First Financial Associates, Inc.

Decision

Matter of:  First Financial Associates, Inc.

File:  B-415713; B-415713.2

Date:  February 16, 2018

DIGEST

Protest of an agency's technical evaluation is denied where the record demonstrates that the evaluation and source selection decision were reasonable and consistent with the solicitation's evaluation criteria.

First Financial Associates, Inc. (FFA), of Lithonia, Georgia, protests the award of a contract to FEEA Childcare Services, Inc. (FEEA) of Alexandria, Virginia, under request for proposals (RFP) No. HSSS01-17-R-0012, issued by the Department of Homeland Security, United States Secret Service, to administer the agency's child care subsidy program (CCSP).  FFA challenges the agency's technical and price evaluations and source selection decision.

We deny the protest.

BACKGROUND

The RFP, which was set aside for small businesses, provided for the award of a fixed-price contract (for a base year and 1 option-year) on the basis of a best-value tradeoff among three evaluation factors:  technical, past performance, and price.[1]  RFP at 1-4, 11-12, 15, 36, 42.[2]  The technical factor included three subfactors:  corporate experience; development of informational website (website); and--at issue here--protection of personally identifiable information (PII).  Id. at 11.

The agency received proposals from eight offerors by the April 10, 2017, deadline, including from FFA and FEEA, whose proposals were evaluated as follows:

AR, Tab 13, Source Selection Decision (SSD), at 4-7; Tab 14, Debrief Letter, at 1. The evaluation findings, as well as the RFP's evaluation provisions and statement of work, are addressed in relevant part below.

The contracting officer, who was the source selection authority (SSA) for the procurement, reviewed the evaluations, conducted a comparative assessment of proposals, and performed a best-value tradeoff.  AR, Tab 13, SSD, at 2, 6-8; see Memorandum of Law (MOL) at 2.  The SSA determined that FEEA's highly-rated and reasonably-priced proposal offered the best value to the agency.  AR, Tab 13, SSD, at 7-8.

The Secret Service awarded the contract to FEEA on September 29.  FFA filed an agency-level protest challenging the award.  Following denial of the agency-level protest, FFA filed the instant protest with our Office.

DISCUSSION

FFA protests the evaluation of its technical proposal and the evaluation of FEEA's price proposal, as well as the agency's best-value determination and source selection decision.  Although we do not address each of FFA's arguments, we have considered all of the protester's contentions and find that none provides a basis to sustain the protest.[4]

Evaluation of Protester's Technical Proposal

FFA contends that its proposal was evaluated contrary to the RFP's evaluation criteria regarding the protection of personally identifiable information.  Protest at 7-10.  In reviewing protests of an agency's evaluation, our Office does not reevaluate proposals, rather, we review the record to determine if the evaluation was reasonable, consistent with the solicitation's evaluation scheme, as well as procurement statutes and regulations, and adequately documented.  See Wackenhut Servs., Inc., B-400240, B-400240.2, Sept. 10, 2008, 2008 CPD ¶ 184 at 6; Cherry Road Techs.; Elec. Data Sys. Corp., B-296915 et al., Oct. 24, 2005, 2005 CPD ¶ 197 at 6. 

The RFP's statement of work advises that the contractor will have daily access to PII and specifies numerous requirements for safeguarding such information, including that the contractor, "upon discovering a security incident, shall report it in accordance with U.S. Secret Service incident reporting procedures and shall expeditiously notify the Contract[ing] Officer's Representative or Designated Official."  AR, Tab 4, RFP amend. 1, Statement of Work (SOW), at 5-6 (emphasis added).

The solicitation's evaluation criteria stated the following in this respect:

The offeror shall submit a standard operating procedure (SOP) document that discloses the procedures utilized in the protection of PII.  The offeror shall be evaluated on its SOP that demonstrates the protection of applicant, recipient PII, and its notification process if a breach or leak [of] information has occurred.

RFP at 11 (emphasis added).

At issue here, FFA's technical proposal included a PII policy (or SOP) that stated:

The FFA Chief Information Officer [CIO] must be informed of a real or suspected disclosure of Protected PII data within 12 hours after discovery, e.g. misplacing a paper report, loss of a laptop, mobile device, or removable media containing PII, accidental email of PII, possible virus, or malware infection o[f] a computer containing PII, etc.

AR, Tab 7, FFA Tech. Proposal, at 46.

The technical evaluation team (TET) assessed a weakness in FFA's proposal under the PII protection subfactor, because the evaluators found that 12 hours was too long to notify the agency of a PII security incident and the statement of work requires that such incidents must be reported expeditiously.  AR, Tab 9, TET Rep., at 11.  FFA's proposal was assigned a marginal rating under the PII protection subfactor based on the weakness.  Id.

FFA argues that this assessment was unreasonable because, according to the protester, the RFP only required offerors to submit a PII SOP consistent with the solicitation's evaluation provisions, not the statement of work.  Protest at 7-9; Protester's Comments at 5.  In this respect, FFA asserts that the use of the past tense "utilized" in the protection of PII evaluation provision indicated that offerors could only submit an existing, "established" SOP, not that offerors should propose "future" SOP plans that had not been previously utilized.  Protest at 8-10.  The protester believes this is the only reasonable interpretation of the RFP and that any ambiguity in this regard was latent and "only came to light in the context of the Agency's evaluation."  Id. at 10.

The Secret Service maintains that FFA's interpretation is unreasonable and that the solicitation's PII requirements were unambiguous.  MOL at 3, 5.  The agency argues that the RFP, when read as a whole, required offerors to submit an SOP that described an expeditious procedure for notifying the agency of a breach of PII, consistent with the statement of work.  See id. at 4-5.  The agency contends that it reasonably evaluated FFA's PII policy, which simply did not meet the RFP requirements.[5]  Id. at 3-5.

We agree with the agency and find, based on our review of the record, that the Secret Service evaluated FFA's technical proposal reasonably and consistent with the solicitation's PII provisions.  Where a dispute exists as to the meaning of a solicitation provision, we will resolve the matter by reading the solicitation as a whole and in a manner that gives effect to all its provisions.  See Veterans Elite, Inc., B-409233, Feb. 10, 2014, 2014 CPD ¶ 64 at 3-5.

The RFP, as set forth above, expressly stated that an offeror would "be evaluated on its SOP that demonstrates the protection of applicant, recipient PII and its notification process if a breach or leak [of] information has occurred."  RFP at 11.  The RFP incorporated, by reference, Federal Acquisition Regulation (FAR) provision 52.212-1, Instructions to Offerors--Commercial Items, which requires that offers, at a minimum, "must show . . . [a] technical description of the items being offered in sufficient detail to evaluate compliance with the requirements in the solicitation."  Id. at 14; see FAR provision 52.212-1(b)(4).  The solicitation also incorporated Homeland Security Acquisition Regulation (HSAR) Special Clause - Safeguarding of Sensitive Information.  RFP at 42-47.  That clause--which the protester fails to address--specifies countless procedures and requirements for handling and protecting PII, including that the contractor must report all known or suspected sensitive information incidents to DHS headquarters or the component security operations center "within one hour of discovery" and must immediately notify the contracting officer of the incident.[6]  Id. at 48-49.

Moreover, the RFP provided for award on the basis of a best-value tradeoff.  Id. at 15.  When a solicitation provides for award on the basis of a best-value tradeoff (as opposed to a lowest-price, technically-acceptable basis, for example), the evaluation of proposals is not limited to determining whether a proposal is merely technically acceptable; rather, proposals may be further differentiated to distinguish their relative quality by considering the degree to which technically acceptable proposals exceed the standard minimum requirements or will better satisfy the agency's needs.  See Interfor US, Inc., B-410622, Dec. 30, 2014, 2015 CPD ¶ 19 at 5; Interlog, Inc., B-282139, Apr. 27, 1999, 99-1 CPD ¶ 87 at 3.

In our view, these provisions leave little doubt that the agency intended to evaluate the extent to which an offeror proposed an SOP that complied with all of the solicitation's PII requirements, including that the contractor report and expeditiously notify the agency of a breach or leak of PII.  Were we to adopt the protester's interpretation of the RFP, the agency would have been limited to evaluating only whether or not an offeror submitted an SOP that included some process for notifying the agency of a breach of PII.  Under FFA's mistaken view, the Secret Service could not have evaluated the extent to which an offeror's SOP exceeded the notification requirements in the statement of work and the HSAR clause described above.  We find the protester's interpretation unreasonable and conclude that the RFP, when read as a whole and in a manner giving effect to all of its provisions, is not ambiguous.  In any event, we agree with the Secret Service that even if the RFP was ambiguous, the ambiguity was patent and FFA should have timely questioned it prior to submitting a proposal.[7]  See MOL at 5-6.

In sum, we find no basis to question the agency's evaluation of FFA's technical proposal.  The protester's allegations to the contrary only reflect its disagreement with the agency's evaluations, which provides no basis to question the reasonableness of the agency's judgments.  See Citywide Managing Servs. of Port Washington, Inc., B-281287.12, B-281287.13, Nov. 15, 2000, 2001 CPD ¶ 6 at 10-11.  We deny this aspect of FFA's protest, accordingly.

Exchanges

The protester also contends that the Secret Service abused its discretion by not seeking clarifications or conducting discussions with FFA regarding its PII procedures.  Protest at 10-13.

As set forth above, the RFP incorporated FAR provision 52.212-1, which states that the agency intends to evaluate offerors and make award without discussions, but reserves the agency's right to conduct discussions if determined necessary by the contractor.  RFP at 14; FAR provision 52.212-1(g).  Discussions occur when an agency communicates with an offeror for the purpose of obtaining information essential to determine the acceptability of a proposal, or provides the offeror with an opportunity to revise or modify its proposal in some material respect.  See FAR § 15.306(d); see also Environmental Quality Mgmt., Inc., B-402247.2, Mar. 9, 2010, 2010 CPD ¶ 75 at 5.  In contrast, clarifications are limited exchanges between the agency and offerors that may occur when contract award without discussions is contemplated; an agency may, but is not required to, engage in clarifications that give offerors an opportunity to clarify certain aspects of proposals or to resolve minor or clerical errors.  FAR § 15.306(a); Satellite Servs., Inc., B-295866, B-295866.2, Apr. 20, 2005, 2005 CPD ¶ 84 at 2 n.2.

We agree with the Secret Service that it was not required to seek clarifications or conduct discussions with FFA.  See MOL at 6-10.  Contrary to the protester's assertion, permitting FFA to address its notification process for a breach of PII would constitute discussions, not clarifications, because it would require FFA to revise its proposal in some material respect.  See FAR § 15.306(d); see, e.g., Alltech Eng'g Corp., B-414002.2, Feb. 6, 2017, 2017 CPD ¶ 49 at 5-7 (finding that providing an offeror the opportunity to revise its proposal and cure a deficiency would constitute discussions).  Moreover, an agency's discretion to hold discussions is quite broad and is not generally reviewed by this Office.[8]  Alliance Worldwide Distrib., LLC, B-408491, Sept. 12, 2013, 2013 CPD ¶ 223 at 3.  There are no statutory or regulatory criteria specifying when an agency should or should not initiate discussions.  L-3 Servs., Inc., B-406292, Apr. 2, 2012, 2012 CPD ¶ 170 at 14.

Thus, FFA's contention that the Secret Service was obligated to conduct discussions or seek clarifications regarding FFA's PII procedures, lacks merit.  See Alares, LLC, B-407124, Nov. 7, 2012, 2012 CPD ¶ 316 at 4-5 (denying challenge to agency's evaluation where the protester's proposal failed to address compliance with infection control procedures and provide a construction safety plan, as required by the solicitation, and the agency was not required to seek clarifications in this respect).

Evaluation of Awardee's Price Proposal

FFA also protests the evaluation of the awardee's price proposal, arguing that the agency failed to consider the risk of FEEA's allegedly unbalanced pricing arising from its "extremely low" prices for certain CLINs.  Protester's Comments at 2-4.

Unbalanced pricing exists where the prices of one or more line items are significantly overstated or understated, despite an acceptable total evaluated price (typically achieved through underpricing of one or more other line items).  General Dynamics--Ordnance & Tactical Sys., B-401658, B-401658.2, Oct. 26, 2009, 2009 CPD ¶ 217 at 5.  To prevail on an allegation of unbalanced pricing, a protester must show that one or more prices in the allegedly unbalanced proposal are overstated; it is insufficient for a protester to show simply that some line item prices in the proposal are understated.  Marine Terminals Corp.-East, Inc., B-410698.9, Aug. 4, 2016, 2016 CPD ¶ 212 at 11.  While both understated and overstated prices are relevant to the question of whether unbalanced pricing exists, the primary risk to be assessed in an unbalanced pricing context is the risk posed by overstatement of prices, because low prices (even below cost prices) are not improper and do not themselves establish (or create the risk inherent in) unbalanced pricing.  American Access, Inc., B-414137, B-414137.2, Feb. 28, 2017, 2017 CPD ¶ 78 at 5; Crown Point Sys., B-413940, B-413940.2, Jan. 11, 2017, 2017 CPD ¶ 19 at 5.

Here, FFA only claims that some of FEEA's CLIN prices are understated; FFA does not allege that any of the awardee's CLIN prices are overstated.  Protester's Comments at 1-4; Protester's Supp. Comments at 1-4.  As such, FFA provides no basis for us to question the agency's price evaluation for allegedly failing to identify unbalanced prices.  See Veterans Evaluation Servs., Inc., et al., B-412940.26 et al., Jan. 5, 2017, 2017 CPD ¶ 17 at 14, citing Marine Terminals Corp.-East, Inc., supra.

Best Value Determination

Finally, FFA challenges the agency's best-value determination and source selection decision because it was based on the allegedly flawed evaluations discussed above.  See Protest at 14; Protester's Comments at 7.

As discussed above, we find no merit to FFA's objections to the agency's technical and price evaluations.  Thus, there is no basis to question the Secret Service's reliance upon those evaluation judgments in making its source selection, and the protester's disagreement in that regard does not establish that the agency acted unreasonably or provide a basis to sustain its protest.  See Citywide Managing Servs. of Port Washington, Inc., supra.

The protest is denied.

Thomas H. Armstrong
General Counsel

[6] The HSAR clause states that PII is a subset of sensitive information and the clause defines a sensitive information incident as "an incident that includes the known, potential, or suspected exposure, loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or unauthorized access or attempted access of any Government system, Contractor system, or sensitive information."  RFP at 45-46; HSAR Class Deviation 15-01, available at https://www.dhs.gov/sites/default/files/publications/HSAR Class Deviation 15-01 Safeguarding of Sensitive Information.pdf (last visited Feb. 13, 2018)