KPaul Properties, LLC

DOCUMENT FOR PUBLIC RELEASE
The decision issued on the date below was subject to a GAO Protective Order. This redacted version has been approved for public release.

Decision

Matter of:  KPaul Properties, LLC

File:  B-419893; B-419893.6

Date:  September 15, 2021

DIGEST

1.  Protest that requirement to submit International Organization for Standardization certification with phase I proposal is unduly restrictive of competition is denied where requirement is reasonably related to agency’s needs.

2.  Protest that agency was required to allow protester to elect to participate in phase II of procurement is denied where protester was eliminated following a compliance check, and its phase I proposal was not evaluated.

3.  Protest that agency could not eliminate protester’s proposal from the competition for failing to provide International Organization for Standardization certification with its phase I proposal without referring the matter to the Small Business Administration under its certificate of competency procedure is denied where certification is a technical evaluation criterion, and not a responsibility criterion. 

KPaul Properties, LLC, a small business of Indianapolis, Indiana, protests the terms of request for proposals (RFP) No. 70RTAC21R00000003, issued by the Department of Homeland Security (DHS) for information technology services.  KPaul asserts that the requirement for offerors to submit with phase I proposals either International Organization for Standardization (ISO) certification 9001:2015 quality management systems and/or ISO certification 20243:2018 open trusted technology provider standards is unduly restrictive of competition.  KPaul further protests that the agency failed to follow the terms of the solicitation when it eliminated the firm from the competition without evaluating KPaul’s phase I proposal because KPaul did not provide an ISO certification.  Finally, KPaul protests that the agency could not reject KPaul’s proposal for failing to provide an ISO certification, without referring the matter to the Small Business Administration (SBA) for a certificate of competency (COC) assessment.[1]

We deny the protest.

BACKGROUND

The solicitation was issued as a small business set-aside[2] on April 20, 2021, for two functional categories--information technology value added resellers and software under the DHS-wide FirstSource III contract.[3]  The solicitation anticipates the award of multiple indefinite-delivery indefinite-quantity (IDIQ) contracts under each of the functional categories for a 5-year base period, three 1-year option periods, and one 2-year option period.  AR, Tab 6b, RFP amend. 2 at 24.  The estimated value of the procurement is $10 billion.  Id. at 1.  Offerors are permitted to submit proposals for either or both functional categories.  Id. at 104. 

The agency is conducting the procurement in two phases.  Id.  During phase I, offerors were required to submit a compliance checklist, a signed cover letter, and responses to two technical evaluation factors:  ability to perform the work, and supply chain risk management approach.  Id. at 104, 105.  The compliance checklist included a list of proposal requirements identified in the solicitation and a column where the offerors could indicate that their proposals met each requirement.  AR, Tab 6c, RFP amend. 2, attach. 6, Compliance Checklist.  Phase I proposals were due on June 9.

As relevant to this protest, the solicitation instructed offerors to provide ISO certification 9001:2015 quality management systems and/or ISO certification 20243:2018 open trusted technology provider standards at the time of submission of their phase I proposals.  RFP at 111.  Offerors were required to indicate whether they submitted the required certifications in the compliance checklist.  AR, Tab 6c, RFP amend. 2, attach. 6, Compliance Checklist.  The certifications also were to be evaluated as part of technical factor I, ability to perform the work.  RFP at 111.  The solicitation advised offerors that the government would look more favorably on proposals that included both certifications.  Id. 

The solicitation notified offerors that the government would conduct a compliance review for both phases.  In particular, the RFP stated that proposals that “do not contain a completed compliance review checklist will not be evaluated” and that proposals that were found to be “noncompliant in accordance with the solicitation instructions will not be evaluated.”  RFP at 107. 

Following the compliance review the agency evaluated phase I proposals.  When the evaluation of the phase I proposals was completed, the agency provided an advisory notification letter to each offeror.  Id. at 113, 122.  The letter advised the offeror either that its proposal was among the most highly rated and the offeror should proceed to phase II, or that the proposal was not among the most highly rated, and the offeror was not likely to be a viable competitor.  Id.  The government’s advice was a recommendation only; offerors who were advised not to proceed to phase II could elect to continue their participation in the procurement.[4]  Id.

On June 8, KPaul submitted a protest to our Office prior to the due date for phase I proposals.  In that protest KPaul asserted that the requirement to submit the ISO certification with the phase I proposal was unduly restrictive of competition.[5]  Subsequently, KPaul submitted a phase I proposal which was rejected because KPaul failed to submit an ISO certification with the proposal.  KPaul then submitted a supplemental protest in which it argued that under the terms of the solicitation the agency was required to allow KPaul to participate in phase II if KPaul chose to do so.  KPaul also protested that when the agency rejected KPaul’s proposal for failing to provide an ISO certification, the agency was considering KPaul’s responsibility and thus was required to refer the matter to the SBA for a COC assessment.  As discussed below we find that none of these bases of protest have merit.

DISCUSSION

ISO Certification Requirement

KPaul protests that the requirement to provide the ISO certification at the time phase I proposals are submitted is unduly restrictive of competition.  KPaul states that its certification application is pending and will be available before performance under the contract begins.  KPaul asserts in this regard that the certification is related to quality management and maintenance of standards that will be applied during contract performance, not to the contractor’s ability to do the work requested by the solicitation.  Therefore, according to KPaul, the certification is not needed at the time phase I proposals are submitted, and instead should be required at the time performance begins.  KPaul contends that GAO has considered this issue in two decisions, USA Jet Airlines, Inc.; Active Aero Group, Inc., B-404666, Apr.1, 2011, 2011 CPD ¶ 91 at 4, and LBM Inc., B-286271, Dec. 1, 2000, 2000 CPD ¶ 194 at 3, and concluded that the requirement for the ISO certification to be supplied with proposals was unduly restrictive of competition.[6] 

The determination of a contracting agency’s needs and the best method for accommodating them are matters primarily within the agency’s discretion.  Systems Application & Techs., Inc., B-270672, Apr. 8, 1996, 96-1 CPD ¶ 182 at 3.  However, where a protester challenges a requirement as unduly restrictive of competition, we will review the record to determine whether the restrictions imposed are reasonably related to the agency’s needs.  Id.  The adequacy of the agency’s justification is ascertained through examining whether the agency’s explanation is reasonable, that is, whether the explanation can withstand logical scrutiny.  LBM, Inc., B-286271, supra at 3. 

We have reviewed the record and conclude that the requirement for offerors to submit an ISO certification with their phase I proposals is not unduly restrictive of competition.  First, in the USA Jet and LBM decisions, our Office did find that the requirement to have an ISO certification at the time that proposals were due was restrictive of competition.  Those decisions, however, were based on the specific facts presented in those protests, and were not meant to stand for the proposition that a procuring agency can never require ISO certifications when proposals are due. 

In USA Jet, the agency asserted that offerors must possess an ISO certification at the time of proposal submission because the certification could take several months to several years to complete and the agency would not allow performance to begin without the certification.  We noted that an agency’s otherwise legitimate requirements regarding an offeror’s demonstrated ability to meet contract requirements may not generally be applied at a point in time prior to when such qualifications become relevant.  We found that the only explanation offered by the agency--that the certification was required in time for performance--did not justify the restriction because the protester could potentially obtain the certification in time for performance.

In LBM, the solicitation was issued in anticipation of a cost comparison pursuant to Office of Management and Budget Circular A-76 between the private-sector proposal offering the best value to the government and the government’s most efficient organization.  We concluded that the ISO certification was justified, but that the agency’s conclusive determination that an offeror would not be capable of meeting the contract requirements, based solely on the fact that it had not obtained the necessary certification prior to submitting a proposal, would unreasonably exclude potential offerors.  This was particularly the case in the context of an A-76 cost comparison, where the time between submission of private-sector proposals and actual commencement of the contract activities might be substantial.

Here, unlike the situation in USA Jet, the agency’s sole justification for the restriction is not that the certification is needed for performance.  Rather, the agency has explained that FirstSource is the department’s key resource for procuring information technology hardware.  Over the life of the FirstSource program almost 15,000 orders have been issued and over $3.7 billion has been spent.  Supp. COS at 11.  With the volume of ordering across DHS and its components, as well as the diverse mission of DHS which includes matters of national security such as immigration, intelligence and  cybersecurity, DHS needs assurances that the IT equipment it buys is not compromised by vulnerabilities or malware from bad actors.  Id.  Further, this is unlike the situation in LBM because this solicitation does not concern an A-76 cost comparison, which, as we noted in LBM, can involve a substantial passage of time between submission of proposals and commencement of the contract.

The agency explains that the ISO 20243:2018 certification requirement is a means by which DHS seeks assurance against supply chain vulnerabilities.  In addition, the ISO 9001:2015 certification provides the government with an objective measure of the offeror’s quality management processes.  The agency therefore is using the certifications in phase I as part of its evaluation of the offeror’s ability to provide high quality services.  Id.  We find that this explanation reasonably supports the agency’s position and demonstrates that the restriction is reasonably related to the agency’s minimum needs.  See Contract Services, Inc., B-411153, May 22, 2015,

2015 CPD ¶ 161 (requirement for facility security clearance at time of proposal submission is reasonable).

We also note that the agency began the procurement process in June 2020 with a draft statement of work and evaluation factors, and subsequently released two additional draft solicitations in November 2020 and February 2021.  The agency also held two industry days in July and December 2020, and held a pre-proposal conference on April 26, 2021.  Supp. COS at 3-8.  Throughout these events the agency continuously indicated its intention to require ISO certifications with phase I proposals.  Id.  The agency was also fully engaged with potential offerors, and based on offeror input adjusted its strategy to make the procurement more competitive.  Among other things, the agency decided to require ISO certification 9001-2015 and/or ISO certification 20243:2018 based on comments from potential offerors that these certifications were more widely available.  Id. at 8.  The agency thus provided potential offerors with the opportunity to comment on the certification, and substantial time to apply for the certification.  Moreover, during phase I the agency received 637 proposals from 325 offerors; only 5 offerors failed to provide at least one of the certifications.  Id. at 3.  The agency’s actions in conducting the procurement, and the number of offers it received, further support our finding that the restriction did not unduly restrict competition. 

Advisory Notice

KPaul protests that in eliminating its proposal from the competition for not including a required certification, the agency failed to follow the procedure set out in the solicitation.  In this regard, KPaul notes that the solicitation provided that after phase I proposals were evaluated, the agency would provide offerors with a notice advising them that their proposals were selected to proceed to phase II, or that they were unlikely to be viable competitors but could elect to proceed to the next phase.  KPaul asserts that the solicitation did not advise offerors that their proposals would be eliminated from the competition, without further consideration, if they did not include the required certifications.  KPaul concludes that under the terms of the solicitation the agency was required to allow KPaul to proceed to phase II if KPaul chose to do so, rather than not evaluate its proposal. 

The agency counters that the process described in the solicitation occurs only after phase I proposals are evaluated.  The agency explains that KPaul’s phase I proposal was not evaluated because it failed to conform to the solicitation requirements.  Since, KPaul’s proposal was eliminated after the compliance review, the agency argues it was not required to provide KPaul with an opportunity to submit a phase II proposal.  Based on our review of the record, we agree with the agency. 

The solicitation informed offerors that “[t]he government will conduct a compliance review for both Phases I and II.  The compliance checklist is included as Attachment 6 to this solicitation.”  RFP at 107.  The phase I checklist provided, “[t]he contractor shall compare its Phase I proposal against each of the requirements as stated in the solicitation prior to submission and indicate yes or no to ensure compliance. . . .  [T]he government requires strict compliance with all solicitation requirements or the proposal may not be accepted.”  AR Tab 6c, RFP attach. 6, Compliance Checklist at 1.  The solicitation also notified offerors that proposals that were found to be noncompliant in accordance with the solicitation instructions would not be evaluated.  RFP at 107.

The solicitation specifically instructed offerors to include one of the two required certifications with their phase I proposals.  RFP at 111.  The compliance checklist required offerors to indicate whether one of the two required certifications had been submitted.  RFP attach. 6, Compliance Checklist at 1.  It therefore was clear from the solicitation, and the compliance checklist, that the agency would consider whether the certifications were submitted when it reviewed the compliance checklist.  As noted above, the solicitation also notified offerors that proposals that were found to be noncompliant in accordance with the solicitation instructions would not be evaluated.  Thus, KPaul was on notice that if it did not include the required certifications its proposal would not be evaluated. 

Moreover, the agency’s responses to questions that offerors submitted regarding the certification requirement confirmed that proposals would be eliminated if they did not include one of the certifications with their phase I proposal.  For example, one offeror asked if the agency would consider proposals where the offeror committed to achieve the certification within 180 days of award.  The agency responded, “[n]o, DHS will not consider proposals where the ISO certifications have not been secured prior to the proposal response date and included with the Phase I proposal in accordance with solicitation requirements.”  AR, Tab 5h Solicitation Questions & Answers, Question 1. 

Another offeror asked the agency to “[p]lease confirm that the Government will consider proposals from vendors that have neither certification.”  The agency responded, “[t]he two certifications listed are a proposal requirement.  Offerors that do not have either certification do not meet proposal requirements.”  Id., Question 59.  Given the clear language in the solicitation, KPaul’s argument that the agency was required to evaluate the protester’s phase I proposal and allow the protester to participate in phase II is denied.

Responsibility

KPaul also argues that the ISO certification concerns performance quality and is therefore a responsibility type criterion.  As a result, according to KPaul, since it is a small business the agency could not reject its proposal without referring the issue to the SBA pursuant to the COC program.[7]

Even if the ISO certification is a matter of responsibility, an issue we do not decide here, agencies may use responsibility criteria as technical evaluation factors.  Consulting and Program Management, B-225369, Feb. 27, 1987, 87-1 CPD ¶ 229 at 4.  Here, the ISO certification was considered under the ability to perform the technical evaluation criterion.  The solicitation required that offerors satisfy the ISO certification requirement at the time of proposal submission.  RFP at 13.  In addition, as discussed above, a proposal that did not include the certification did not meet the solicitation requirements and would not be considered.  Thus, under the terms of the solicitation, the requirement to submit one of the two ISO certifications at the time of proposal submission was a material term of the solicitation.  See Tridentis, LLC, B-418690.4, Jan. 5, 2021, 2021 CPD ¶ 186 at 6; ProTech Servs. USA, LLC, B-417484, July 19, 2019, 2019 CPD ¶ 260 at 4. 

Where a proposal, on its face, leads an agency to the conclusion that an offeror has not complied with a material term or condition of the solicitation, the matter is one of the proposal’s acceptability, and not a matter of the offeror’s responsibility.MT & Associates, LLC, B-410066, Oct. 17, 2014, 2014 CPD ¶ 326 at 6.  Since KPaul did not submit the ISO certification its offer was properly eliminated from the competition and the agency was not required to refer KPaul to the SBA.  Tridentis, LLC, B-418690.4, supra. 

The protest is denied

Edda Emmanuelli Perez
General Counsel