In the United States Court of Federal Claims BID PROTEST No. 19-575C (Filed Under Seal: October 1, 2019 | Reissued: October 2, 2019)
) RX JOINT VENTURE, LLC, ) Keywords: Bid Protest; Air Force; IDIQ; ) Technical Evaluation; IT Services Plaintiff, ) ) v. ) ) THE UNITED STATES OF AMERICA, ) ) Defendant, ) )
David F. Barton, Gardner Law, San Antonio, TX, for Plaintiff.
Michael D. Austin, Trial Attorney, Commercial Litigation Branch, Civil Division, U.S. Department of Justice, Washington, DC, for Defendant, with whom were Deborah A. Bynum, Assistant Director, Robert E. Kirschman, Jr., Director, and Joseph H. Hunt, Assistant Attorney General. Cpt. Jacquelyn Fiorello, United States Air Force, Of Counsel.
OPINION AND ORDER
KAPLAN, Judge.
In this pre-award bid protest, Plaintiff RX Joint Venture (“RXJV” or “the joint venture”) challenges the Air Force’s decision to eliminate it from the Small Business Enterprise Application Solutions (“SBEAS”) competitive procurement because it found the joint venture’s proposal technically unacceptable. Currently before the Court are the parties’ cross-motions for judgment on the administrative record. For the reasons discussed below, RXJV’s motion is DENIED and the government’s cross-motion is GRANTED.
This opinion was previously issued under seal on October 1, 2019. The parties were given the opportunity to propose redactions on or before October 15, 2019. Because the parties have notified the Court that they do not have any proposed redactions (ECF No. 33), the Court reissues its decision without redactions. BACKGROUND
I. Overview of the Solicitation
The Air Force issued Solicitation No. FA8771-17-R-10000 (“the Solicitation” or “the RFP”) on September 28, 2017. Admin. R. (“AR”) Tab 25 at 488, 617 (conformed solicitation dated October 19, 2017); see also Def.’s Opp’n to Pl.’s Cross-Mot. for J. Upon the Admin. R. & Def.’s Cross-Mot. for J. Upon the Admin. R. (“Def.’s MJAR”) at 4, ECF No. 19. The Solicitation anticipated the award of up to forty IDIQ contracts “to provide a vehicle for [agency] customers to access a wide range of Information Technology (IT) Network Centric services and solutions that support the IT lifecycle.” AR Tab 25 at 617. The scope of IT services included documentation, operations, deployment, cybersecurity, configuration management, training, and other related services. Id. The final amended version of the RFP provided offerors with detailed instructions, the criteria used to evaluate proposals, and over seventy definitions of IT-related terms. See generally id. at 629–714.
The ceiling amount on the contract is almost $13.4 billion, including a five-year base ordering period and an option period extending another five years. Id. at 625–26. The Solicitation instructed offerors to submit proposals in four volumes: Capability Maturity Model Integration (“CMMI”) documentation, technical experience, past performance, and contract documentation. Id. at 632. Offerors were informed of the government’s intention to evaluate all proposals and award a contract on a best value basis without discussions. Id. at 650.
In the Solicitation, the Air Force instructed that “proposal[s] shall be clear, specific, and shall include sufficient detail for effective evaluation and substantiating the validity of stated claims.” Id. at 629 (instructions to offerors). “Legibility, clarity, and coherence” were characterized as “very important.” Id. Further, offerors were admonished that “[t]he proposal should not simply rephrase or restate the Government’s requirements but rather shall provide convincing rationale to address how the Offeror’s proposal meets these requirements.” Id. In addition, the Solicitation stated that an offeror “shall assume that the Government has no prior knowledge of the Offeror’s facilities and experience, and therefore will base its evaluation on the information presented in the Offeror’s proposal.” Id.
II. The Evaluation Process
The Solicitation established a staged evaluation process. Id. at 650. The first stage, the CMMI verification, served as a “gate that must be successfully accomplished prior to a proposal moving on to receive a Technical Evaluation.” Id. (emphasis removed). Proposals that met the CMMI verification requirement would then be considered under the Solicitation’s two-factor evaluation criteria. Id. Under Factor 1, the government would evaluate an offeror’s technical proposal and eliminate any offeror whose proposal earned an “unacceptable” rating. Id. at 651. Next, the Air Force would evaluate the past performance of all remaining offerors to determine which presented the best value to the government. Id. at 649.
To qualify as “acceptable” under the Technical Experience Acceptability Factor, an offeror was required to receive a minimum technical acceptability score of at least 4200 points. Id. at 652. Offerors were required to fill out self-scoring worksheets in which they could claim
2 technical experience in ten elements or categories: life-cycle software services; cybersecurity; IT business analysis; programming languages/frameworks; tools/software development methodologies; platforms/environments; database components; mobile/internet of things (“IoT”); server operating systems; and COTS/GOTS/FOSS software. Id. at 652–58.1
Each experience element was allotted a specified number of points on the self-scoring worksheet. Some of the elements were broken down further into sub-elements. Id. at 652. Though partial points were not awarded for any of the technical elements, offerors could receive a sub-set of the maximum allowable points if they met the requirements of a sub-element.2
Offerors were required to submit technical narratives (“TNs”) to demonstrate to the agency that they possessed the technical experience they claimed on the self-scoring worksheets. Id. They were permitted to submit a maximum of six TNs, each of which could reference only one contract. Id. The TN submissions, collectively, were not to exceed twenty pages. Id.
On the self-scoring worksheet, offerors were required to provide a reference to the TN or TNs that would verify each element or sub-element of experience claimed. See id. at 671 (explaining that an offeror “shall enter the technical narrative #, page #, paragraph # that supports each technical element claimed”). If the requisite experience could not be verified by reference to a TN, the government deducted the points the offeror claimed for that element.
III. The Air Force Finds RXJV’s Proposal Technically Unacceptable
RXJV submitted a timely proposal on November 1, 2017. See generally AR Tab 26 at 715–760 (RXJV Volume I proposal). On June 28, 2018, the agency determined that RXJV met the threshold requirement to move to the technical evaluation stage. AR Tab 27 at 761 (RXJV technical evaluation).
On the self-scoring worksheet, RXJV had claimed experience that resulted in a total point score of 5650. AR Tab 26 at 728–30. The Air Force, however, could not validate that RXJV possessed the experience it claimed as to ten technical sub-elements. See AR Tab 28 at 790 (letter from the contracting officer to RXJV explaining how the agency evaluated RXJV’s proposal). These were: 1a (life-cycle software services – developing/implementation) (500 points); 2a (cybersecurity – vulnerabilities and threats) (300 points); 2b (cybersecurity – risk management) (500 points); 3d (IT business analysis – functional business area expert) (200 points); 5a (tools/development methodology – security) (150 points); 5c (tools/development methodology – testing) (150 points); 6a (platforms/environments – mainframe, mid-tier/client- server, or web-services) (100 points); 6d (platforms/environments – Defense Information Systems Agency Enterprise Computing Center or Department of Defense Computing Facility)
1 One non-technical element––the government facility clearance level––was also to be scored on the sheet. Id. at 658. 2 For example, Element 1 (life cycle software services) was worth a maximum of 1400 points, but offerors could accumulate 500 points for Sub-Element 1a; 200 points each for Sub-Elements 1b, 1c, and 1e; and 300 points for Sub-Element 1d. AR Tab 25 at 672.
3 (200 points); 8a (mobile/IoT – new mobile application development) (100 points); and 9 (server operating systems) (300 points). AR Tab 27 at 761–90.
Based on its review, the Air Force deducted 2500 points from RXJV’s self-scoring worksheet, resulting in a score of 3150. See id. at 790. Because this total score was below the 4200-point minimum, the agency found RXJV’s proposal technically unacceptable. Id.
IV. The Debrief
On March 22, 2019, the Air Force notified RXJV that it was being removed from the competition because it did not demonstrate that it possessed sufficient technical experience to meet the requirements of the Solicitation. AR Tab 28 at 791 (notice of removal). On March 24, 2019, RXJV requested a debrief. See Pl.’s Mot. for J. Upon Admin. R. (“Pl.’s MJAR”) at 9, ECF No. 17; AR Tab 30 at 842, ECF No. 18-1 (email exchange between contracting officer and Eduardo Guerrero, the joint venture’s program manager). The contracting officer notified RXJV that “[a]ll offerors w[ould] receive a written debrief” but that “[t]here w[ould] be no in person or oral debriefs scheduled.” AR Tab 30 at 842.
The Air Force sent RXJV a detailed written debrief on March 26, 2019. AR Tab 29 at 793; AR Tab 30 at 841. RXJV reviewed the debriefing materials and submitted a list of follow- up questions to the contracting officer two days later. AR Tab 30 at 840–41, 845–50. On April 1, 2019, the contracting officer informed RXJV that “the Government will not [be] addressing the questions submitted” and that the “debrief was concluded on 26 March 2019.” Id. at 840.
V. The Present Action
RXJV filed the present protest on April 17, 2019. See generally Compl., ECF No. 1. In its pleadings, RXJV challenges as arbitrary and capricious the Air Force’s decisions that its TNs did not demonstrate the technical experience it claimed under Sub-Elements 1a, 2a, 2b, 5c, 6a, 6d, 8a, and 9. Id. ¶¶ 25–40; Pl.’s MJAR at 8; Def.’s MJAR at 7 n.3.
On May 17, 2019, RXJV filed a motion to supplement the administrative record with the affidavit of its President, Dale Patenaude. ECF No. 13. The government filed its opposition on May 23, 2019. ECF No. 14. In addition, on June 21, 2019, the government filed an unopposed motion to correct or amend the administrative record to include an email chain and accompanying attachments between RXJV’s program manager and the contracting officer. See ECF No. 18; see generally AR Tab 30.
On September 17, 2019, this Court denied RXJV’s motion to supplement the administrative record. ECF No. 30. It granted the government’s motion to correct the record. Id.
In the meantime, RXJV filed a motion for judgment on the administrative record on May 31, 2019. ECF No. 17. The government filed its cross-motion on June 21, 2019. Oral argument was held on the cross motions on September 19, 2019.
4 DISCUSSION
I. Subject-Matter Jurisdiction
The Court of Federal Claims has jurisdiction over bid protests in accordance with the Tucker Act, 28 U.S.C. § 1491, as amended by the Administrative Dispute Resolution Act of 1996 § 12, 28 U.S.C. § 1491(b). Specifically, the Court has the authority “to render judgment on an action by an interested party objecting to a solicitation by a Federal agency for bids or proposals for a proposed contract or to a proposed award or the award of a contract or any alleged violation of statute or regulation in connection with a procurement or a proposed procurement.” 28 U.S.C. § 1491(b)(1); see also Sys. Application & Techs., Inc. v. United States, 691 F.3d 1374, 1380–81 (Fed. Cir. 2012) (observing that § 1491(b)(1) “grants jurisdiction over objections to a solicitation, objections to a proposed award, objections to an award, and objections related to a statutory or regulatory violation so long as these objections are in connection with a procurement or proposed procurement”).
To possess standing to bring a bid protest, a plaintiff must be an “interested party”—i.e., an actual or prospective bidder (or offeror) who possesses a direct economic interest in the procurement. Sys. Application & Techs., Inc., 691 F.3d at 1382 (citing Weeks Marine, Inc. v. United States, 575 F.3d 1352, 1359 (Fed. Cir. 2009)); see also Orion Tech., Inc. v. United States, 704 F.3d 1344, 1348 (Fed. Cir. 2013). An offeror has a direct economic interest in a pre-award, post-evaluation protest if the protester demonstrates that, absent the alleged errors, it would have a “substantial chance” of receiving the award; that is, if the protester “could have likely competed for the contract” but for the alleged errors. Orion, 704 F.3d at 1348–49; see also Myers Investigative & Sec. Servs., Inc. v. United States, 275 F.3d 1366, 1370 (Fed. Cir. 2002) (holding that “prejudice (or injury) is a necessary element of standing”). The Court assumes well-pled allegations of error to be true for purposes of the standing inquiry. Square One Armoring Serv., Inc. v. United States, 123 Fed. Cl. 309, 323 (2015) (citing Digitalis Educ. Sols., Inc. v. United States, 97 Fed. Cl. 89, 94 (2011), aff’d, 664 F.3d 1380 (Fed. Cir. 2012)).
RXJV, an actual offeror, challenges the agency’s decision to eliminate it from the competition because it found RXJV’s proposal technically unacceptable. Its suit thus challenges a procurement decision and falls within the Court’s “broad grant of jurisdiction over objections to the procurement process.” Sys. Application & Techs., Inc., 691 F.3d at 1381. Moreover, RXJV has sufficiently alleged a direct economic interest in the procurement. Taking the allegations of error to be true—as it must to determine standing—the Court finds that RXJV “could likely have competed for the contract” in the absence of the alleged errors, because it would likely have proceeded to the next phase of the procurement. Accordingly, RXJV is an interested party and the Court has subject-matter jurisdiction over its claims.
II. Motions for Judgment on the Administrative Record
Parties may move for judgment on the administrative record pursuant to Rule 52.1 of the Rules of the Court of Federal Claims (“RCFC”). Pursuant to RCFC 52.1, the Court reviews an agency’s procurement decision based on the administrative record. See Bannum, Inc. v. United States, 404 F.3d 1346, 1353–54 (Fed. Cir. 2005). The court makes “factual findings under RCFC [52.1] from the record evidence as if it were conducting a trial on the record.” Id. at 1357. Thus,
5 “resolution of a motion respecting the administrative record is akin to an expedited trial on the paper record, and the Court must make fact findings where necessary.” Baird v. United States, 77 Fed. Cl. 114, 116 (2007). The Court’s inquiry is “whether, given all the disputed and undisputed facts, a party has met its burden of proof based on the evidence in the record.” A&D Fire Prot., Inc. v. United States, 72 Fed. Cl. 126, 131 (2006). Unlike a summary judgment proceeding, genuine issues of material fact will not foreclose judgment on the administrative record. Bannum, Inc., 404 F.3d at 1356.
III. Scope of Review of Procurement Decisions
The Court reviews challenges to procurement decisions under the same standards used to evaluate agency actions under the Administrative Procedure Act, 5 U.S.C. § 706 (“APA”). See 28 U.S.C. § 1491(b)(4) (stating that “[i]n any action under this subsection, the courts shall review the agency’s decision pursuant to the standards set forth in section 706 of title 5”). Thus, to successfully challenge an agency’s procurement decision, a plaintiff must show that the agency’s decision was “arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with law.” 5 U.S.C. § 706(2)(A); see also Bannum, Inc., 404 F.3d at 1351.
This “highly deferential” standard of review “requires a reviewing court to sustain an agency action evincing rational reasoning and consideration of relevant factors.” Advanced Data Concepts, Inc. v. United States, 216 F.3d 1054, 1058 (Fed. Cir. 2000) (citing Bowman Transp., Inc. v. Arkansas-Best Freight Sys., Inc., 419 U.S. 281, 285 (1974)). As a result, where an agency’s action has a reasonable basis, the Court cannot substitute its judgment for that of the agency. See Honeywell, Inc. v. United States, 870 F.2d 644, 648 (Fed. Cir. 1989) (holding that as long as there is “a reasonable basis for the agency’s action, the court should stay its hand even though it might, as an original proposition, have reached a different conclusion”) (quoting M. Steinthal & Co. v. Seamans, 455 F.2d 1289, 1301 (D.C. Cir. 1971)). The Court’s function is therefore limited to “determin[ing] whether ‘the contracting agency provided a coherent and reasonable explanation of its exercise of discretion.’” Impresa Construzioni Geom. Domenico Garufi v. United States, 238 F.3d 1324, 1332–33 (Fed. Cir. 2001) (quoting Latecoere Int’l, Inc. v. U.S. Dep’t of Navy, 19 F.3d 1342, 1356 (11th Cir. 1994)).
IV. Merits
The joint venture’s protest is based entirely on what it alleges was an irrational technical evaluation of its proposal. Its arguments have a common theme: that the Air Force required it to provide excessive detail to establish that it possessed the relevant technical experience. According to RXJV, the Air Force should have indulged a variety of presumptions about RXJV’s technical expertise that were not explicitly detailed in its proposal but which RXJV argues the Air Force should have found established by implication.
This theme is fundamentally at odds with the Solicitation’s explicit requirements as well as with the narrow standard of review applicable to protests such as this one. Under the Solicitation, as noted above, offerors were required to submit proposals that were “clear” and “specific,” and that “include[d] sufficient detail for effective evaluation and for substantiating the validity of stated claims.” AR Tab 25 at 629. Further, they were directed to provide a “convincing rationale to address how the Offeror’s proposal meets [the Solicitation’s]
6 requirements.” Id. These admonitions certainly put offerors on notice that it would not be prudent to assume that the agency would credit them for technical experience not spelled out explicitly or in detail.
Further, it is well established that evaluations of proposals for their technical quality involves the specialized expertise of an agency’s subject-matter experts. As the United States Court of Appeals for the Federal Circuit has observed, protests concerning “the minutiae of the procurement process in such matters as technical ratings . . . involve discretionary determinations of procurement officials that a court will not second guess.” E.W. Bliss Co. v. United States, 77 F.3d 445, 449 (Fed. Cir. 1996). To the contrary, courts “give the greatest deference possible to these determinations.” One Largo Metro, LLC v. United States, 109 Fed. Cl. 39, 74 (2013) (observing that “the evaluation of proposals for their technical excellence or quality is a process that often requires the special expertise of procurement officials”) (quoting Beta Analytics Int’l, Inc. v. United States, 67 Fed. Cl. 384, 395 (2005)); see also CSC Gov’t Solutions, Inc. v. United States, 129 Fed. Cl. 416, 434 (2016) (“[T]he deference afforded to an agency’s decision must be even greater when a trial court is asked to review a technical evaluation because of the highly specialized, detailed, and discretionary analyses frequently conducted by the government in that regard.” (internal quotation marks omitted)). Therefore, in cases where a protester challenges the technical ratings it has been assigned, “this court’s main task is to ensure that the [contracting officer] examined the relevant data and articulated a ‘rational connection between the facts found and the choice made.’” WorldTravelService v. United States, 49 Fed. Cl. 431, 441 (2001) (citing Motor Vehicle Mfrs. Ass’n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43 (1983)).
In this case, RXJV is asking the Court to substitute its own judgment (or more accurately, RXJV’s views) for those of the agency’s technical experts regarding whether RXJV adequately demonstrated its technical proficiency in its narratives. Of course, this is precisely what E.W. Bliss Co. and related authority direct the Court not to do. For the reasons set forth below, RXJV has failed to discharge its heavy burden of demonstrating that the agency’s technical evaluation lacked a rational basis.
A. Sub-Element 1a: Life-cycle Software Services
Sub-Element 1a: Life-cycle Software Services (500 points) required offerors to demonstrate their experience in design, build, test, and implementation of an Information System (“IS”). The Solicitation defines the verb “build” as “[t]he process by which source code is converted into a stand-alone form that can be run on a computer or to the form itself” and observes that “[o]ne of the most important steps of a software build is the compilation process, where source code files are converted into executable code.” AR Tab 25 at 688.
The Air Force’s technical experts concluded that RXJV’s proposal did not demonstrate its “build” experience. AR Tab 27 at 762–65. For example, with respect to TN #1, the agency acknowledged that RXJV had asserted in its proposal that it “provides and implements software solutions by adding, modifying, and compiling source code, and managing both source and executable/program libraries.” Id. at 763 (quoting AR Tab 26 at 731 (TN #1)). But notwithstanding this conclusory statement, the agency found, “the proposal [did] not demonstrate the offeror’s build experience of converting and compiling source code into an executable form [because] it does not provide demonstrated examples [and] does not identify the compilation
7 process nor the tool used to perform the task.” Id. at 763. “While the proposal uses the terms ‘compiling’ and ‘building’ [and] the proposal includes statements that the offeror has experience,” the agency reasoned, it “fails to provide further information, and therefore does not satisfy the evaluation criteria to demonstrate experience with the build of an IS.” Id. at 763–64; see also id. at 762, 764–65 (explaining why the other technical narratives referenced by RXJV did not demonstrate build experience compiling and converting source code).
RXJV argues that it was irrational for the agency to find that it had not demonstrated build experience because “in modern software development, the build is automated by the tools RXJV uses.” Pl.’s MJAR at 20. “Software development, integration, test and successful delivery of an Information System [] such as demonstrated in RXJV’s proposal,” it argues, “cannot be accomplished without compiling and completing the other logical processes necessary to complete the build of an IS.” Id.; see also AR Tab 30 at 845 (RXJV debrief follow-up questions) (“Today, modern software development is performed with automated tools that prepare code for testing without a specific ‘compile’ step . . . build is automated by the tools we use.”). The processes it used, RXJV contends, are “commonly used and they presume an iterative compile and build function.” Pl.’s MJAR at 20.
This critique of the agency’s decision—which is typical of the approach RXJV takes throughout its protest—does not persuade the Court that it has a basis for finding the agency’s conclusions irrational. The administrative record reflects that the agency reviewed each of the TNs that the joint venture asserted would support its claimed build experience. AR Tab 27 at 762–65. The Air Force’s technical experts explained why they found RXJV’s proposal deficient on this score, noting for example that TN #2 did not “provide demonstrated examples” or “make any reference to the compilation process or actions performed by the offeror to convert code into an executable form.” Id. at 764. The agency was not obligated to draw inferences or indulge presumptions about RXJV’s expertise regarding the compilation process, which the Solicitation identified as “[o]ne of the most important steps of a software build.” AR Tab 25 at 688. It had the discretion to require RXJV to explain itself more clearly and fully so that agency experts could be satisfied that RXJV in fact understood the process and possessed the relevant expertise. Indeed, “[o]fferors carry the burden of presenting ‘an adequately written proposal, and an offeror’s mere disagreement with the agency’s judgment concerning the adequacy of the proposal is not sufficient to establish that the agency acted unreasonably.’” Software Eng’g Servs., Corp. v. United States, 85 Fed. Cl. 547, 554 (2009) (quoting United Enter. & Assocs. v. United States, 70 Fed.Cl. 1, 26 (2006) (citation omitted)); see also Impresa Construzioni, 238 F.3d at 1324 (noting that “the courts have recognized that contracting officers are entitled to exercise discretion upon a broad range of issues confronting them in the procurement process” (internal quotation marks omitted)).3
3 RXJV argues “[t]he agency applied an unreasonable interpretation of ‘build’ and/or its elements that was also contrary to the plain meaning of the RFP terms.” Pl.’s MJAR at 18. The government contends that RXJV waived any challenge to the definition of the word “build” contained in the Solicitation by not raising it before proposal submission. Def.’s MJAR at 14–15 (citing Blue & Gold Fleet v. United States, 492 F.3d 1308, 1313 (Fed. Cir. 2007)). To the extent that the joint venture is challenging the definitions in the Solicitation, the Court agrees with the
8 B. Sub-Element 2a: Cybersecurity (Vulnerabilities and Threats)
The joint venture’s challenge to the agency’s determination regarding Sub-Element 2a is unavailing for similar reasons. That sub-element required offerors to describe their “knowledge and experience in providing services to assess software application vulnerabilities and threats using the Risk Management Framework [“RMF”].” AR Tab 25 at 654. The Air Force reviewed each of RXJV’s narratives and determined that although the narratives referenced its experience applying the RMF framework, they did not supply sufficient detail to satisfy the agency regarding its expertise in “providing services to assess software application vulnerabilities and threats.” AR Tab 27 at 769–70.
For example, the agency noted that while TN #2 “outline[d] the high-level steps [RXJV] took to achieve an [Interim Authority to Operate], the proposal [did] not demonstrate the offeror’s experience assessing software application[s] for vulnerabilities and threats.” Id. at 769. Similarly, with respect to TN #4, the Source Selection Evaluation Board observed that “[s]tating the use of the RMF [in the TN] shows the offeror’s knowledge about the use of RMF but does not demonstrate how the offeror assessed software application vulnerabilities and threats for [Public Key Infrastructure].” Id. at 770; see also id. at 769, 770 (making similar observations with respect to TN #3 and #5).
RXJV again faults the agency for requiring it to provide greater detail regarding its experience, contending that that the agency should have concluded that it demonstrated proficiency in addressing vulnerabilities and threats based on its narratives showing that it was granted an authority to operate (“ATO”) in several of its contracts. Pl.’s MJAR at 22.4 Its argument is that “[a]s part of obtaining ATOs, pursuant to the government’s own requirements, RXJV had to demonstrate experience providing services to assess software application vulnerabilities and threats.” Id.; see also AR Tab 30 at 847 (“[S]uccessful implementation of RMF and achieving an ATO for multiple systems, as referenced in our TNs for sub element 2b, demonstrates the Offeror’s experience in assessing vulnerabilities and threats for the whole system.”).
But the Air Force found RXJV’s proposal deficient because it failed to include specific examples that described how it assessed threats and vulnerabilities to achieve ATOs. The Solicitation required offerors to “demonstrate[] [their] knowledge and experience . . . using the Risk Management Framework [RMF].” AR Tab 25 at 654. It was clearly within the Air Force’s discretion to find that mere assertions regarding the successful implementation of an RMF
government that such a challenge has been waived. But the Court does not read the joint venture’s argument as a challenge to the definition of the word “build” in the Solicitation. Rather, it is a challenge to the application of the word “build” as defined in the Solicitation to RXJV’s proposal. And for the reasons set forth in the text, the Court concludes that challenge lacks merit. 4 According to the government, an ATO “certifies a system is secure, works cohesively with existing systems, and is granted permission to operate on a network.” Def.’s MJAR at 19 n.7.
9 process or achievement of ATOs did not sufficiently demonstrate RXJV’s technical expertise as to this element.
In that regard, the Court rejects the joint venture’s contention, pressed at oral argument, that faulting RXJV for not showing “how” it performed the tasks for which it claimed expertise imposed a requirement on it that was not contained in the Solicitation. The Solicitation stated, as noted, that offerors must provide a “convincing rationale” that addressed “how the . . . proposal meets [the Solicitation’s] requirements.” Id. at 629 (emphasis supplied). The Solicitation also required offerors to “demonstrate” their knowledge and experience. It was entirely consistent with the Solicitation’s requirements, therefore, for the agency to find RXJV’s proposal technically deficient because it did not provide detail about “how” tasks were performed.
C. Sub-Element 2b: Cybersecurity (Risk Management)
RXJV’s challenge concerning Sub-Element 2b (500 points) similarly lacks merit. Under that sub-element, offerors were required to “demonstrate[] knowledge and experience in incorporating risk management principles and information security requirements to prevent the loss of data Confidentiality, Integrity and Availability using the following three (3) preventative technical controls[:] Authentication, Authorization and Accountability.” Id. at 654. The Solicitation further specified that the Air Force “would not accept points claimed by the offeror if the experience does not address all 3 risk management principles (Confidentiality, Integrity and Availability) . . . [and] all 3 preventative technical controls (Authentication, Authorization and Accountability).” Id.
The Air Force determined that RXJV did not provide enough detail to meet the requirements of Sub-Element 2b—specifically the “required Accountability and Availability experience.” AR Tab 27 at 773; see also id. at 771 (evaluating TN #1) (explaining that RXJV’s proposal merely “stat[ed] a list of tasks that the offeror has experience with” but did not “demonstrate experience incorporating risk management princip[les] and information security to prevent the loss of data”); id. at 772–73 (evaluating TNs #2 and #5) (“Stating a list of controls that the offeror has experience with does not demonstrate experience incorporating risk management princip[les] and information security requirements to prevent the loss of data.”); id. at 772 (evaluating TN #3) (“Stating a list of processes that the offeror has experience with does not demonstrate . . . experience with accountability or availability, as defined in the solicitation.”); id. at 773 (evaluating TN #4) (“While the proposal outlines the high-level steps and tools the offeror used at the PKI SPO, the proposal does not demonstrate the three preventative technical controls to prevent the loss of data or ensure Confidentiality, Integrity and Availability or give specific examples of, discuss in any detail, etc., the use of the tools and processes listed.”).
RXJV again asserts that the Air Force’s decision was arbitrary and capricious on the grounds that the Air Force required it to supply excessive and unnecessary detail. It claims that experience with Confidentiality and Integrity risk management principles “presume[s] . . . experience with all 3 preventative technical controls, including accountability.” Pl.’s MJAR at 24. But once again, the Solicitation provided six distinct cybersecurity requirements and RXJV bore the burden of demonstrating to the satisfaction of the agency’s experts that it had the capability to meet all of them. It did not do so, and the Court has no basis for disturbing the
10 agency’s decision, in the exercise of its expert judgment, that RXJV did not substantiate the experience it claimed.
D. Remaining Claims
As noted, RXJV also challenges the agency’s technical evaluations with respect to Sub- Elements 5c, 6a, 6d, 8a, and 9. There is no need to discuss these remaining challenges in detail. For one thing, even if the remaining challenges were meritorious, they would not afford RXJV the additional 1050 points it would need to establish that its proposal was technically acceptable. Therefore, such errors would not have caused RXJV the “significant prejudice” required to justify sustaining its bid protest. Bannum, Inc., 404 F.3d at 1353 (holding that “[t]o establish significant prejudice [the protester] must show that there was a substantial chance it would have received the contract award but for the errors.” (internal quotation marks omitted)).
In any event, the Court has reviewed the remaining challenges and finds them without merit. These challenges similarly take issue with judgment calls the agency’s technical experts made finding RXJV’s narratives insufficiently detailed and/or too conclusory. See, e.g., Pl.’s MJAR at 27–28 (challenging the agency’s determination under Sub-Element 6a that RXJV’s TNs failed to show how it implemented an information system). Others are based on supposed inconsistencies between the ratings the agency assigned to different technical sub-elements. See id. at 26–27 (arguing that it was inconsistent for the agency to validate the points RXJV claimed under Sub-Elements 1a and 3b but not those it claimed for 5c). All of these determinations required the agency’s experts to apply their specialized knowledge to the highly technical discussions contained in RXJV’s narratives. Because the record reflects that the agency reviewed the technical narratives and explained the reasons for its decisions, RXJV’s disagreements with those decisions provide the Court with no basis for setting them aside. For these reasons, the Court concludes that RXJV’s claims based on Sub-Elements 5c, 6a, 6d, 8a, and 9 lack merit.
CONCLUSION
For the foregoing reasons, RXJV’s motion for judgment on the administrative record is DENIED. The government’s cross-motion is GRANTED. The Clerk is directed to enter judgment accordingly. Each party shall bear its own costs.
IT IS SO ORDERED.
s/ Elaine D. Kaplan ELAINE D. KAPLAN Judge