Deloitte Consulting, LLP (ID11200006)

B-419508,B-419508.2 Apr 15, 2021 Jump To FULL REPORT VIEW DECISION RELATED PAGES GAO CONTACTS Highlights Deloitte Consulting LLP, of Arlington, Virginia, protests the General Services Administration's (GSA) issuance of a federal supply schedule (FSS) task order to Kearney & Company, pursuant to request for quotations (RFQ) No. ID11200006, to provide cybersecurity and privacy support services for the Department of Housing and Urban Development (HUD). Deloitte protests that Kearney's quotation reflects services that are beyond the scope of the FSS labor categories on which Kearney's quotation is based. We sustain the protest. View Decision DOCUMENT FOR PUBLIC RELEASE The decision issued on the date below was subject to a GAO Protective Order. This redacted version has been approved for public release.   Decision     Matter of:  Deloitte Consulting, LLP File:  B-419508; B-419508.2 Date:  April 15, 2021 David S. Cohen, Esq., John J. O’Brien, Esq., and Daniel Strouse, Esq., Cordatis LLP, for the protester. Jason A. Carey, Esq., J. Hunter Bennett, Esq., Andrew R. Guy, Esq., and Anna Menzel, Esq., Covington & Burling, LLP, for Kearney & Company, P.C., the intervenor. Stephene G. Parry, Esq., General Services Administration, for the agency. Glenn G. Wolcott, Esq., and Christina Sklarew, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision. DIGEST Protest challenging award of a federal supply schedule (FSS) task order is sustained where the awardee’s quotation represented that the awardee would provide services exceeding the scope of the underlying FSS contract. DECISION   Deloitte Consulting LLP, of Arlington, Virginia, protests the General Services Administration’s (GSA) issuance of a federal supply schedule (FSS) task order to Kearney & Company, pursuant to request for quotations (RFQ) No. ID11200006, to provide cybersecurity and privacy support services for the Department of Housing and Urban Development (HUD).  Deloitte protests that Kearney’s quotation reflects services that are beyond the scope of the FSS labor categories on which Kearney’s quotation is based.  We sustain the protest. BACKGROUND In August 2020, the GSA issued the final version of the RFQ,[1] pursuant to Federal Acquisition Regulation (FAR) subpart 8.4 procedures, seeking quotations to provide cybersecurity support services for HUD’s Chief Information Officer, Chief Privacy Officer, and Chief Information Security Officer.  Agency Report (AR), exh. 1, RFQ at 11.  More specifically, the solicitation stated that the agency was “seeking continued support in modernizing cybersecurity and privacy processes, capabilities, and services,” id., further noting that HUD:  “possesses over 200 information systems”; requires an “enterprise wide approach”; and seeks to be “more proactive in seeking vulnerabilities/ deficiencies in its information systems/assets, increasing employee/contractor cybersecurity knowledge, adjusting cybersecurity training, and enhancing reporting to internal and external stakeholders.”  Id. at 12.  Finally, the solicitation identified five specific services that will be required:  (1) cybersecurity support project management; (2) security architecture and innovation; (3) governance, risk, and compliance; (4) strategic initiatives; and (5) privacy program support.  Id. The solicitation sought quotations from vendors holding Group 70 FSS contracts with special item number (SIN) 132-45 (titled “Highly Adaptive Cybersecurity Services”) and/or SIN 132-51 (titled “Information Technology Professional Services”), see Supp.