Cyber Defense eMagazine December Edition for 2021

The U.S. Government Accountability Office’s (GAO) bid protest decision in Steel Point Solutions, LLC 4 ,
provides an instructive example of how an impaired objectivity OCI can come about while providing IT
services to the government. The protest involved a solicitation to design, build, and operate a corporate
automation implementation center for the National Geospatial-Intelligence Agency (NGA). The scope of
work included recommending, designing, deploying, monitoring, and maintaining robotic process
automation solutions for the NGA. Deloitte Consulting, LLP (Deloitte) was selected for the award, and a
protester challenged the award, arguing Deloitte had task orders with the NGA that created an impaired
objectivity OCI.
Under one of the task orders, Deloitte supported the NGA in determining what products to purchase to
maintain NGA’s IT portfolio. At the same time, under the protested contract, Deloitte would be deploying
and maintaining IT systems if the contract award was upheld. Stated differently, under the task order,
Deloitte would be making recommendations to the NGA about what products to purchase to maintain the
IT systems under the protested contract – which could include Deloitte’s own offerings. GAO
characterized the situation as a “textbook example” of an impaired objectivity OCI because Deloitte would
be “in a position to make judgments or recommendations that would have the effect of directly influencing
its own well-being.”
GAO also found a separated Deloitte task order presented an impaired objectivity OCI. Under the second
task order, Deloitte facilitates the review and approval of all NGA information systems. In its proposal for
the protested contract, Deloitte recognized there was a potential OCI because its work under the task
order could require Deloitte to determine whether to approve systems to be used under other contracts,
and Deloitte attempted to address the potential OCI using the template mitigation plan that was provided
with the solicitation. GAO found the mitigation plan was vague and nonspecific, and the separate
mitigation plan Deloitte submitted for the task order was ultimately of no help because the plan depended
on Deloitte not pursuing work that would give rise to an OCI – which clearly did not work because of
Deloitte’s decision to compete for the protested contract. GAO sustained the protest and recommended
that the NGA reconsider its OCI analysis.
One can easily imagine how the task order discussed above could give rise to an unequal access to
information OCI. For example, advising an agency about the types of IT services and products to procure
could provide a contractor with information about the agency’s budget forecasts, future requirements,
and acquisition plans – all competitively useful nonpublic information. Likewise, facilitating the review
and approval of an agency’s information systems would provide a contractor with information about
competitors’ systems and the agency’s requirements – also competitively useful nonpublic information.
At this point, the significance of OCIs for contractors working in the IT and cybersecurity sectors should
be clear.
OCIs Caused by Subcontractors
Contractors should also be mindful of the fact that a subcontractor can introduce an OCI into a
procurement. If a subcontractor would have an OCI as a prime contractor for a given opportunity,
performing as a subcontractor does not remove the OCI.
4 Steel Point Solutions, LLC, B- 419709, B-419709.2, July 7, 2021, 2021 CPD 254.
Cyber Defense eMagazine – December 2021 Edition 89
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.