Cybergenic Systems, LLC (RFP200509)

B-421213 Jan 19, 2023 Jump To VIEW DECISION DOWNLOADS RELATED PAGES GAO CONTACTS Highlights Cybergenic Systems, LLC, a service-disabled veteran-owned small business (SDVOSB) of Sykesville, Maryland, protests the award of a contract to Premier Enterprise Solutions, LLC, a SDVOSB of Upper Marlboro, Maryland, under request for proposals (RFP) No. 220509, issued by the Department of Health and Human Services, Centers for Medicare and Medicaid Services (CMS) for enterprise cybersecurity awareness and training program support. Cybergenic challenges the agency's determination that its proposal was unacceptable. We deny the protest. View Decision DOCUMENT FOR PUBLIC RELEASE The decision issued on the date below was subject to a GAO Protective Order. This redacted version has been approved for public release. Decision Matter of: Cybergenic Systems, LLC File: B-421213 Date: January 19, 2023 Joseph P. Underwood, Esq., for the protester. Shane J. McCall, Esq., Nicole D. Pottroff, Esq., John L. Holtz, Esq., Stephanie L. Ellis, Esq., and Gregory P. Weber, Esq., Koprince McCall Pottroff LLC, for Premier Enterprise Solutions, LLC, the intervenor. Linda Santiago, Esq., and Douglas Kornreich, Esq., Department of Health and Human Services, for the agency. Samantha S. Lee, Esq., and Peter H. Tran, Esq., Office of the General Counsel, GAO, participated in the preparation of the decision. DIGEST Protest challenging the agency’s evaluation of the protester’s proposal as technically unacceptable is denied where the agency reasonably concluded that the protester’s proposal took various exceptions to material terms and conditions of the solicitation. DECISION Cybergenic Systems, LLC, a service-disabled veteran-owned small business (SDVOSB) of Sykesville, Maryland, protests the award of a contract to Premier Enterprise Solutions, LLC, a SDVOSB of Upper Marlboro, Maryland, under request for proposals (RFP) No. 220509, issued by the Department of Health and Human Services, Centers for Medicare and Medicaid Services (CMS) for enterprise cybersecurity awareness and training program support. Cybergenic challenges the agency’s determination that its proposal was unacceptable. We deny the protest. BACKGROUND On June 10, 2022, CMS issued the solicitation as a set-aside for SDVOSBs, seeking enterprise-wide cybersecurity and privacy awareness and training program support for CMS’s Information Security and Privacy Group, which is charged with protecting CMS data. Agency Report (AR), Tab 3C, RFP at 1; AR, Tab 3D, Statement of Work (SOW) at 5-8.[1] To meet these requirements, the agency identified two task areas to be performed in the SOW: (1) program management; and (2) training and awareness development support. AR, Tab 3D, SOW at 9-10. Task area two, training and awareness support, was further divided into three subtask areas (training modernization, learning management system support, and CyberVets training) and four optional task areas.[2] Id. According to the protester, the firm (through a wholly-owned subsidiary) has performed as a subcontractor on the incumbent contract for CyberVets training. AR, Tab 5B, Technical Proposal at 10. The solicitation anticipated the award of a fixed-price contract with a base year and four 1-year option periods. RFP at 1, 6. The RFP provided for award on a best-value tradeoff basis, considering the following evaluation factors: corporate experience; management approach; past performance; section 508 compliance/voluntary product accessibility template (VPAT)[3]; and price. Id. at 60-61. Relevant here, the solicitation directed offerors to submit any proposal assumptions, conditions, or exceptions. Id. at 58. In this regard, the RFP explained: This information must include, but is not limited to, the terms and conditions associated with meeting the project time-frame, assumptions about the roles, responsibilities, information, facilities, or other items the offeror expects the Government will provide in support of the project, etc. Id. The RFP also warned that “[t]he Government reserves the right to reject any proposal that includes any pricing assumption that adversely impacts the Government’s requirements or fails to comply with any of the requirements outlined herein.” Id. The agency received proposals from seven offerors, including Cybergenic and Premier, by the July 15, deadline for submission of proposals. COS at 3, 9. Cybergenic identified assumptions in its proposal. AR, Tab 5B, Technical Proposal at 32, 117-26; AR, Tab 5C, Price Proposal at 8. Within the technical proposal, after stating that Cybergenic would “provide the proposed services as required in the RFP,” Cybergenic referred the agency “to Appendix 2, Reference Assumptions for specific conditions.” AR, Tab 5B, Technical Proposal at 32. Appendix 2 listed more than 30 assumptions regarding the services to be provided and “the scope, timeline, and resource plan for this engagement.” Id.