Pueo Business Solutions, LLC

DOCUMENT FOR PUBLIC RELEASE
The decision issued on the date below was subject to a GAO Protective Order. This version has been approved for public release.

Decision

Matter of: Pueo Business Solutions, LLC

File: B-422105

Date: January 3, 2024

DIGEST

1. Protest that awardee had unfair competitive advantage stemming from its having hired a former agency employee is denied where the agency investigated the issue and reasonably concluded that the awardee did not gain an unfair advantage.

2. Protest challenging the evaluation of the protester’s technical quotation is denied where the evaluation was reasonable and consistent with the terms of the solicitation.

Pueo Business Solutions, LLC (Pueo), a service-disabled veteran-owned small business (SDVOSB) of Fredericksburg, Virginia, protests the issuance of a task order to Maveris, LLC, an SDVOSB of Arlington, Virginia, under request for quotations (RFQ) No. 36C10B23Q0450, issued by the Department of Veterans Affairs (VA), for cybersecurity services. The protester alleges the VA failed to adequately consider and mitigate a conflict of interest, and also challenges the agency’s evaluation of its quotation.

We deny the protest.

BACKGROUND

The agency issued the solicitation on August 16, 2023, pursuant to the procedures of Federal Acquisition Regulation (FAR) subpart 8.4, to SDVOSB firms holding the General Services Administration’s multiple-award federal supply schedule (FSS) contract for highly adaptive cybersecurity services (category 54151). Agency Report (AR), Tab 5B, Amendment 002 to RFQ at 1, 227.[1] The solicitation contemplated the issuance of a single task order, with fixed-price contract line items, with a nine-month base period of performance and four 1‑year option periods. Id. at 66. Through the RFQ, the VA sought information and cybersecurity support services for the agency’s cybersecurity operations center (CSOC) to assist in developing and providing enterprise-wide information and cybersecurity and network defense services. Id. The performance work statement (PWS) identified specific functional areas (and corresponding tasks in those areas) the contractor would perform, to include: program management; vulnerability scanning; security and external communications management; cybersecurity threat intelligence; cybersecurity incident response; cybersecurity analytics; cyber threat intelligence threat analysis; cybersecurity technical services; and operations center requirements and development. Id. at 60-192

The solicitation advised that award would be made on a best-value tradeoff basis, considering three factors, listed in descending order of importance: (1) technical; (2) past performance; and (3) price. Id. at 233. As relevant here, under the technical factor, vendors were to provide a detailed approach to address eight questions and hypothetical scenarios, which the agency described as technical discriminators. Id. at 229-230. The VA would consider (a) the extent to which a vendor’s quotation demonstrated a clear understanding of solving the problems identified in the technical discriminators and meeting or exceeding the requirements in the PWS, and (b) the feasibility of the offered approach. Id. at 233. The solicitation advised that the non-price factors, combined, “are significantly more important than the Price[.]” Id. The RFQ further provided that “[t]o receive consideration for award, a rating of no less than ‘Acceptable’ must be achieved for the Technical Factor.”[2] Id.

The agency received multiple quotations by the August 28 deadline for receipt of quotations, to include quotations from Pueo and Maveris. The following is a summary of the final ratings of those vendors’ quotations:

AR, Tab 9, Source Selection Decision (SSD) at 2.

The protester was notified on September 28 that it was not selected for award. Contracting Officer’s Statement at 3. This protest followed.

DISCUSSION

The protester argues the agency’s failure to consider and properly mitigate an alleged conflict of interest tainted the VA’s award decision. Protest at 25-26; Comments at 8-9; Supp. Comments at 3-4. In addition, Pueo challenges the agency’s evaluation of its quotation under the technical factor. Protest at 11-24; Comments at 3-8; Supp. Comments at 2-3. In this regard, the protester argues the agency’s assignment of one deficiency, three significant weaknesses, and one weakness was unreasonable. For the reasons that follow, we find no basis to sustain the protest.[3]

Unfair Competitive Advantage

Pueo contends the VA failed to consider and adequately address the awardee’s unfair competitive advantage that resulted from the awardee’s hiring of a former VA official. Protest at 25-26; Comments at 8-9; Supp. Comments at 3-4. On September 8, after the quotation due date, but before award was made, Pueo notified the VA of a potential organizational conflict of interest (OCI) based on unequal access to information.[4] AR, Tab 8A, Pueo OCI Memo at 1. Pueo explained that Maveris recently hired a former VA employee who previously served as the director of the VA’s network security operations center. Id. Pueo further explained that this employee would have been involved in “all procurement activities while he was in the position as well as future planning” and he “would have detailed non-public knowledge of budgetary restrictions as well as any contemplated technical requirements.” Id. at 2.

In response to Pueo’s allegation, the contracting officer investigated the matter. See AR, Tab 8, OCI Investigation Memo. The contracting officer found that the former government employee, whom we refer to as Mr. X, served as the director of the VA’s network security operations center and was responsible for building VA’s CSOC. Mr. X left the VA and joined Maveris in November 2021. Id. at 2. The contracting officer’s investigation noted that the current PWS, to include budget planning for such, was developed only within the last year, and that Mr. X was not involved in any requirements development or future planning for this PWS. Mr. X’s replacement at the VA confirms that the two had no communication regarding the instant requirement. Id. at 2. Based on her investigation, the contracting officer “determined that there is no actual or potential unequal access to information OCI pertaining to Maveris’ hiring of Mr. [X] and their potential bid” for this requirement. Id. at 3.

Pueo contends the agency’s investigation was insufficient. Comments at 9-10; Supp. Comments at 3-4. In this regard, the protester argues the VA only engaged in “perfunctory discussions” with relevant agency officials, and failed to consider whether Mr. X had access to nonpublic information. Comments at 9. In response, the agency argues its investigation was reasonable and sufficiently considered the protester’s concerns. Supp. Memorandum of Law (MOL) at 4.

As a general matter, contracting agencies are to avoid even the appearance of impropriety in government procurements. FAR 3.101-1; Interactive Info. Sols., Inc., B‑415126.2 et al., Mar. 22, 2018, 2018 CPD ¶ 115 at 5. Where a firm may have gained an unfair competitive advantage through its hiring of a former government official, the firm can be disqualified from a competition based upon the appearance of impropriety that is created by this situation, even if no actual impropriety can be shown, so long as the determination of an unfair competitive advantage is based on facts and not on mere innuendo or suspicion. Geo Owl, LLC, B‑420599, June 13, 2022, 2022 CPD ¶ 143 at 4. Thus, a person’s familiarity with the type of work required resulting from the person’s prior position in the government is not, by itself, evidence of an unfair competitive advantage. Rather, there must be hard facts establishing the person’s access to nonpublic information, which could provide a firm with an unfair competitive advantage. Interactive Info. Sols., Inc., supra.

To resolve an allegation of unfair competitive advantage under these circumstances, we typically consider all relevant information, including whether the former government employee had access to competitively useful inside information, as well as whether the former government employee’s activities with the firm were likely to have resulted in a disclosure of such information. Dewberry Crawford Group; Partner 4 Recovery, B‑415940.11 et al., July 2, 2018, 2018 CPD ¶ 298 at 25. Whether the appearance of impropriety based on an alleged unfair competitive advantage exists depends on the circumstances in each case, and, the responsibility for determining whether to continue to allow an offeror to compete in the face of such alleged impropriety is a matter for the contracting agency. Interactive Info. Sols., Inc., supra at 5. We review the reasonableness of a contracting officer’s investigation and, where an agency has given meaningful consideration to whether a significant conflict of interest exists, we will not substitute our judgment for the agency’s, absent clear evidence that the agency’s conclusion is unreasonable. Geo Owl, LLC, supra; Northrop Grumman Systems Corp.--Mission Systems, B-419557.2 et al., Aug. 18, 2021, 2021 CPD ¶ 329 at 9.

Here, we find no basis to object to the agency’s conduct of its investigation or its ultimate conclusions regarding the lack of a disqualifying conflict of interest. The contracting officer makes three salient conclusions, none of which the protester disputes. First, Mr. X left his position 22 months prior to the agency’s issuance of the instant solicitation and the VA’s receipt of quotations pursuant to the solicitation. AR, Tab 8, OCI Investigation Memo at 1. Second, the agency confirmed Mr. X “was not involved in any requirements development or future planning of the current PWS nor was Mr. [X] involved in developing the requirements for the previous CSOC Task Order.” Id. at 2. Third, Mr. X’s replacement had no discussions with Mr. X related to this requirement. Id.

The protester fails to advance any specific argument rebutting these facts, but instead, asserts that just because Mr. X “did not actually put pen to paper when it came to the development of the PWS does not mean that Mr. [X] did not have special knowledge about the Agency’s needs and requirements in the subject matter of this procurement[.]” Supp. Comments at 4. But, as explained above, a person’s familiarity with the type of work required resulting from their prior position in the government is not, by itself, evidence of an unfair competitive advantage. Interactive Info. Sols., Inc., supra at 5. Where, as here, the contracting officer investigates a potential unfair competitive advantage and reasonably concludes that no such advantage exists, we will generally defer to the agency’s judgment. See VSE Corp., B-404833.4, Nov. 21, 2011, 2011 CPD ¶ 268 at 8. Based on the record, we find that the contracting officer’s investigation gave meaningful consideration to the protester’s allegations and reasonably concluded that there was no unfair competitive advantage. We therefore find no basis to sustain this protest allegation.

Technical Evaluation

Pueo also argues the agency’s assignment of a rating of unacceptable under the technical factor--based on the assignment of a deficiency, three significant weaknesses, and one weakness--was unreasonable. Protest at 11-24; Comments at 3-8; Supp. Comments at 2-3. The protester contends the agency unreasonably failed to consider relevant portions of its quotation, and ignored the stated evaluation criteria expressed in the RFQ. The VA responds that its evaluation was reasonable and consistent with the terms of the solicitation. See MOL at 2-16.

Where, as here, an agency issues an RFQ to FSS vendors under FAR subpart 8.4 and conducts a competition for the issuance of an order or establishment of a blanket purchase agreement, we will review the record to ensure that the agency’s evaluation was reasonable and consistent with the terms of the solicitation and applicable procurement laws and regulations. Digital Solutions, Inc., B-402067, Jan. 12, 2010, 2010 CPD ¶ 26 at 3-4; DEI Consulting, B‑401258, July 13, 2009, 2009 CPD ¶ 151 at 2. In reviewing a protest challenging an agency’s technical evaluation, our Office will not reevaluate the quotations; rather, we will examine the record to determine whether the agency’s evaluation conclusions were reasonable and consistent with the terms of the solicitation and applicable procurement laws and regulations. OPTIMUS Corp., B‑400777, Jan. 26, 2009, 2009 CPD ¶ 33 at 4. A protester’s disagreement with the agency’s judgment, without more, does not establish that an evaluation was unreasonable. DEI Consulting, supra.

Under the technical factor, vendors’ quotations were required to provide “a detailed approach” that addressed eight identified questions and scenarios (or technical discriminators). AR, Tab 5B, RFQ at 229. These technical discriminators, in turn, referenced specific PWS tasks that were necessarily implicated in a vendor’s response. Id. As one example, vendors were required to propose a plan to address a hypothetical situation where the “the Director of the Business Unit that oversees an important Veteran-facing system, My HealtheVet, has requested the CSOC look at the system to discover weaknesses that may exist to help secure the system and better help protect Veterans.” Id. The RFQ provided that this hypothetical situation concerned, at a minimum, the following PWS tasks: 5.2 (Vulnerability Scanning Services Support); 5.17 (External Assessment Services); and 5.18 (Perimeter Security Support). Id.

As noted above, the VA’s technical evaluation would consider a vendor’s understanding of these problems, and the feasibility of the presented approach. Id. at 233. Concerning a vendor’s understanding of the problem, the solicitation explained that the VA would determine the extent to which a quotation “demonstrates a clear understanding of all features involved in solving the problems and meeting and/or exceeding the requirements presented in the solicitation and the extent to which uncertainties are identified and resolutions proposed.” Id. Regarding feasibility of approach, quotations would be evaluated to determine “the extent to which the proposed approach is workable and the end results achievable” and “the level of confidence provided the Government with respect to the Offeror’s methods and approach in successfully meeting and/or exceeding the requirements in a timely manner.” Id.

The agency assigned Pueo’s quotation a rating of unacceptable under the technical factor, finding no strengths, one weakness, three significant weaknesses, and one deficiency.[5] AR, Tab 7, Pueo’s Technical Consensus Report at 1-5. Overall, the evaluator found that Pueo demonstrated a lack of understanding of the solicitation’s requirements, the firm’s approach cannot be expected to meet those requirements, and is considered very high risk. Id. at 5. Because Pueo’s technical quotation received a rating of unacceptable, consistent with the terms of the solicitation, the firm’s quotation was not considered for award in the VA’s best-value determination. AR, Tab 9, SSD at 2.

Pueo objects to each negative finding attributed to its quotation by the VA. However, as the following representative examples illustrate, we find no basis to object to the agency’s evaluation of Pueo’s technical quotation.[6]

The VA’s technical evaluation team assigned a deficiency with respect to the firm’s approach to the My HealtheVet technical discriminator, identified above.[7] AR, Tab 7, Pueo’s Technical Consensus Report at 4. The evaluators noted a myriad of problems with Pueo’s approach, finding at least eight specific issues with the protester’s technical solution. Id. For example, the agency explained:

[T]he Offeror merged all tasks under PWS 5.17 to the “Penetration Testing Support” dialogue provided, such as Red Team activities, as well as Mobile Application Security Assessment (MASA), which should all have been addressed as separate actions and functions; MASA is not a penetration test based on the requirements of the PWS, and Red Team is a separate function or type of penetration testing. [Pueo’s] approach stated that a MASA would be conducted; however, no details or further insight into how or why the MASA would be performed or what the value added would be to the process was provided.

Id.

The protester disagrees with the agency’s findings in this regard, arguing “the Agency focused on minutia amounting to little more than criticism of the aesthetics of the proposal.” Comments at 4. In support, Pueo notes that it did not merge 5.17 tasks, as the agency suggests, but instead, its quotation focused on specific subtasks. Protest at 13; see AR, Tab 6, Pueo’s Technical Proposal at I-14-15. Moreover, the protester concedes that while its technical solution did not include red team activities, it instead reasonably focused on penetration testing to address the presented scenario. Protest at 13. Additionally, the protester notes that its quotation “clearly stated the reason and value for conducting MASA” activities, and the agency’s requirement that a vendor explain how MASA activities would be performed was not expressly required under the terms of the RFQ. Id. at 13‑14. In sum, the protester argues “[t]he Agency is speaking to a preferred composition; not whether Pueo provided a proposal reflecting its understanding of the scenario and the best way to address it.” Comments at 4.

We have no basis to question the reasonableness of the agency’s evaluation conclusions. In response to the protest, the VA submitted a declaration by the source selection evaluation board (SSEB) chair, who was also a technical evaluator.[8] AR, Tab 11, SSEB Chair Declaration. With respect to Pueo’s merging tasks under PWS 5.17, she explains the protester’s identification of tasks by PWS subsection does not adequately “constitute addressing the activities as separate actions and functions.” Id. at 4. Thus, Pueo demonstrated a “a lack of understanding by not addressing the activities [of PWS 5.17] as separate functions, each of which would be necessary and distinct components of discovering weaknesses in the system as contemplated [by the technical discriminator].” Id. The SSEB chair further explains that Pueo’s failure to include red team activities as part of its assessment plan represented a “fatally flawed approach because Red Team activities are a key component of discovering weaknesses in systems that cannot be discovered by other means.” Id. Concerning Pueo’s MASA approach, the SSEB chair explains that Pueo failed to provide “sufficient detail to show how or why the MASA would be performed[,]” which in turn demonstrated Pueo’s lack of understanding of the requirement. Id. at 5.

We find reasonable the agency’s evaluation conclusions. The underlying record, as supported by the SSEB chair’s declaration, demonstrates that the agency undertook a thorough review of Pueo’s quotation, but with respect to the My HealtheVet technical discriminator, Pueo’s quotation failed to meaningfully address several important factors. For example, while the protester may believe that failing to address red team activities reflects the VA’s concern about the structure, not the content, of Pueo’s quotation, the underlying record does not support such a conclusion. Indeed, red team support is specifically identified as a subtask under PWS 5.17 (external assessment services). AR, Tab 5B, RFQ at 183. We have no basis to question the VA’s conclusion that the protester’s failure to address this activity as part of its technical solution represented a “fatally flawed approach[.]” AR, Tab 11, SSEB Chair Declaration at 4.

Similarly, while the protester asserts it sufficiently addressed its MASA approach, the VA disagreed. Indeed, Pueo’s explanation of its MASA approach amounts to two sentences in its quotation and provides little detail about how it would actually use MASA as part of its technical solution. See AR, Tab 6, Pueo’s Technical Proposal at I-14-15. Contrary to the protester’s argument, such a finding was not outside the bounds of the solicitation; as the agency explains, the RFQ instructions specifically warned offerors that quotations “which merely restate the requirement or state the requirements will be met, without providing supporting rationale, are not sufficient.” AR, Tab 5B at 233; MOL at 4. Here, Pueo’s disagreement with the VA’s evaluation judgments, without more, do not demonstrate that those judgments are unreasonable.[9] See Science Applications Int’l Corp., B-413112, B-413112.2, Aug. 17, 2016, 2016 CPD ¶ 240 at 6. Accordingly, we find the agency’s assignment of a deficiency under the technical factor to be reasonable.[10]

The protest is denied.

Edda Emmanuelli Perez
General Counsel