Deloitte Consulting, LLP

Decision

Matter of:  Deloitte Consulting, LLP

File:  B-419508; B-419508.2

Date:  April 15, 2021

DIGEST

Protest challenging award of a federal supply schedule (FSS) task order is sustained where the awardee’s quotation represented that the awardee would provide services exceeding the scope of the underlying FSS contract.

Deloitte Consulting LLP, of Arlington, Virginia, protests the General Services Administration’s (GSA) issuance of a federal supply schedule (FSS) task order to Kearney & Company, pursuant to request for quotations (RFQ) No. ID11200006, to provide cybersecurity and privacy support services for the Department of Housing and Urban Development (HUD).  Deloitte protests that Kearney’s quotation reflects services that are beyond the scope of the FSS labor categories on which Kearney’s quotation is based. 

We sustain the protest.

BACKGROUND

In August 2020, the GSA issued the final version of the RFQ,[1] pursuant to Federal Acquisition Regulation (FAR) subpart 8.4 procedures, seeking quotations to provide cybersecurity support services for HUD’s Chief Information Officer, Chief Privacy Officer, and Chief Information Security Officer.  Agency Report (AR), exh. 1, RFQ at 11.  More specifically, the solicitation stated that the agency was “seeking continued support in modernizing cybersecurity and privacy processes, capabilities, and services,” id., further noting that HUD:  “possesses over 200 information systems”; requires an “enterprise wide approach”; and seeks to be “more proactive in seeking vulnerabilities/ deficiencies in its information systems/assets, increasing employee/contractor cybersecurity knowledge, adjusting cybersecurity training, and enhancing reporting to internal and external stakeholders.”  Id. at 12.  Finally, the solicitation identified five specific services that will be required:  (1) cybersecurity support project management; (2) security architecture and innovation; (3) governance, risk, and compliance; (4) strategic initiatives; and (5) privacy program support.  Id.

The solicitation sought quotations from vendors holding Group 70 FSS contracts with special item number (SIN) 132-45 (titled “Highly Adaptive Cybersecurity Services”) and/or SIN 132-51 (titled “Information Technology Professional Services”), see Supp. AR at 7 n.4; advised vendors that source selection would be based on a best-value tradeoff determination;[2] and required vendors to submit fixed-price labor rates for labor categories on the vendors’ FSS contracts. 

On or before the September 2, 2020 closing date, quotations were submitted by four vendors, including Deloitte and Kearney.[3]  Deloitte’s quotation reflected rates for labor categories on its FSS contract under SIN 132-45, Highly Adaptive Cybersecurity Services; Kearney’s quotation reflected rates for labor categories on its FSS contract under SIN 132-51, Information Technology Professional Services.  Thereafter, the quotations were evaluated as follows:

Contracting Officer’s Statement at 2. 

On December 28, 2020, the agency selected Kearney’s quotation for award.  This protest followed.

DISCUSSION

Deloitte protests that Kearney’s quotation reflected services that were outside the scope of the FSS labor categories on which Kearney’s quotation was based and, accordingly, maintains that the quotation should have been rejected.[4] 

For example, Deloitte notes that Kearney’s quotation proposed to provide a [redacted]--drawn from the labor category “Systems Programmer II” on Kearney’s FSS contract.  Supp. Protest at 4.  Deloitte further notes that Kearney’s quotation provides that the services it will provide under this position include the following:

·  Review [redacted] documentation, including [redacted].

·  Review and analyze operation and proposed Component systems to identify [redacted].

·  Facilitate communications/workflow between applicable stakeholders.

·  Identify compliance gaps and define requirements to ensure compliance with HUD privacy policies, procedures, and legal statutes.

AR, exh. 4, Kearney’s Quotation at 150.

Finally, Deloitte notes that the “Systems Programmer II” labor category in Kearney’s FSS contract--on which Kearney’s quotation for the [redacted] position is based--describes only the following functional responsibilities of that position:

Responsible for programming for development and/or enhancement of various computer applications which may include operating, database, web, and/or other information systems.  Prepares technical documentation on code development and performs other activities such as testing and validation.

Supp. Protest, exh. 1, Kearney FSS Contract at 10.

In this context, Deloitte asserts that Kearney’s quotation regarding the position [redacted] represents that Kearney will provide a [redacted] who is capable of identifying compliance gaps and defining requirements to ensure compliance with HUD privacy policies, procedures and legal statutes; further, the quotation does not suggest that any programming functions will be performed under this position.  Yet, the FSS labor category--“Systems Programmer II,” to which this position is mapped (and on which a portion of the price quotation is based)--discusses only programming and/or coding activities, and gives no indication of any expertise regarding compliance with HUD privacy policies, procedures or legal statutes.  Protest at 4-8.

By way of another example, Deloitte notes that Kearney’s quotation proposed to provide a [redacted]--drawn from the labor category “Systems Analyst I” on Kearney’s FSS contract.  Supp. Protest at 6.  Deloitte further notes that Kearney’s quotation represents that the services to be performed under this position will include the following:

·  Track and maintain existing and emerging Federal authoritative cybersecurity and privacy laws, regulations, and guidance;

·  Communicates new laws and regulations to Team Kearney and HUD personnel;

·  Works with Kearney Team Task Leads to ensure they stay abreast and are working with the most up-to-date-authoritative guidance for their respective areas.

AR, exh. 4, Kearney Quotation at 141-42.

Again, Deloitte notes that the “Systems Analyst I” labor category in Kearney’s FSS contract--on which Kearney’s quotation for the [deleted] is based--describes only the following functional responsibilities of that position:

Responsible for performing various aspects of the systems development lifecycle to include analysis, design, programming, documentation, or implementation of information systems applications.  Prepares design documents and related technical reports/documentation.

Supp. Protest, exh. 1, Kearney’s FSS Contract at 10.

In this context, Deloitte asserts that Kearney’s quotation of a [redacted] represents that a significant portion of the services performed will involve staying abreast of cybersecurity and privacy developments and sharing this knowledge with the Kearney project team.  Supp. Protest at 4-8.  Yet, the FSS labor category “System Analyst I”--to which this position is mapped (and on which a portion of the price quotation is based)--makes no reference to such knowledge or expertise.  Id.  Overall, Deloitte protests that Kearney’s quotation was based on providing services that go significantly beyond a reasonable interpretation of the scope of services in the FSS labor categories on which Kearney’s quotation is based.[5]

The agency argues that, as reasonably interpreted, the FSS labor categories at issue “are intended to cover a large variety of potential requirements” and “broad functional responsibilities.” Supp. AR, at 2.  Accordingly, the agency maintains that the specific services required by the solicitation, and reflected in Kearney’s quotation, should be considered within the scope of the FSS labor categories on which Kearney’s quotation was based.  Id. at 7.  We disagree.

The FSS program, directed and managed by GSA, gives federal agencies a simplified process for obtaining commonly used commercial supplies and services.  FAR 8.401(a).  However, an agency may not use FSS procedures to purchase goods or services that are not contained on an awardee’s FSS contract.  See, e.g., US Investigations Servs., Prof’l Servs. Div., Inc., B-410454.2, Jan. 15, 2015, 2015 CPD ¶ 44 at 3; American Warehouse Sys., B-402292, Jan. 28, 2010, 2010 CPD ¶ 41 at 2.  That is, where an agency announces its intent to order from an existing FSS, all goods or services quoted must be on the vendor’s schedule contract as a precondition to its receiving the order.  Science Applications Int’l Corp., B-401773, Nov. 10, 2009, 2009 CPD ¶ 229 at 2 n.1; Tarheel Specialties, Inc., B-298197, B‑298197.2, July 17, 2006, 2006 CPD ¶ 140 at 4; CourtSmart Digital Sys., Inc., B‑292995.2, B‑292995.3, Feb. 13, 2004, 2004 CPD ¶ 79 at 5.  When a concern arises that a vendor is offering services outside the scope of its FSS contract, the relevant inquiry is whether the services offered are actually included on the vendor’s FSS contract, as reasonably interpreted.  AWS Convergence Techs., Inc., B-404002.2, B‑404002.3, Apr. 20, 2011, 2011 CPD ¶ 95 at 7.

Here, based on our review of Kearney’s quotation and the FSS contract on which that quotation is based, we conclude that award was improper in that some of the labor categories in Kearney’s FSS contract that formed the basis for award cannot be reasonably interpreted as including the services that are proposed by Kearney and are required by the solicitation.  For example, the description of the labor categories “System Programmer II” and “System Analyst I” in Kearney’s FSS contract cannot be reasonably interpreted to include the specific knowledge and expertise regarding cybersecurity and privacy requirements that are contemplated by the solicitation.  In addition, the FSS descriptions of these labor categories are inconsistent with the descriptions provided in Kearney’s quotation.  We are unpersuaded by the agency’s assertion that its “broad” reading of the FSS labor categories, discussed above, was reasonable or permissible.  Here, the RFQ sought specific knowledge and expertise to address cybersecurity and privacy-related threats to HUD’s information technology systems that currently exist and/or may be subsequently encountered, and required that specific services be performed to address such threats.  The knowledge, expertise, and activities necessary to address such threats are not reasonably reflected in the FSS labor categories on which Kearney’s quotation was based.  Accordingly, award to Kearney was improper.

RECOMMENDATION

In light of our discussion above, we conclude that the task order was not properly issued to Kearney on the basis of the quotation it submitted.  Accordingly we recommend that the agency terminate that task order for the convenience of the government and either:  (1) reopen discussions with the vendors to facilitate the submission of revised quotations based on FSS labor categories that reasonably reflect the solicitation’s cybersecurity and privacy-related requirements, and issue a task order based on such revised quotations; or (2) issue an order to the vendor next in line for selection under the terms of the solicitation.  We also recommend that Deloitte be reimbursed its costs of filing and pursuing the protest, including reasonable attorneys’ fees.  Bid Protest Regulations, 4 C.F.R. 21.8(d)(1).  Deloitte’s certified claims for such costs, detailing the time expended and costs incurred, must be submitted directly to the agency within 60 days after receipt of this decision.  4 C.F.R. 21.8(f)(1).

The protest is sustained.

Thomas H. Armstrong
General Counsel