Posted

Risk Too High? GAO Says You Don’t Have to Bid

by

In Protection Strategies Etc. International, LLC, B-423539 (Aug. 25, 2025), Protection Strategies, a service-disabled veteran-owned small business (SDVOSB), filed a pre-award protest challenging the terms of a solicitation issued by the Defense Counterintelligence and Security Agency (DCSA) for background investigation support services. The protester objected to the agency’s decision to issue the solicitation as a general small business set-aside, rather than reserving it for SDVOSBs or another small business subcategory. It also raised concerns about the solicitation’s risk structure, particularly the use of a fixed-price contract model and the alleged lack of guaranteed funding for phase-in activities.

According to the protester, these solicitation terms imposed unreasonable risk and lacked clarity, creating a competitive disadvantage for small business offerors. The protester also claimed that under the FAR and SBA regulations, DCSA was required to set aside the procurement for a specific subcategory of small business, like SDVOSBs, if there were at least two capable firms expected to submit fair market offers. GAO disagreed, finding no violation of procurement law and holding that the agency acted within its discretion​.

The Decision
GAO dismissed the protest in part and denied it in part, ruling that:

  1. Set-Asides for SDVOSBs Are Not Mandatory: The solicitation was originally structured with a tiered evaluation that gave preference to SDVOSBs. The agency later removed that structure and issued the procurement as a 100% small business set-aside, citing a lack of reasonable expectation that at least two SDVOSBs would submit proposals. GAO rejected the protester’s claim that the agency was required to set the procurement aside for SDVOSBs. It clarified that while both FAR 19.203(c) and 13 C.F.R. § 128.404(b)(2)(i) require agencies to consider setting aside a procurement for specific small business subcategories (like 8(a), HUBZone, SDVOSB, or WOSB), neither regulation requires the agency to do so, even if the agency finds two or more capable firms.
  2. Agencies Can Assign High Risk to Contractors, And Can Even Do So Intentionally: The protester argued that the solicitation’s phase-in requirements were unfunded, ambiguous and risky, and that the fixed-price structure imposed unreasonable financial burdens on small business offerors. GAO disagreed. The record showed the agency intended to fund the phase-in activities as part of the first task order, and that the solicitation included adequate historical data and defined requirements to allow offerors to compete intelligently. GAO also reiterated a foundational principle: an agency is not required to eliminate all performance risk and may properly assign substantial risk to the contractor and minimal risk to itself.
  3. Policy Change Arguments Didn’t Stick: The protester attempted to link some of the perceived solicitation flaws to policy shifts under the new Trump administration, suggesting that the Administration’s actions introduced risk into the procurement. GAO rejected this line of argument, noting that the record showed the agency’s actions were based on market research, acquisition planning and business judgment, not on external political factors or direction.

Key Takeaways for Contractors

  1. There’s No Rule Requiring SDVOSB Set-Asides Outside the VA: Unless the procurement is being conducted by the Department of Veterans Affairs, the “Rule of Two” only requires a general small business set-aside if two or more qualified firms are expected to submit proposals. It does not require a subcategory set-aside, even if the agency is aware of two capable SDVOSBs.
  2. Regulatory Language Like “Shall Consider” Does Not Equal “Shall Do”: The FAR and SBA regulations say agencies must consider SDVOSB and other subcategory set-asides, but GAO made clear that this does not create a mandatory obligation.
  3. Risk-Shifting Is Permissible (and Quite Common): Agencies can (and often do) push cost, staffing and ramp-up risk onto offerors, especially in fixed-price contracts. If the solicitation provides enough data to propose intelligently, GAO won’t second-guess the risk allocation.
  4. Don’t Assume Unclear Equals Unlawful: The protester argued that the phase-in terms were ambiguous, but GAO found them sufficiently clear when read together with the PWS, Q&A responses, and historical workload data.
  5. If the Risk Is Too High, You Don’t Have to Bid: GAO’s final word was pointed: if an offeror finds the risk too steep, its recourse is not a protest. Rather, it’s to walk away from the competition.