Slalom Inc.

DOCUMENT FOR PUBLIC RELEASE

The decision issued on the date below was subject to a GAO Protective Order. This redacted version has been approved for public release.

Decision

Matter of: Slalom Inc.

File: B-422623; B-422623.2; B-422623.3

Date: August 29, 2024

Emily P. Golchini, Esq., Olivia L. Lynch, Esq., James G. Peyster, Esq., and Cherie J. Owen, Esq., Crowell & Moring LLP, for the protester.
Ryan P. McGovern, Esq., J. Andrew Jackson, Esq., Robyn B. Celestino, Esq., Shelbie M. Rose, Esq., and Matthew C. Sardo, Esq., Jones Day, for International Business Machines Corporation; and Isaias Alba, IV, Esq., Katherine B. Burrows, Esq., and Eric A. Valle, Esq., Piliero Mazza, PLLC, for Capital Technology Group, LLC, the intervenors.
Beth Sturgess, Esq., Richard Postma, Esq., Jessica Easton, Esq., and John Cornell, Esq., Department of Homeland Security, U.S. Citizenship and Immigration Services, for the agency.
Hannah G. Barnes, Esq., and Christina Sklarew, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision.

DIGEST

1. Protest challenging the acceptability of the awardee's quotation under the corporate experience factor is denied where the plain language of the solicitation required one, but not both, of the members of the awardee's contractor team arrangement to submit a corporate experience example.

2. The agency's evaluation of the protester's quotation under the technical demonstration factor did not constitute application of unstated evaluation criteria.

3. The agency's evaluation under the past performance factor was reasonable and sufficiently documented.

DECISION

Slalom, Inc., of McLean, Virginia, protests the issuance of a task order to the contractor teaming arrangement (CTA) of International Business Machines Corporation (IBM) and Capital Technology Group, LLC (CTG), of Bethesda, Maryland, by the Department of Homeland Security, U.S. Citizenship and Immigration Services (USCIS), under request for quotations (RFQ) No. 70SBUR24Q00000004 for information technology (IT) services.[1] Slalom protests various aspects of the agency's evaluation and source selection decision.

We deny the protest.

BACKGROUND

On December 18, 2023, the agency issued the RFQ, pursuant to Federal Acquisition Regulation (FAR) subpart 8.4, seeking development, security, and operations services to support software development for USCIS's Verification Information System, a national record system containing immigration status information used to determine immigrants' employment and benefit eligibility. Agency Report (AR), Tab 5, RFQ at 62; AR, Tab 5a, Performance Work Statement (PWS) at 1. The solicitation, issued to vendors holding General Services Administration (GSA) multiple award schedule contracts with special item number 54151S, IT Professional Services, anticipates the issuance of a hybrid, timeand-materials, fixed-price task order with a 12-month base period and four 12month option periods.[2] RFQ at 49.

The solicitation provided for award on a best-value tradeoff basis, considering the following five factors: corporate experience, oral presentation, technical demonstration, past performance, and price. RFQ at 63. The RFQ advised that the non-price factors were equally important, and that, when combined, they were “significantly more important than price.” Id. The solicitation also cautioned that while USCIS was more concerned with “obtaining superior performance capability,” it would “not issue an award to a quoter who presents a considerably higher overall price to achieve only slightly superior performance capabilities.” Id. at 68.

As amended, the solicitation established a two-phase process. In phase one, the agency evaluated quotations under the corporate experience and oral presentation factors. RFQ at 61. Thereafter, the agency informed vendors of their likelihood of success based on the phase one evaluation results and recommended either that they proceed or not proceed with a phase two submission. Id. In phase two, the agency evaluated the remaining factors.

Of relevance here, the RFQ established three different “groups” of requirements for submitting experience examples, labeled A, B, and C, and required vendors to submit at least one “group A” corporate experience example and gave vendors the option to submit examples for “group B” and “group C.”[3] RFQ at 52. The solicitation advised that all submitted examples should be recent and relevant, with recency defined as “projects performed in the past five [] years from the date of this solicitation issuance” for all three groups. Id. For group A, the solicitation advised that “the quoter shall provide at least one [], and up to three [], recent and relevant example(s) by the quoting contractor,” which the RFQ defined as “the prime contractor, all members of a GSA [s]chedule [c]ontractor [t]eam [a]rrangement (CTA) performing at least 25% of the work on FALCON, or partner of a [j]oint [v]enture.”[4] The solicitation defined relevant group A examples as projects with a specific focus:

Relevant experience examples shall include only projects that employed Agile and DevSecOps techniques in Amazon Web Services (AWS) and each must show the handling of large scale contracts consisting of at least ten (10) DevSecOps teams, nine (9) to twelve (12) people each, developing discrete applications with various technologies in AWS environment, managing a total staff of ninety-plus (90+) Full Time Employees (FTEs), and a total contract obligation (current/actual dollars obligated) of over eighty (80) million dollars. Each example shall show a minimum of two (2) years of delivered contract period of performance in order to be deemed relevant.

RFQ at 52-53. The solicitation further advised that any quotation “submitted without an example from the quoting contractor demonstrating this experience will be rated ‘low confidence,' [and] will not be eligible for award.” Id. at 63.

With respect to the technical demonstration, the solicitation provided for an in-person demonstration in which vendors would implement a solution, after twelve calendar days of preparation, for a problem statement they received from the agency. RFQ at 57. The solicitation directed vendors to build the solution using specific technical tools and platforms and allocated thirty minutes for the solution setup, forty minutes for the presentation of the solution, and twenty minutes for the agency to ask clarifying questions. Id. at 59. The agency would then provide additional instructions to enhance the solution, and the vendors would have five hours to implement those instructions and an hour to demonstrate the enhanced solution, after which the agency would have thirty minutes to again ask clarifying questions. Id. As relevant here, the solicitation advised that vendors would be evaluated based on the extent to which “the process is consistent with best practices and the approaches planned for FALCON, in accordance with the PWS” and specifically provided for the evaluation of “[s]ecurity practices” and the extent to which the vendor “integrate[d] security into [the] software development lifecycle.” Id. at 66.

For the technical demonstration factor, the corporate experience factor, and the oral presentations factor, the solicitation provided that the agency would assign a confidence rating of high confidence, some confidence, or low confidence. Id. at 69. Quotations would be assigned a rating of superior, satisfactory, unsatisfactory, or neutral under the past performance factor. Id.

Under the past performance factor, the RFQ advised vendors that the relevant examples provided under the corporate experience factor “will be considered recent and relevant for purposes of past performance and the entire period of performance will be evaluated for past performance.” RFQ at 59. The solicitation directed vendors not to provide additional documentation for the past performance factor. Id.

By January 5, 2024, the closing date for receipt of quotations, the agency received quotations from seven vendors. Contracting Officer's Statement (COS) at 1. Following the phase one advisory downselect, three vendors, including Slalom and IBM, proceeded to the technical demonstration stage.[5] COS at 2. All three vendors submitted price quotations by the February 28 due date. Id. at 3. The agency evaluated IBM's and Slalom's quotations as follows:

	Corporate Experience	Oral Presentations	Technical Demonstration	Past Performance	Total Evaluated Price
Slalom	Some Confidence	High Confidence	High Confidence	Superior	$349,616,116
IBM	High Confidence	Some Confidence	High Confidence	Superior	$305,574,755

See AR, Tab 22, Source Selection Decision Document (SSDD) at 4.

On May 16, the contracting officer selected IBM for award on the basis that IBM's and Slalom's quotations were “essentially equal” and IBM offered a “much lower price.” COS at 3-4; AR, Tab 22, SSDD at 15. This protest followed.

DISCUSSION

Slalom challenges virtually every aspect of the agency's evaluation, including the following representative examples. First, Slalom contests the agency's evaluation of the corporate experience factor, arguing that IBM's quotation failed to comply with a solicitation requirement. Second, Slalom argues that the agency applied unstated evaluation criteria in evaluating Slalom's quotation under the technical demonstration factor. Finally, the protester challenges the agency's determination that Slalom's and IBM's past performance quotations were essentially equal. After reviewing the record, we find no basis to sustain Slalom's protest.[6]

Corporate Experience

Slalom argues that IBM's quotation failed to comply with the solicitation requirement regarding group A corporate experience. Supp. Protest at 5. Specifically, the protester asserts that the RFQ required each member of the IBM CTA -- IBM and CTG -- to submit a group A corporate experience example. Id. at 6. At issue is the following solicitation requirement:

Group A: The quoter shall provide at least one (1), and up to three (3), recent and relevant experience example(s) by the quoting contractor that meet the criteria above. If the quoting contractor is a Joint Venture (JV), the quoting contractor must submit at least one example from each of the JV partners. For the purposes of this solicitation, “quoting contractor” is defined as the prime contractor, all members of a GSA Schedule Contractor Team Arrangement (CTA) performing at least 25% of the work on FALCON, or partner of a Joint Venture.

RFQ at 52. Slalom contends that the solicitation's definition of “quoting contractor” means that each member of a CTA must individually provide at least one group A example. Id.

Slalom points to the agency's responses in a question-and-answer session (Q&A) incorporated by amendment into the solicitation. Id. at 7; Comments and Second Supp. Protest at 15. Specifically, a vendor asked the agency to confirm that the group A experience requirement “is for 1 to 3 relevant experience past performance references from the CTA as a whole and not 1 to 3 relevant experiences from each member of the CTA providing more than 25% of the work on FALCON.” AR, Tab 6b, Q&A at 1. The agency responded that it “can confirm that the 1 to 3 relevant corporate experiences is the total number of corporate experiences [whether] from the prime or CTA members performing at least 25% of the work on FALCON . . . .” Id. Slalom claims that the agency's response directly supports its assertion that each member of the CTA, not the CTA as a whole, had to submit at least one group A corporate experience example. Supp. Protest at 6.

The agency responds that the solicitation did not contain a requirement for each member of a CTA to submit a group A example under the corporate experience factor. Memorandum of Law (MOL) at 20. USCIS points to the RFQ language, emphasizing that it specifically requires each member of a JV to submit a group A example if the quoting contractor is a JV--but does not state the same requirement for each member of a CTA. Id. at 21; RFQ at 52. The agency also argues that basic math makes it impossible for the RFQ to require each member of a CTA to submit a group A experience, as the solicitation limits group A submissions to three examples, meaning a CTA consisting of four firms performing 25% of the work on the effort at issue could not submit four group A examples without violating this limitation. MOL at 21.

The agency also asserts that the Q&A bolsters its position, not Slalom's. Specifically, the agency points to its answer that confirmed that one to three relevant experiences was the number required from the CTA “as a whole and not . . . from each member.” MOL at 21 (quoting AR, Tab 6b, Q&A at 1). In short, the agency contends that, consistent with the language in the solicitation and the Q&A responses, “the evaluation criteria did not say ‘any and all' who meet the definition of quoting contractor must have successfully executed a large-scale contract [consistent with group A recency and relevancy requirements,]” but rather that the quoting contractor must submit one such corporate experience example. Id. at 22 (citing RFQ at 63).

Where a protester and agency disagree over the meaning of solicitation language, we will resolve the matter by reading the solicitation as a whole and in a manner that gives effect to all of its provisions; to be reasonable, and therefore valid, an interpretation must be consistent with the solicitation when read as a whole and in a reasonable manner. See Glock, Inc., B-414401, June 5, 2017, 2017 CPD ¶ 180 at 8. Where a dispute exists as to a solicitation's actual requirements, we will first examine the plain language of the solicitation. Id.

Here, we agree with the agency that the solicitation did not require IBM and CTG to each submit a corporate experience group A example. The plain language of the solicitation's evaluation criteria stated that a quotation “without an example from the quoting contractor” meeting corporate experience recency and relevancy requirements would receive a low confidence rating, and this wording supports the agency's position that the quoting contractor, as a whole, needed to submit one group A example. RFQ at 63 (emphasis added). Further, in instructing quoting contractors to provide one to three corporate experience examples, the RFQ defined the quoting contractor, in the case of a CTA, as “all members” of a CTA. RFQ at 52. The solicitation provided an exception to this language only with regard to joint ventures, by expressly requiring each joint venture partner to submit a group A example, rather than the joint venture as a whole. RFQ at 52.

Further, the agency's Q&A response supports the agency's argument. Specifically, in the Q&A, a prospective vendor asked the agency to confirm that the group A corporate experience requirement “is for 1 to 3 relevant experience past performance references from the CTA as a whole and not 1 to 3 relevant experiences from each member of the CTA providing more than 25% of the work on FALCON.” AR, Tab 6b, Q&A at 1 (emphasis added). The agency responded by confirming the vendor's understanding. Id. Finally, as the agency notes, the protester's interpretation of the solicitation language would make it impossible for a four-member team CTA to comply with the RFQ's limitation on the number of corporate experience submissions in the group A category. See MOL at 21. Accordingly, we conclude that the solicitation required the CTA as a whole, not each member, to submit at least one group A example under the corporate experience factor. Slalom's assertions to the contrary are without merit and its protest challenging the agency's evaluation under the corporate experience factor is denied.

Technical Demonstration

Next, with regard to the evaluation under the technical demonstration factor, Slalom complains that the agency improperly assigned decreased confidence ratings due to Slalom's failure to comply with “security best practices.” Specifically, Slalom complains that the negative assessments reflect application of criteria “that were never once defined or mentioned in the [s]olicitation.” Protest 65. For example, during the technical demonstration, the agency criticized Slalom's failure to secure a particular database that housed test data in a private subnet. AR, Tab 19, Technical Evaluation at 32. The protester argues that the solicitation did not require the database be secured, that it secured the database by other means, and that “Slalom's decision not to place the database in a private subnet was a calculated business decision to avoid overcomplicating its proposed solution.” Protest at 64-67, 67 n.26. Slalom contends that the only references to the RFQ's best security practices under the technical demonstration factor is the requirement to follow a process “consistent with best practices and the approaches planned for FALCON” and to conduct the demonstration in accordance with “[s]ecurity practices.” The protester argues that this provided inadequate notice to vendors regarding the evaluation standard the agency would apply, which resulted in these negative findings. Comments and Second Supp. Protest at 50 (quoting RFQ at 66).

The agency responds that the solicitation clearly advised vendors that they would be evaluated based on whether their solution for the technical demonstration was consistent with best practices, including security best practices. MOL at 25. The agency argues that securing a potentially sensitive database in a private subnet is a security best practice. Id. at 26. USCIS asserts that failing to use a secure private subnet gave “anyone on the Internet” access, while “[s]ecuring in a private subnet is a best practice because it prevents outside access from attempting to enter the database, allowing for a lower chance of attack.” Id.

Where, as here, a procurement is conducted pursuant to FAR subpart 8.4, our Office will not reevaluate proposals, nor substitute our judgment for that of the agency; rather, we will review the record to ensure that the agency's evaluation was reasonable and consistent with the terms of the solicitation and applicable procurement laws and regulations. Computer World Servs., B-417634, Sept. 6, 2019, 2019 CPD ¶ 340 at 5. In this context, a protester's disagreement with a procuring agency's evaluation judgments, without more, does not establish that the evaluation was unreasonable. Robbins-Gioia, LLC, B-402199 et al., Feb. 3, 2010, 2010 CPD 67 ¶ at 6. Finally, while a solicitation must disclose the evaluation factors, it need not specifically identify every element an agency may consider during an evaluation where such elements are intrinsic to, or reasonably subsumed within, the stated factors. FAR 15.304(d); Computer World Servs., supra.

Here, the solicitation clearly advised offerors that they would be evaluated under the technical demonstration factor based on the extent to which vendors followed best practices, including security best practices. RFQ at 66. We note the agency's argument that Slalom's failure to use a private subnet to secure a database could enable outside access and raise a higher likelihood of attack, and its failure to use an image scanning tool caused the protester to miss vulnerabilities in the system. MOL at 26, 28. Consequently, the record shows that the agency had a reasonable basis to conclude Slalom's failure to follow these practices compromised the security of the system during the technical demonstration, and we find no basis to question the agency's judgment. In short, the protester's disagreement with the agency fails to establish that the agency's judgment was unreasonable. Slalom's protest challenging the agency's evaluation under the technical demonstration factor is denied.[7]

Past Performance

Finally, Slalom argues that the agency's conclusion that Slalom's and IBM's past performance quotations were “essentially equal” was unreasonable and inadequately documented. Comments and Second Supp. Protest at 46 (quoting AR, Tab 22, SSDD at 15). The protester contends that its quotation regarding past performance is “vastly different” from IBM's, pointing to its “successful incumbent past performance.” Id. at 47. Slalom asserts that the agency concluded the two past performance quotations were essentially equal without looking behind their adjectival ratings and “with no substantive comparison of the quotes.” Id. at 48.

The agency responds that its conclusion was both reasonable and sufficiently documented. Specifically, USCIS argues that it considered the Contractor Performance Assessment Reporting System (CPARS) reviews and the past performance questionnaires, and documented this evaluation in the SSDD. Supp. MOL at 5-6. Further, the agency contends that the SSDD specifically addressed various aspects of Slalom's past performance, discussing [REDACTED] ratings Slalom received in a prior contract and concluding that those ratings were not due to Slalom's performance. Id. at 6; AR, Tab 22, SSDD at 15.

In a FAR subpart 8.4 procurement, an agency's evaluation judgments must be documented in sufficient detail to show that they are reasonable. Neopost USA Inc., B404195, B-404195.2, Jan. 19, 2011, 2011 CPD ¶ 35 at 7; FAR 8.405-2. However, for procurements conducted under this section of the FAR that require a statement of work, such as this one, subsection 8.405-2(f) of the FAR designates limited documentation requirements. Here, the record shows that the evaluators utilized CPARS to verify the past performance examples provided by vendors, considered the individual examples submitted, and documented these considerations. AR, Tab 33, Business Evaluation Report at 9-10. For example, the agency noted [REDACTED] ratings in one of the protester's submissions and concluded that those ratings did not relate to Slalom's performance. AR, Tab 22, SSDD at 15.

Based on our review of the record, we agree with the agency that it adequately documented its conclusions regarding the awardee's and protester's past performance quotations and find that the protester's disagreement with the agency's past performance rating does not establish that the agency' s evaluation was unreasonable. Further, to the extent the protester believes that its incumbent status merited a higher past performance rating on its quotation than IBM's, our Office has explained that there is no requirement that an incumbent be given extra credit for its status as an incumbent, or that an agency assign or reserve the highest rating for the incumbent vendor. LogiCore Corp., B-416629 et al., Nov. 6, 2018, 2018 CPD ¶ 383 at 7-8. This protest ground is denied.

The protest is denied.

Edda Emmanuelli Perez
General Counsel

---