS provides little express limitation on engineering services, yet also states that engineering services include three specific limited development steps of establishing a proof of concept, performing prototyping, and deploying a pilot to limited users. While general language in BPA PWS 9 also describes engineering services as “providing support tasks not otherwise defined” elsewhere in the PWS, we will not read such broad language as providing a general exception to the scope of the BPA. See DynCorp Int'l LLC, B-402349, Mar. 15, 2010, at 9 (sustaining protest that orders exceeded scope of contracts under which they were issued; general statements in the contracts did not serve to expand their scope beyond that anticipated during the competition). Regarding transition services under BPA PWS 11, we likewise find no support for the contracting officer's contention that the BPA provision discussing the vendor's role in transition from legacy systems to the BPA vendors' solution anticipates the vendor would develop new applications or business processes under the label of a short-term project.[11] We therefore sustain the protest with respect to the inclusion of development requirements in the LAAFB order.

LAAFB order PWS 2.18 -- Task Eighteen: ConWrite Support

Ares contends that task 18 requires Vision to provide functional administration for multiple contracting and procurement databases. Supp. Protest at 6. The firm contends that such specialized support services are not within the scope of the EITaaS BPA. Id.

The agency explained that the scope of task 18 involves contracting support software (ConWrite). Vision's work under the LAAFB order “entails patching and user access management of existing databases,” and asserts that the work constitutes ordinary operations and maintenance. The agency also argues that task 18 properly includes Vision supporting a potential future transition to a new centrally managed web-based solution (CON-IT). COS at 18. The agency explains that it viewed this task as being covered mainly under the enterprise services scope of the EITaaS BPA PWS. Id. at 19.

In its comments responding to the agency report, Ares briefly references its earlier arguments regarding the scope of transition services, and states that the same principles show that task 18 is beyond the scope of the EITaaS BPA. Comments & 2d Supp. Protest at 25. These brief assertions fail to materially contest the substance of the agency's explanation supporting the inclusion of task 18. Accordingly, we deny the Ares challenge to the inclusion of task 18 in the LAAFB order.

LAAFB order PWS 2.19 – Task Nineteen: Space Systems Command Intelligence & Threat Analysis Support

Ares also argues that LAAFB order task 19 exceeds the scope of the EITaaS BPA PWS because the scope of task 19 is “mission-network operations and cybersecurity management services” that are not contemplated by the EITaaS BPA PWS. Supp. Protest at 6. Ares contends that task 19 states that Vision will be appointed to hold multiple significant roles for LAAFB -- specifically the Information Systems Security Manager, the Information Systems Security Officer, and the System Administrator -- all for the Air Force sensitive compartmented information network at LAAFB. Comments & Supp. Protest at 25. Ares argues that the order PWS describes those roles as, respectively, a lead governance role responsible for overseeing cybersecurity compliance for LAAFB, a day-to-day manager of security functions, and the administrative role charged with oversight of all tasks associated with ensuring the sensitive compartmented information network at LAAFB is operational, accessible, and complies with agency enterprise architecture. Id. These responsibilities are outside the scope of the EITaaS BPA PWS, the firm argues. Id. at 26.

In response, the contracting officer asserts that the requirements in task 19 “fall squarely” in the scope of the EITaaS BPA PWS requirements regarding cybersecurity support under six elements of BPA PWS 7.3.1 and PWS 14 configuration management. COS at 19.

Our review of the record does not support the contracting officer's assertions that the scope of task 19 is contemplated by the EITaaS BPA PWS. As discussed above with respect to task 4, EITaaS BPA PWS 7.3.1, which is entitled “End User Device and Data Protection,” provides for the vendor to ensure end user device protection. Under that heading, the BPA PWS requirements that the contracting officer argues are relevant include, for example, having the vendor's system support monitoring and assessment of end user devices, implementing and enabling the agency's zero-trust architecture along with the ability to isolate non-compliant endpoints, and automated threat detection and remediation across end user devices, and protection of data in transit and at rest. See AR, Tab 3, EITaaS BPA PWS at 19-24. As we concluded, above, with regard to LAAFB order task 4, the scope of tasks under EITaaS BPA PWS 7.3.1 does not include the governance, day-to-day network operations, and system administration roles in task 19. Neither does the scope of EITaaS BPA PWS 14, configuration management, support the agency's position. As noted above, the scope of the configuration management task area in the BPA PWS is a brief and general instruction for the vendor to ensure that configuration management practices are followed by itself and all subcontractors “across all aspects of the BPA,” and has no relationship to intelligence and threat analysis support. Accordingly, the record shows that LAAFB task 19 exceeds the scope of the EITaaS BPA PWS.

For the reasons discussed above, the LAAFB order exceeds the scope of the EITaaS BPA with regard to task areas 4, 5, 6, 7, 19, and development requirements under tasks 9 and 10. The record demonstrates material differences between the requirements of the LAAFB order and the EITaaS BPA. See Vetterra, LLC, B-417991 et al., Dec. 20, 2019, at 6. Therefore, the agency's placement of the order under the BPA was improper. We sustain the protest on that basis.

Comparison of Scope of LAAFB Order to Scope of Vision FSS Contract

Apart from whether the LAAFB order was within the scope of the EITaaS BPA, Ares contends that the order is improper because it is outside the scope of Vision's FSS contract. Specifically, the protester argues that of the 40 labor categories on Vision' s FSS contract, none provide labor categories necessary to perform many of the services under the order. Protest at 9. The protester also contends that the agency explained that it regarded the existence of the CTA led by CACI as making it unnecessary to review the labor categories on Vision's FSS contract specifically, in order to compare them to the labor categories required under the LAAFB order. Rather, the agency considered that by issuing the order to Vision, the existence of the CTA would make the more extensive labor categories on the CTA members' contracts (including CACI's) available. Supp. Protest at 8. Ares argues that this position is legally and factually incorrect; that is, only one order was issued, which was to Vision and therefore was under Vision's FSS contract, and nothing indicates that CACI also received any portion of the LAAFB order. Id. Further, in response to the agency's proffer of a table listing 32 unique roles required by the LAAFB order, the labor categories in the EITaaS that could fill those roles and, the FSS labor categories that would fulfill the skill and seniority requirements of those EITaaS labor categories, Ares argues that none of the FSS labor categories listed by the agency can be found on Vision's FSS contract, although there are similarities.[12] Comments & 2nd Supp. Protest at 4‑7.

The agency argues that the LAAFB order is within the scope of Vision's FSS contract because a review shows a number of Vision's labor categories that could meet the requirements of the order. COS at 25. Additionally, the contracting officer maintains that the EITaaS Wave 1 Ordering Guide permits the use of any CTA member's labor categories, not just the firm receiving the order, when it states that “prices for all labor categories must be on CACI and/or CTA members['] Schedule contract.” Id. As a result, the agency contends there is no credible basis on which to argue that Vision lacks the requisite labor categories to perform the LAAFB order. Id. at 26.

For its part, Vision argues that the factual premise of Ares's argument is incorrect because “Ares presumes that the [g]overnment is ordering from the labor categories on Vision IT's GSA Schedule.” Intervenor's Comments at 7. Vision contends that Ares lacks evidence that the agency failed to determine that the “function of [a] job category listed in the [s]olicitation [wa]s sufficiently close to the service offered in the vendor's FSS contract,” and that an ordering agency is not required to determine that a vendor's FSS has the same “job titles and qualifications.” Id. (citing HomeSource Real Estate Asset Servs., Inc. v. United States, 94 Fed. Cl. 466, 486–87 (2010)).

FSS delivery orders that are outside the scope of the underlying FSS or BPA are subject to the general requirement for full and open competition. See Onix Networking Corp., B-411841, Nov. 9, 2015, at 6-7. In determining whether a delivery order is outside the scope of the underlying FSS contract, our Office considers whether there is a material difference between the delivery order and the underlying BPA. Id. Where an agency orders from an existing FSS, all items quoted and ordered are required to be on the vendor's schedule contract as a precondition to receiving an order. Science Applications Int'l Corp., B-401773, Nov. 10, 2009, at 2.

Our review of the record shows that the agency lacks a factual basis for its conclusion that the LAAFB order is within the scope of Vision's FSS contract. While the agency offers that it is possible that several of Vision's labor categories could meet the requirements, the agency and Vision both contend that an order issued to a CTA member need not fall within the scope of that firm's FSS contract, so long as it might fall within the scope of another CTA member's FSS contract. We disagree that existence of a CTA relieves an agency of the requirement to order only those services that are within the scope of the order recipient/CTA member's FSS contract. That basic legal principle is unchanged. As explained above, under a CTA, each team member is a prime contractor and in privity of contract with the government with respect to its underlying FSS contract. A CTA simply allows the agency to place orders with more than one CTA member for a single requirement, but the agency indicates the LAAFB order was placed with Vision.

Neither the agency nor Vision points to any basis in law or regulation to support the idea that the rules requiring FSS contractors to operate within the scope of their FSS contracts can effectively be ignored after the formation of a CTA. The agency merely references the EITaaS Wave 1 ordering guide for the unremarkable notion that all labor categories must be on CACI's or a CTA member's FSS contract. The agency, however, does not indicate where the ordering guide says that a CTA member can perform labor categories that are not on its own FSS contract.[13] Absent such support, we are unwilling to adopt such a proposition because the conclusion is at odds with the very notion that each team member is a prime contractor that has privity of contract with the government. Since each team member is a prime contractor, it is axiomatic that the terms of each contract must be the basis of that relationship, which necessarily includes the requirement for the FSS contractor to operate within the scope of its contract. Here, the agency has not shown that the LAAFB order is within the scope of Vision's FSS contract and, on the contrary, indicates that neither the agency nor Vision believed that it had to do so, or in fact did so. Accordingly, we also sustain the protest on this basis.

RECOMMENDATION

During the protest, the agency notified our Office that the head of the contracting activity had authorized continued performance under the LAAFB order as being in the government's best interests, as provided in 31 U.S.C. § 3554(b)(2). Under those circumstances, we are to recommend relief “without regard to any cost or disruption from terminating, recompeting, or reawarding the contract.” We therefore recommend that the agency terminate the LAAFB order issued to Vision and issue a new solicitation to meet its requirements consistent with the rules for full and open competition. We also recommend that the agency reimburse Ares its costs of filing and pursuing the protest, including reasonable attorneys' fees. 4 C.F.R. § 21.8(d)(1). In accordance with 4 C.F.R. § 21.8(f)(1), the protester's certified claim for such costs, detailing the time expended and costs incurred, must be submitted directly to the agency within 60 days after receipt of this decision.

The protest is sustained.

Edda Emmanuelli Perez
General Counsel

---