Washington, DC 20548

441 G St. N.W.

Washington, DC 20548

Comptroller General

of the United States

DOCUMENT FOR PUBLIC RELEASE

Decision

Matter of:

Ares Enterprise, LLC

File:

B-424548; B-424548.2; B-424548.3

Date:

September 3, 2026

The decision issued on the date below was subject to a

GAO Protective Order. No party requested redactions;

we are therefore releasing the decision in its entirety.

Daniel J. Strouse, Esq., Pablo Nichols, Esq., Samuel Van Kopp, Esq.,

Anna Dichter, Esq., and Leslie A. Weinstein, Esq., Cordatis LLP, for the protester.

Victoria A. Moore, for Vision Information Technology Consultants LLC, the intervenor.

Erika Whelan Retta, Esq., and Isabelle P. Cutting, Esq., Department of the Air Force,

the agency.

Paul N. Wengert, Esq., and Tania Calhoun, Esq., Office of the General Counsel, GAO,

participated in the preparation of the decision.

DIGEST

1. Protest that Federal Supply Schedule (FSS) order issued under blanket purchase

agreement (BPA) exceeded the scope of the BPA is sustained where the record shows

that the BPA described services in support of specific functions, but the order included

services that were broader than and materially different from the scope of the BPA.

2. Protest that order issued under BPA exceeded the scope of the recipient vendor’s

FSS is sustained where the agency failed to validly determine that the order was within

the scope of the vendor’s contract and its labor categories.

DECISION

Ares Enterprise, LLC, of Fairfax, Virginia, a small business, protests the issuance of a

Federal Supply Schedule (FSS) task order under the Enterprise Information Technology

as a Service (EITaaS) Wave 1 Blanket Purchase Agreement (BPA) to Vision

Information Technology Consultants LLC, of San Antonio, Texas, also a small business,

under a solicitation issued by the United States Space Force, 1 for information

technology services in support of the 61st Communications Squadron at Los Angeles

Although the contracting actions at issue were taken on behalf of the United States

Space Force, many of the personnel involved, were from the Department of the Air

Force, including counsel representing the agency. Unless material to the protest, we

generally use the term “agency” throughout to indicate the United States Space Force.

1

Air Force Base (LAAFB), in El Segundo, California. Ares argues that the Space Force

improperly placed the LAAFB order on a sole-source basis and that the order exceeds

the scope of Vision’s FSS contract and the EITaaS BPA. 2

We sustain the protest.

BACKGROUND

Ares has performed information technology support services at LAAFB as a

subcontractor to Trace Systems, Inc., which was the recipient of a task order issued on

March 1, 2025, under the Army’s Responsive Strategic Sourcing for Services indefinitedelivery, indefinite-quantity contract. Contracting Officer’s Statement (COS) at 4 n.1.

Although the term of that task order provided a base year and four option years, the

agency did not exercise the first option year; instead, it awarded a series of 1-month

bridge contracts to Trace, under which performance ended on May 31, 2026. Id.

The agency explains that the transition of work from Trace’s contract to the EITaaS BPA

follows a 2023 agency decision to transition all local information technology contracts

providing field services to the EITaaS BPA. COS at 3 (citing Agency Report (AR),

Tab 4, Memorandum from Air Force Deputy Chief Information Officer (June 9, 2023)

at 1).

In planning the procurement, the agency’s contracting officer’s technical representative

and the contracting officer reviewed the most recent update to the EITaaS BPA ordering

guide, a July 2025 briefing from CACI about the BPA, 3 the views of the BPA contracting

The agency explains that the EITaaS BPA was a single-award BPA valued at

$5.7 billion over a term of up to 10 years. The Air Force established the BPA on

August 30, 2022, with a contractor teaming arrangement (CTA) consisting of ten FSS

contractors: CACI NSS, LLC, as the lead contractor and nine small business team

members, including Vision, but not Ares. A CTA under the General Services

Administration's (GSA) FSS program is a written agreement between two or more

Schedule contractors to work together to meet an agency's requirements and to

maximize a vendor's competitiveness. See GSA, Partner with Other MAS Contractors

page, https://www.gsa.gov/sell-to-government/step-1-learn-about-governmentcontracting/how-to-access-contract-opportunities/help-with-mas-contracts-to-sell-togovernment/team-up-with-other-mas-contractors (last visited Aug. 26, 2026). Under

GSA’s policies regarding CTAs, each team member is deemed to have contractual

privity with the contracting agency. After establishing a single-award FSS BPA, an

agency may issue orders without holding further competition. See Federal Acquisition

Regulation (FAR) 8.405-3(c)(1).

2

Ares also contends that the July 2025 briefing reveals an impermissible organizational

conflict of interest (OCI) that makes issuing the order to any EITaaS CTA member

improper. Comments & 2nd Supp. Protest at 2-3. Ares argues that CACI, as a

contractor, had impaired objectivity in providing information to the agency regarding the

(continued...)

3

Page 2

B-424548 et al.

officer, and the views of a CACI official. Based on that review, they both determined

that the agency’s requirements were within the scope of the BPA. COS at 4-5; AR,

Tab 7, Scope Determination Documents at 2 (Contracting Officer’s Determination and

Findings (May 21, 2026)). During the process, the contracting officer’s technical

representative (COTR) questioned whether two subjects (knowledge management

functions and freedom of information/personally identifiable information/records

management functions) were within the scope of the EITaaS BPA and was advised by

both CACI and the BPA contracting officer that they were. Id. at 4 (Memorandum from

COTR to Contracting Officer).

The agency explains that CACI selected Vision to submit a quotation for the LAAFB

order because, under the EITaaS BPA procedures, “as CTA Lead, CACI receives

solicitations and distributes them to CTA members that, in its determination, can best

meet the stated requirements.” COS at 2. In that regard, the BPA ordering guide

provides a list of the CTA lead duties, which includes that CACI will “[d]istribute

solicitations to appropriate CTA Team Member(s) and consolidate [a] formal proposal

submission” and then will “[c]onsolidate and submit proposal responses including CTA

Team Members as applicable.” AR, Tab 5, EITaaS Ordering Guide (Mar. 8, 2024

revision) at 7.

On May 29, 2026, Space Force issued the order at issue (the LAAFB order) to Vision

under the EITaaS BPA to provide services for a 9-month base period, and two 1-year

options, plus a 6-month extension-of-services option under FAR 52.217-8. COS at 5;

Memorandum of Law (MOL) at 3. Ares then filed this protest.

DISCUSSION

Ares contends that the LAAFB order exceeds the scope of both the EITaaS BPA and

Vision’s FSS contract. The agency argues that the protest should be dismissed as

untimely and because Ares is not an interested party. We consider those arguments

before turning to the merits of the protest.

scope of the EITaaS BPA. Id. While, as noted, the COTR and contracting officer

reviewed the briefing, Ares’s arguments do not support the claim that, in doing so, the

agency regarded CACI to be providing unbiased analysis or advice from which an OCI

could arise. The agency recognized the obvious fact that the lead contractor on the

BPA, CACI, was describing the scope of its own BPA, and thus was not objective or

unbiased. Indeed, the emails regarding the briefing, and the briefing itself, are

prominently marked with CACI’s logo and their text shows them to be an effort to

promote use of the BPA, rather than convey an unbiased analysis. Accordingly, we

dismiss this argument as lacking the required factual and legal basis. 4 C.F.R.

§§ 21.1(c)(4), 21.5(f).

Page 3

B-424548 et al.

Timeliness

Space Force argues that the protest is untimely because Trace had been told of the

agency’s intention to issue an order under the EITaaS BPA as early as March 1, but

Ares did not file its protest until June 3, well beyond the 10-day timeliness requirement

in our Bid Protest Regulations. Req. for Dismissal at 2-3 (citing 4 C.F.R. § 21.2(a)).

Ares acknowledges that by May 12 it had learned that Vision was working to recruit

incumbent employees based on an expectation that the agency would issue an order to

it under the EITaaS BPA, but also that the agency had delayed a decision to proceed

until May 29. Protest at 4. Ares contends that it “learned from recruiters, which had

begun reaching out to Ares employees on behalf of” Vision, that the agency “intended to

place work” from the contract on which Ares was then performing onto a different

contract vehicle. Opp. to Req. for Dismissal at 1-2. Ares explains that it learned on

May 29 that the agency had, or would imminently, issue an order to Vision, so the firm

filed an agency-level protest. Id. at 1-2. While the agency-level protest stated that Ares

did not believe an order had been issued (thus it was arguably premature), the agency

immediately denied Ares’s protest and then proceeded to issue the order to Vision on

May 29. COS at 6.

Contrary to the agency’s view, Ares was not required to file a defensive protest based

on secondhand information to challenge a contracting action that had not, in fact,

occurred at that time. See, e.g., Ervin & Assocs., Inc., B-278850, Mar. 23, 1998, at 7

(protest challenging task order as exceeding scope of underlying contract was not

untimely even though protester received rumors of the order more than 10 days before

the protest because “mere speculation or rumor provides no basis for questioning the

propriety of a procurement”). Ares filed this protest with our Office on June 3, which is

timely because it was filed within 10 days of the denial of the agency-level protest--and

within 10 days of the issuance of the LAAFB order. 4 C.F.R. § 21.2(a)(2), (3).

Interested Party

The agency also argues that Ares’s protest should be dismissed because the firm is not

an interested party because it was not one of the EITaaS BPA team members.

Ares contends that it is an interested party to challenge the LAAFB order because its

protest contends that the order is improper and beyond the scope of both the BPA and

Vision’s FSS contract. Ares also argues it could compete for the requirement if its

protest were to be sustained because Space Force would have to consider a

procurement that did not use the EITaaS BPA or Vision’s FSS contract, and thus, would

hold a competitive procurement under which Ares could compete.

Under the bid protest provisions of the Competition in Contracting Act, 31 U.S.C.

§§ 3551-3557, only an “interested party” may protest a federal procurement. That is, a

protester must be an actual or prospective bidder or offeror whose direct economic

interest would be affected by the award of a contract or the failure to award a contract.

Page 4

B-424548 et al.

Bid Protest Regulations, 4 C.F.R. § 21.0(a)(1). Determining whether a party is

interested involves consideration of a variety of factors, including the nature of issues

raised, the benefit or relief sought by the protester, and the party’s status in relation to

the procurement. RELM Wireless Corp., B-405358, Oct. 7, 2011, at 2.

Here, Ares is challenging whether the LAAFB order is within the scope of both Vision’s

BPA and its FSS contract and contending that if the protest is sustained then the

LAAFB order is invalid and a competitive procurement will be required, under which

Ares could compete. Protest at 11; Opp. to Req. for Dismissal at 5. Based on the

issues raised and the relief sought, Ares is an interested party to pursue this protest.

See Sigmatech, Inc., B-296401, Aug. 10, 2005, at 4 n.5 (protester that did not hold FSS

contract was an interested party to challenge the propriety of agency’s actions

establishing an FSS BPA and placing orders under it).

Accordingly, we proceed with consideration of Ares’s challenges to the scope of the

order, first with respect to the scope of the EITaaS BPA, and then with respect to the

scope of Vision’s FSS contract.

Comparison of Scope of LAAFB Order to Scope of EITaaS BPA

Ares argues that the LAAFB order issued to Vision exceeds the scope of the EITaaS

BPA’s performance work statement (PWS). In particular, Ares argues that the order

includes operation and maintenance of networks and systems, and mission-specific,

system-specific engineering and development work, most of which is beyond the scope

of the EITaaS BPA. In contrast, the firm argues, the scope of the EITaaS BPA is

principally enterprise help desk services and end user device support. Protest at 7. As

a result, the firm contends, the scope of the BPA does not include much of the scope of

the order, including operations and maintenance of systems and infrastructure,

cybersecurity and information security, information technology planning and

management, electronic information systems support, short-term projects, and support

for records management, among other things. Supp. Protest at 5-6; Protest at 8. 4

The agency argues that it made a reasonable assessment that the services were within

the scope of the EITaaS BPA, and that Ares’s arguments are faulty both because it

interprets the scope of the BPA too narrowly and depicts the scope of Vision’s order too

broadly. Correctly understood, the agency contends that the order issued to Vision is

within the broad scope of the EITaaS BPA. MOL at 5-6. The contracting officer argues

Ares raised additional arguments in its first supplemental protest, challenging several

tasks in eight LAAFB task areas (2.8 and 2.11 through 2.17) that the firm argued were

partially beyond the scope of the EITaaS BPA. Supp. Protest at 7-8. For each task

area, the agency responded with an explanation of the basis for its judgment that each

task area was within the scope of the BPA. E.g., COS at 6-7, 19-24. In its comments,

Ares made only a general assertion (in a brief footnote) that those challenges were

valid. In doing so, it did not meaningfully challenge the agency’s arguments in support

of those task areas. We deem those challenges abandoned and do not address them.

4

Page 5

B-424548 et al.

that most of the challenged work is within the scope of EITaaS BPA task areas 7.1,

Enterprise Services; 7.2, End User Device; and 7.3, Protect. COS at 6-7. For the

remainder of the challenged work, the contracting officer argues that individual tasks

would be covered by EITaaS BPA task area 9 (engineering services) for electronic

information support systems, task area 11 (transition services) for short-term projects

and support of the contract writing system, and task area 14 (configuration

management) for intelligence and threat support services. Id. at 7.

The Competition in Contracting Act generally requires “full and open competition” in

government procurements, to be obtained through competitive procedures. 10 U.S.C.

§ 3201(a)(1); see also 41 U.S.C. § 3301. Where an agency uses the FSS program, it

satisfies the requirement to obtain full and open competition, so long as the agency

complies with the applicable procedures for its use. 10 U.S.C. § 3012(3). Among

these, when an agency uses the FSS, it must order products and services that are

available from the relevant contractor’s FSS contract(s) and may not order non-FSS

items (known as “open market” items). 5 RELX Inc., B-421597.2, B-421597.3,

Nov. 17, 2023, at 5.

Where a protester challenges a task order as exceeding the scope of the contract or

agreement under which the order is issued, our Office will review the record to

determine “whether there is a material difference between the . . . order and the

underlying BPA.” Vetterra, LLC, B-417991 et al., Dec. 20, 2019, at 6. The effort to

assess whether differences are material is based on “reviewing the BPA as awarded”

and “the terms of the delivery order.” Tempus Nova, Inc., B-412821, June 14, 2016,

at 4. Our “overall inquiry is whether the order is of a nature which potential offerors [that

would have competed for establishment of the BPA] reasonably would have

anticipated.” Vetterra, LLC, supra at 6.

The EITaaS BPA included a PWS that described the intended purpose of the EITaaS

BPA as a vehicle to provide “wave 1” of a set of services to:

transform End User Device services . . . . Services may also be required

to develop new systems, consolidate and/or integrate systems, develop

interfaces with other systems/services, and expand the existing systems

to also support other [agency] mission areas.

AR, Tab 3, EITaaS BPA attach. 3, PWS at 5.

The PWS further described the wave 1 services as providing “a robust Enterprise IT

Service Management (EITSM) platform, modernized End User Devices, Device

We recognize an exception for the inclusion of items for which the total value does not

exceed the micro-purchase threshold, the level at which competition requirements do

not generally apply. See Maybank Indus., LLC, B-403327; B-403327.2, Oct. 21, 2010,

at 4. No party here contends that this exception would apply to the order.

5

Page 6

B-424548 et al.

Software, Device Management, and responsive and efficient Enterprise and Local Help

Desk Services.” Id. at 8.

The PWS states that it “establishes the full scope of Wave 1,” which was depicted in an

accompanying graphic and organized in a bulleted list, as follows:

•

•

•

Enterprise Services

• Service Desk and ITSM [information technology service management]

End User Devices and Management

• Computing Devices

• Print

• Voice Devices

• Bring Your Own Approved Device (BYOAD)

Protect

• End User Device and Data Protection

Id. at 8-9.

The PWS provided narrative explanations of each task area (many of which were

broken into further subdivisions) starting at section 7 of the document. The protest

issues mainly arise with respect to the scope of task areas 7.1, 7.2, 7.3, 9, 11, and 14,

which we summarize below as necessary background.

EITaaS task area 7.1 was labeled “enterprise services,” under which subtask 7.1.1,

labeled “service desk and ITSM [information technology service management],”

provided for the vendor to provide a “common set of productivity and collaborative

services to support and bring value to” the agency’s over 800,000 users, “agnostic of

device, worldwide location, or time.” Id. at 9. To do so, the vendor would “manage all

Wave 1 services and operate, maintain, and deploy processes and tools that conform to

commercial best practices” by establishing an ITSM office. The functions of the ITSM

office were listed as including areas such as planning and management of enterprise

information technology and organizational change management “for Wave 1 service

areas.” Id. at 9-10.

For example, under subtask 7.1.1.1, labeled “service desk,” the vendor would provide a

single point of 24/7/365 IT service support “for all service issues (including end point

devices)” Id. at 10. Subtask 7.1.1.2, labeled “field services,” required services that

were distinguished from the service desk by field services constituting “Tier 2

services,” 6 in the form of “[o]n-site local field support providing touch labor and walk-in

service.” Id. at 10-11. Subtask 7.1.1.3 provided for the vendor to institute a single,

The tiers were summarized in the PWS, ranging from tier 0 (virtual self-service/user

empowerment), tier 1 (staffed call center support), tier 2 (on-site local field support and

walk-in service), tier 3 (on-call access to subject matter experts), and tier 4 (support by

original equipment manufacturer). AR, Tab 3, EITaaS BPA PWA at 10.

6

Page 7

B-424548 et al.

enterprise-wise solution for managing both classified and unclassified service requests,

incidents, releases, problems, events, assets, configuration, knowledge, service levels,

and similar needs, which the PWS contrasted with the agency’s existing solutions,

under which cyber weapons, programs, and user groups were managed separately. Id.

at 11. Other enterprise services subtasks included providing rapid or automated

incident response, and an information technology storefront. Id. at 12.

Task 7.2, “End User Device” covers services for “the fielding and management of . . .

enterprise end user device solutions, such as computing, mobile, print, and voice

solutions.” Id. at 13. The subtasks included developing a new secure device

configuration baseline, provisioning and managing “government-issued laptops, mobile

devices and smart devices,” and providing a storefront for agency commands to procure

pre-configured devices. Id. 14. Other subtasks related to providing and managing

printing capabilities, document scanning, copying, and faxing for classified and

unclassified materials, as well as non-mobile voice communication devices for both

classified and unclassified communications, and bring-your-own-approved-device

support to allow access to agency resources through a user’s personal device. Id.

at 16-17.

Task 7.3, “Protect,” would include subtasks for services such as end user device and

data protection and malware prevention, automated endpoint management, automated

patching of devices, development of a vulnerability management solution, providing an

automated threat detection and remediation solution, and applying encryption methods

to protect data at rest on a device and during transmission. Id. at 19-24.

PWS task 9, engineering services, states that the vendor will provide engineering

services “to perform support tasks not already defined” among the BPA tasks and

contract line items. Id. at 26. The PWS stated that the specific requirements of such

engineering tasks would be defined in individual task orders, but gave as three

illustrations services to provide a “proof-of-concept” (described as a non-operational

representation of a desired capability), a “prototype” (described as an incomplete project

or product for testing purposes), or a “pilot” (described as a final product distributed only

to limited users). Id. at 26-27. The PWS further stated that engineering services could

also be used “to complete other tasks that would be defined by the Government at the

BPA Order level, consistent with the allowable scope of the BPA.” Id. at 27.

PWS task 11, transition services, stated the importance of transition services to move

from legacy solutions to the contractor’s solution and noted the need for transition

services to include ensuring an “effective transition-in and transition-out of other

contractor and Government support,” while providing continued system operations, and

preventing interruption or disruption of services. Id. at 27.

Finally, task 14, configuration management, consists of just three sentences, which

direct the vendor to “uphold all [c]onfiguration [m]anagement disciplines,” to develop,

implement and maintain configuration management processes across all aspects of the

BPA, and to submit a configuration management plan. Id. at 28.

Page 8

B-424548 et al.

Ares challenges numerous provisions of the LAAFB order, each of which we address

below.

LAAFB order PWS 2.4 -- Task Four: Network and System Operations &

Maintenance

Ares argues that the LAAFB order improperly requires Vision to provide operation and

maintenance of an extensive list of systems, networks, and infrastructure--albeit

excluding those within scope of a separate contract held by CACI. Supp. Protest at 5;

AR, Tab 8, LAAFB Order PWS at 21. Notwithstanding that exclusion, Ares argues that

the order’s requirements improperly require Vision to provide support services to

“operate and maintain equipment and systems in a serviceable condition or to restore it

to a serviceable condition to include identifying required parts to the Government,

inspection, periodic testing, adjustment, and repair” for networks and systems identified

in an accompanying appendix. Comments & Supp. Protest at 10-11. The firm’s

responsibilities are to include “check[ing] each network and system that is controlled by

the [61st Communications Squadron] every business day morning and provid[ing] a

status report.” Id. The covered systems and networks depicted include a Wi-Fi

network, external web servers, wide area networks, storage area networks, virtual

desktops for non-classified and classified networks, backup power systems, and

database, file, print, application, and web servers. Id. at 10 (citing AR, Tab 8, LAAFB

Order PWS at 84 (PWS app. B, “Scope of Control” diagram)).

The contracting officer contends that PWS 2.4 of the LAAFB order is properly within the

scope of EITaaS PWS 7.2 and 7.3. COS at 6, 8-10. 7 The agency contends that the

scope of the EITaaS BPA “does not exclude any specific device or include a

comprehensive list of IT components,” and therefore the order properly required Vision

to provide services to operate and maintain anything that could be classified as

“endpoints.” The agency reasons that the task thereby included support of the entire

range of agency infrastructure. Id. at 9.

Our review of the record does not support the contracting officer’s determination of the

scope of the EITaaS BPA. EITaaS PWS tasks in paragraphs 7.2 and 7.3 provide for

We recognize that the agency contends in its memorandum of law that “the LAAFB

[order] does not call for network operations, infrastructure support, or software and

application development.” MOL at 3. The language of the order PWS contrasts with

this claim, however. For example, the name of task four is “Network and System

Operations & Maintenance,” and provides that Vision “shall be responsible for

operations and maintenance of all systems and infrastructure within the control of the

[61st Communications Squadron] that have not been consolidated” under other

contracts. The PWS then refers to the scope of control diagram and specifies that

operations and maintenance support is to include the vendor’s efforts “to operate and

maintain equipment and systems . . . to include identifying required parts to the

Government, inspection, periodic testing, adjustment, and repair.” AR, Tab 8, LAAFB

Order PWS at 21.

7

Page 9

B-424548 et al.

end user device support. End user devices are treated in EITaaS as falling into the

categories of computing devices (subtask 7.2.1), printers (7.2.2), voice devices (7.2.3),

and bring-your-own-approved-device items (7.2.4). AR, Tab 3, EITaaS BPA attach. 3,

PWS at 13-18. The EITaaS tasks under PWS 7.2 do not describe the operation and

maintenance of underlying networks, systems, or enterprise infrastructure such as

servers and storage area networks.

With regard to EITaaS PWS 7.3, our review shows that its scope again covers end user

devices and protection of data in transit and at rest “on the user’s devices (i.e., desktop,

laptop, tablet, mobile phone, etc.),” along with services that allow such a device to be

wiped or disabled remotely. Id. at 19. Even though EITaaS PWS 7.3 includes a

subtask addressing “endpoint management,” that subtask involves the monitoring of

and assessment of “all end user devices to include [bring-your-own-approved-device] as

well as mobile and stateless devices,” but does not provide a basis to include broader

responsibility network operations and maintenance. Id. at 20. To the contrary, PWS 7.3

expressly distinguishes its scope from broader network and system cybersecurity

scope, stating that “Wave 1 will focus on the End User Device and Data Protection

capability[,] with other service areas being provided in future waves.” Id. at 19

(emphasis added). The contracting officer’s reading of the EITaaS PWS as including

aspects of the LAAFB networks and systems such as servers and storage area

networks is not consistent with the language of that subtask, which addresses support

of end user devices and is, therefore, unreasonable. Consequently, our review shows

that LAAFB PWS 2.4 is not within the scope of the EITaaS BPA.

LAAFB order PWS 2.5 -- Task Five: Cybersecurity

Next Ares challenges the scope of PWS 2.5 of the LAAFB order. That task requires

Vision to provide continuous security, operational availability, and reliability of IT

systems and equipment supporting the LAAFB mission, including assessment and

authorization, responding to negligent classified information releases, training of support

staff cybersecurity liaison, ports/protocols/services management, and numerous other

subtasks. Ares contends none of these services are within the scope of the EITaaS

BPA. Comments & 2nd Supp. Protest at 16-19.

The contracting officer explains that the agency is responsible for cybersecurity

governance, while the services actually included in the LAAFB order are within the

scope of EITaaS PWS 7.3. The contracting officer explains that PWS 2.5 of the LAAFB

order provides that Vision will “augment[] the Government Base Cybersecurity Office

(BCO) by providing Risk Management Framework (2.5.1) support, Computer Security

(2.5.2), support[] the government’s TEMPEST Program (2.5.3), participat[e] in the

government’s Information Assurance Program (IAP) [(]2.5.4[)], and support[] the base

Communications Security (COMSEC) program (2.5.5).” COS at 11. Those

requirements are within the scope of the EITaaS BPA, the contracting officer explains,

because they “fall within the Protection [sic, Protect] portfolio of the EITaaS Wave 1

BPA at PWS . . . [regarding] security configuration management, vulnerability

management, protected transit, and data protection” of EITaaS PWS 7.3. Id. at 11.

Page 10

B-424548 et al.

Our review of the record in this regard does not support the contracting officer’s

determination of the scope of the EITaaS BPA with respect to the cybersecurity task.

As discussed above, the scope of EITaaS PWS 7.3 specifically relates to security

involving end user devices (such as the requirements to ensure end user devices are

configured and run properly within agency networks, services to scan end user devices,

and services to support monitoring and assessment of end user device compliance).

The EITaaS BPA tasks in PWS 7.3 that the agency cites do not provide for the broader

cybersecurity-related services included in LAAFB PWS 2.5, which are not related to end

user devices. As noted previously, the scope of EITaaS PWS 7.3 expressly notes that

its scope addresses “End User Device and Data Protection capability” and that other

service areas are to be addressed in subsequent BPA waves. AR, Tab 3, EITaaS BPA

attach. 3, PWS at 19. In short, our review shows that LAAFB PWS 2.5 is not within the

scope of the EITaaS BPA.

LAAFB order PWS 2.6 -- Task Six: Information Technology Planning and Support

Services

Under task six, the LAAFB PWS specifies that Vision will provide technical expertise

regarding multiple areas that include information technology requirements analysis,

managing projects, installation records management, developing a “road map for future

[information technology] requirements,” and providing technical solutions. AR, Tab 8,

LAAFB PWS at 33. Ares argues that task six requires Vision to provide the agency with

“base-level communications, program management and governance” rather than wave

1 end user device support. Ares acknowledges that the EITaaS BPA describes service

desk and information technology service management functions that involve incident

response, management of service requests, incidents, releases, problems, events,

assets, configuration, knowledge, and service levels. Comments at 19 (citing AR,

Tab 3, EITaaS BPA PWS at 11). Nevertheless, Ares argues that the EITaaS BPA PWS

does not contemplate that the BPA would include providing information technology

requirements analysis or technical solution development. Comments at 19.

The agency again argues that Ares mischaracterizes the scope of the LAAFB order.

Contrary to the protester’s depiction, the contracting officer explains that under task six,

the agency retains “overall responsibility base-level communication planning.” COS

at 12. Task six, the agency explains, requires Vision to “augment” the agency’s work by

validating new information technology requirements and developing technical solutions,

managing and maintaining information system installation records, performing quality

assurance functions, and planning and overseeing installations/modification of systems

within the vendor’s control. COS at 12 (citing AR, Tab 8, LSSFB Order PWS at 33-35).

The agency contends that the scope of task six is consistent with the EITaaS BPA tasks

for enterprise services in PWS 7.1 and protection in PWS 7.3. In particular, the

contracting officer argues that EITaaS PWS 7.1.1 provides for the vendor to provide a

service desk and an information technology service management office. Then, within

that requirement, 7.1.1.2 provides for the service desk to function as “the single point” of

information technology support, and to “manage the full lifecycle of all incidents,

Page 11

B-424548 et al.

problems, and service requests[,] including fulfillment, verification, and closure as well

as interact/cooperate with existing help desks and service providers.” COS at 13

(quoting AR, Tab 3, EITaaS BPA PWS at 10). Further, the agency explains, the

remaining elements of task six, under which Vision will provide both communications

records management and quality assurance, are within the scope of EITaaS BPA

PWS 7.3.1.10. Id. at 13-14.

Our review of the record shows that the LAAFB order identifies the general scope of

task six as covering information technology requirements analysis, managing projects,

providing installation records management, developing a roadmap for future information

technology requirements, and providing technical solutions. AR, Tab 8, LAAFB Order

PWS at 33. The subtasks under task six then provide that Vision would be appointed

as the Cyberspace Infrastructure Planning System (CIPS) 8 monitor for the purposes of

having Vision “oversee all new [information technology] requirement requests for

LAAFB.” Id. In that role, the order goes on to specify that Vision will, for example,

develop technical solutions with stakeholders, manage and maintain communications

and information systems installation records, act as the quality assurance monitor for

equipment, technical order management, corrosion prevention and control, and

electrostatic discharge standards, and will review contracting statements of work and

performance work statements “to ensure standard processes are followed.” Id. at 34.

The EITaaS BPA PWS does not provide a basis for the inclusion of the LAAFB order

task six requirements. The scope of the enterprise services in the BPA, and particularly

the service desk support under PWS 7.1, are described in terms of a service desk and

an information technology service management office to respond to incidents, problems,

and service requests. 9 Significantly, EITaaS BPA PWS 7.3.1.10 is organized under

PWS 7.3.1, which establishes the scope of the subsidiary task elements as being

connected to end user devices and associated data protection. BPA PWS 7.3.1.10

follows after requirements addressing the needs for the vendor’s system to provide for

protection of specific files and directories from modification, such as attempts to modify

or terminate antivirus protections (PWS 7.3.1.7); protection of data at rest through

encryption (PWS 7.3.1.8); and ensuring a capability to isolate an individual application

from the operating system when necessary (PWS 7.3.1.9). AR, Tab 3, EITaaS BPA

CIPS is an official system of records used by Air Force communications squadrons to

manage infrastructure-related information technology documentation. It enables the

agency’s planning and management of base infrastructure using functions that include

requirement tracking, work order management, outside plant wiring diagrams, inside

plant records, and work plans. See, e.g., Air Force Materiel Command, CIPS

Implementation for Gunter Business and Enterprise Systems, Dec. 5, 2023,

https://www.afmc.af.mil/News/Article-Display/Article/3606965/cips-implementation-forgunter-business-and-enterprise-systems/ (last visited Aug. 26, 2026).

8

In so noting, we also recognize that PWS 7.1 has a distinctly broader scope that,

unlike PWS 7.2 and 7.3 discussed above, does not focus specifically on services in

support of end user devices.

9

Page 12

B-424548 et al.

PWS at 23-24. Understood in that context, PWS 7.3.1.10 provides for the vendor’s

solution to “ensure confidentiality, integrity, and availability of information” both when

moving across the agency’s networks and resting within systems, by use of approved

encryption. The language of the EITaaS BPA PWS does not support the agency’s

much broader construction of the BPA PWS tasks and, specifically, does not provide a

basis for LAAFB order requirements for Vision to analyze new information technology

requirements, or to develop appropriate technical solutions. Neither does the scope of

the BPA anticipate providing services to manage and maintain information system

installation records, performing quality assurance functions for equipment, ensuring

compliance with corrosion prevention and control standards and electrostatic discharge

limits, or reviewing contracting statements of work and performance work statements.

Therefore, task six of the LAAFB Order improperly exceeds the scope of the EITaaS

BPA.

LAAFB order PWS 2.7 -- Task Seven: Knowledge Management

Ares next challenges the inclusion of the knowledge management task in the LAAFB

order. The order PWS provides that Vision will serve as the alternate base records

manager, and as both the primary and alternate unit records managers for the 61st

Communications Squadron. AR, Tab 8, LAAFB Order PWS at 37. The contractor is

required to visit each of 44 unit-level records managers, train all records professionals

within 3 months of appointment, develop publications, and monitor processing and

reviews of publications and forms under applicable policies. Id. Under the Privacy Act

functions, the contractor is tasked with being appointed as the unit privacy monitor for

the 61st Communications Squadron, and with analyzing and processing breaches of

personally identifiable information protections and related complaints and then

determining the appropriate disposition. Id. The task also included advising on and

preparing responses to Freedom of Information Act requests under government

supervision, and assisting in developing, managing, and maintaining unit Sharepoint

sites, including annual training for the knowledge managers. Id. at 38. Ares argues that

the scope of the EITaaS BPA has no significant relationship to the scope of LAAFB

order PWS 2.7. Comments & 2nd Supp. Protest at 21.

The agency argues that Ares overstates the scope of the records management task and

ignores that the agency retains overall responsibility for knowledge management. COS

at 14. The contracting officer explains that after reviewing the issue, the agency

correctly determined that the knowledge management task was within EITaaS PWS

7.1.1.3, labeled information technology service management, and PWS 7.3.1.11,

labeled data protection. Id. at 15.

We do not agree that the scope of knowledge management task seven is within the

scope of the EITaaS BPA PWS, based on our review of the record here. First, BPA

PWS 7.3.1.11 provides simply for the vendor to ensure that information on user devices

will be retained until the device was decommissioned or the information was removed

by designated agency officials, and to hold the corresponding records as provided in

data retention policies. AR, Tab 3, EITaaS BPA attach. 3, PWS at 24.

Paragraph 7.3.1.11 does not address providing broader knowledge management

Page 13

B-424548 et al.

support. Neither does PWS 7.1.1.3 support the agency’s position. It describes the

agency’s goal of a single, enterprise-wide ITSM solution that would allow the agency to

“provide end-to-end management of service requests, incidents[,] releases, problems,

events, assets, configuration, knowledge, service levels, etc.” Id. at 11. The PWS

describes the solution in terms of implementation through appropriately secure cloud

instances and “support[ing] cyber weapon systems, programs of record, and users as

opposed to the current configuration where the [the agency] pays for multiple ticketing

systems.” Id. at 12. In short, the EITaaS subtask has no similarity to the requirements

of LAAFB task seven, which provides for Vision to provide support for much broader

knowledge management functions (regardless of the fact that the agency itself retains

overall responsibility). Therefore LAAFB PWS 2.7 is also not within the scope of the

EITaaS BPA.

LAAFB order PWS 2.9 & 2.10 -- Task Nine: Electronic Information Systems

Support and Task Ten: Short-Term Projects

Ares challenges the inclusion of tasks nine and ten 10 in the LAAFB order, arguing that

the tasks require Vision to provide “operation, maintenance, enhancement, and

development of enterprise applications, databases, SharePoint environments, Power

Apps, scheduling systems, and other business applications… [and] includes software

engineering functions such as coding, integration testing, version control, and

development activities,” among other things. Supp. Protest at 5. Ares characterizes the

elements of task nine first as requiring operations and maintenance, which it argues

also exceeds the scope of the EITaaS BPA PWS under task nine for the same reasons

that Ares argued regarding task four, discussed above. Comments & 2d Supp. Protest

at 23. Regarding task ten, Ares argues that the LAAFB order provides for Vision to

support short-term projects that amounts to “developing and implementing new

requirements,” which the firm contends are also beyond the scope of the EITaaS BPA

PWS. Id. at 24.

The firm notes that the LAAFB order PWS describes task nine as including process

engineering, for which the PWS identifies three types: 1) maintenance, under which the

vendor modifies an existing software product to correct faults, to improve functionality,

or to adapt it to an environment; 2) enhancement, under which the vendor improves an

existing software product to meet a new requirement, including associated testing; and

3) development, under which the vendor programs, documents, tests software; that is,

to create a new software program. Comments & 2d Supp. Protest at 22 (citing AR,

Tab 8, LAAFB Order PWS at 41). Ares argues that the order thus requires more than

We address LAAFB order PWS tasks nine and ten together. The LAAFB order PWS

states that task nine involves “maintain[ing] and enhanc[ing] existing processes

identified in Appendix I” and then provides definitions of not just the terms maintenance

and enhancement, but also development. Task nine then states that “for development

of business processes, refer to [task ten] Short Term Projects paragraph 2.10.” AR,

Tab 8, LAAFB order PWS at 41. This connection between the tasks that the LSSFB

order PWS establishes simplifies our consideration of both tasks.

10

Page 14

B-424548 et al.

simply maintaining or enhancing the existing applications and business processes and,

at a minimum, provides for Vision to develop and implement new applications to

respond to new requirements. Ares notes that at least two such development

requirements are identified in appendix I to the PWS as requiring development: a CIPS

requirements tracker and a video teleconference/conference center service request

application. Id. at 23 (citing AR, Tab 8, LAAFB Order PWS at 102 (app. I, “Space

Systems Command Enterprise Information Systems Processes” table). The firm notes

that the order also states that short-term projects under task ten could include

“integrating tools,” “migrating the existing LAAFB network environment to another

mandated environment,” and “developing/implementing new business processes to

improve information management.” Id. at 24 (quoting AR, Tab 8, LAAFB Order PWS at

44). Ares argues that the requirement for Vision to develop applications and new

business processes under tasks nine and ten are not contemplated by the EITaaS BPA

PWS. Comments & 2d Supp. Protest at 23-25.

The contracting officer argues that the requirements under task nine fall within the

scope of engineering services under EITaaS BPA PWS 9, while the requirements of

task ten are within the scope of transition services under BPA PWS 11. COS

at 7, 16-17. The contracting officer contends that the requirements of the LAAFB order

do not include “development of new business processes, applications, or major

modifications of existing processes/applications.” COS at 16. Instead, the order

provides for Vision to manage and maintain an existing platform and to maintain and

enhance “existing applications and business processes” consistent with best practices.

Id. The actual requirements of the order are within the scope of EITaaS BPA PWS

enterprise services for the same reasons as explained regarding task six above, the

contracting officer contends, or at most are covered as supporting engineering services

described in EITaaS BPA PWS 9. Id.

In most respects Ares fails to show that LAAFB order PWS tasks nine and ten exceed

the scope of the EITaaS BPA PWS. As noted above, BPA PWS 7.1 includes enterprise

services that expressly include planning and management of enterprise information

technology, and Ares does not show that the order requirements for operating,

maintaining, and enhancing the agency’s existing platform, existing applications, and

business processes would exceed the scope of the BPA. However, the order PWS also

identifies “development” as one of the three elements of process engineering, it then

connects “development of business processes” to task 10, and it refers to the table in

appendix I that identifies a need for development of a CIPS requirements tracker and a

video teleconference/conference center service request application. AR, Tab 8, LAAFB

Order PWS at 41-42, 102 (PWS app. I, “Space Systems Command Enterprise

Information Systems Processes” table, lines 25, 30, 34). Whether arising under task

nine or ten of the LAAFB order, the EITaaS BPA PWS does not anticipate for services

in support of application development, which the order defines as “computer

programming, documenting, testing, and bug fixing involved in creating applications and

frameworks,” with the purpose of creating “a new software program” or a new version of

existing software reflecting “major changes.” AR Tab 8, LAAFB Order PWS at 42.

Page 15

B-424548 et al.

Neither does the EITaaS BPA PWS 9, engineering services, or PWS 11, transition

services, provide for the application development requirements to be included in the

LAAFB order as the agency argues. The EITaaS BPA PWS provides little express

limitation on engineering services, yet also states that engineering services include

three specific limited development steps of establishing a proof of concept, performing

prototyping, and deploying a pilot to limited users. While general language in BPA PWS

9 also describes engineering services as “providing support tasks not otherwise

defined” elsewhere in the PWS, we will not read such broad language as providing a

general exception to the scope of the BPA. See DynCorp Int’l LLC, B-402349,

Mar. 15, 2010, at 9 (sustaining protest that orders exceeded scope of contracts under

which they were issued; general statements in the contracts did not serve to expand

their scope beyond that anticipated during the competition). Regarding transition

services under BPA PWS 11, we likewise find no support for the contracting officer’s

contention that the BPA provision discussing the vendor’s role in transition from legacy

systems to the BPA vendors’ solution anticipates the vendor would develop new

applications or business processes under the label of a short-term project. 11 We

therefore sustain the protest with respect to the inclusion of development requirements

in the LAAFB order.

LAAFB order PWS 2.18 -- Task Eighteen: ConWrite Support

Ares contends that task 18 requires Vision to provide functional administration for

multiple contracting and procurement databases. Supp. Protest at 6. The firm

contends that such specialized support services are not within the scope of the EITaaS

BPA. Id.

The agency explained that the scope of task 18 involves contracting support software

(ConWrite). Vision’s work under the LAAFB order “entails patching and user access

The contracting officer contends that under the existing LAAFB order, Vision will only

perform planning for short-term projects scope under task ten. If the agency approves

of Vision’s plan, the contracting officer would implement the project by modifying the

LAAFB order. Although recognizing that the modification “would have to fall within the

scope of the LAAFB [order] and underlying EITaaS Wave 1 BPA PWS,” the contracting

officer contends the BPA “provides significant breadth for short term projects.” COS

at 18. We disagree because the scope of transition services in EITaaS BPA PWS 11 is

not so broad. Instead, the PWS provides for transformation of “end user services” from

legacy systems to the vendor’s solution. AR, Tab 3, EITaaS BPA PWS at 27. Contrary

to the contracting officer’s reading, the use of the term “end user services” (or EUS) is a

reference to the PWS background, where EUS was one of three lines of effort

established in 2018 through other transaction agreements. Id. at 5. The PWS further

explains that one of the six goals of the EITaaS BPA is to provide a transition,

specifically by “[c]eas[ing] the EUS [risk reduction effort] and transition[ing] eight bases

to Wave 1 Enterprise Services.” Id. at 7. The scope of transition services in BPA

PWS 11 is thus specifically related to EUS transition, not the broad scope depicted by

the contracting officer.

11

Page 16

B-424548 et al.

management of existing databases,” and asserts that the work constitutes ordinary

operations and maintenance. The agency also argues that task 18 properly includes

Vision supporting a potential future transition to a new centrally managed web-based

solution (CON-IT). COS at 18. The agency explains that it viewed this task as being

covered mainly under the enterprise services scope of the EITaaS BPA PWS. Id. at 19.

In its comments responding to the agency report, Ares briefly references its earlier

arguments regarding the scope of transition services, and states that the same

principles show that task 18 is beyond the scope of the EITaaS BPA. Comments & 2d

Supp. Protest at 25. These brief assertions fail to materially contest the substance of

the agency’s explanation supporting the inclusion of task 18. Accordingly, we deny the

Ares challenge to the inclusion of task 18 in the LAAFB order.

LAAFB order PWS 2.19 – Task Nineteen: Space Systems Command

Intelligence & Threat Analysis Support

Ares also argues that LAAFB order task 19 exceeds the scope of the EITaaS BPA PWS

because the scope of task 19 is “mission-network operations and cybersecurity

management services” that are not contemplated by the EITaaS BPA PWS. Supp.

Protest at 6. Ares contends that task 19 states that Vision will be appointed to hold

multiple significant roles for LAAFB -- specifically the Information Systems Security

Manager, the Information Systems Security Officer, and the System Administrator -- all

for the Air Force sensitive compartmented information network at LAAFB. Comments &

Supp. Protest at 25. Ares argues that the order PWS describes those roles as,

respectively, a lead governance role responsible for overseeing cybersecurity

compliance for LAAFB, a day-to-day manager of security functions, and the

administrative role charged with oversight of all tasks associated with ensuring the

sensitive compartmented information network at LAAFB is operational, accessible, and

complies with agency enterprise architecture. Id. These responsibilities are outside the

scope of the EITaaS BPA PWS, the firm argues. Id. at 26.

In response, the contracting officer asserts that the requirements in task 19 “fall

squarely” in the scope of the EITaaS BPA PWS requirements regarding cybersecurity

support under six elements of BPA PWS 7.3.1 and PWS 14 configuration management.

COS at 19.

Our review of the record does not support the contracting officer’s assertions that the

scope of task 19 is contemplated by the EITaaS BPA PWS. As discussed above with

respect to task 4, EITaaS BPA PWS 7.3.1, which is entitled “End User Device and Data

Protection,” provides for the vendor to ensure end user device protection. Under that

heading, the BPA PWS requirements that the contracting officer argues are relevant

include, for example, having the vendor’s system support monitoring and assessment of

end user devices, implementing and enabling the agency’s zero-trust architecture along

with the ability to isolate non-compliant endpoints, and automated threat detection and

remediation across end user devices, and protection of data in transit and at rest. See

AR, Tab 3, EITaaS BPA PWS at 19-24. As we concluded, above, with regard to LAAFB

order task 4, the scope of tasks under EITaaS BPA PWS 7.3.1 does not include the

Page 17

B-424548 et al.

governance, day-to-day network operations, and system administration roles in task 19.

Neither does the scope of EITaaS BPA PWS 14, configuration management, support

the agency’s position. As noted above, the scope of the configuration management

task area in the BPA PWS is a brief and general instruction for the vendor to ensure that

configuration management practices are followed by itself and all subcontractors

“across all aspects of the BPA,” and has no relationship to intelligence and threat

analysis support. Accordingly, the record shows that LAAFB task 19 exceeds the scope

of the EITaaS BPA PWS.

For the reasons discussed above, the LAAFB order exceeds the scope of the EITaaS

BPA with regard to task areas 4, 5, 6, 7, 19, and development requirements under tasks

9 and 10. The record demonstrates material differences between the requirements of

the LAAFB order and the EITaaS BPA. See Vetterra, LLC, B-417991 et al.,

Dec. 20, 2019, at 6. Therefore, the agency’s placement of the order under the BPA was

improper. We sustain the protest on that basis.

Comparison of Scope of LAAFB Order to Scope of Vision FSS Contract

Apart from whether the LAAFB order was within the scope of the EITaaS BPA, Ares

contends that the order is improper because it is outside the scope of Vision’s FSS

contract. Specifically, the protester argues that of the 40 labor categories on Vision’s

FSS contract, none provide labor categories necessary to perform many of the services

under the order. Protest at 9. The protester also contends that the agency explained

that it regarded the existence of the CTA led by CACI as making it unnecessary to

review the labor categories on Vision’s FSS contract specifically, in order to compare

them to the labor categories required under the LAAFB order. Rather, the agency

considered that by issuing the order to Vision, the existence of the CTA would make the

more extensive labor categories on the CTA members’ contracts (including CACI’s)

available. Supp. Protest at 8. Ares argues that this position is legally and factually

incorrect; that is, only one order was issued, which was to Vision and therefore was

under Vision’s FSS contract, and nothing indicates that CACI also received any portion

of the LAAFB order. Id. Further, in response to the agency’s proffer of a table listing 32

unique roles required by the LAAFB order, the labor categories in the EITaaS that could

fill those roles and, the FSS labor categories that would fulfill the skill and seniority

requirements of those EITaaS labor categories, Ares argues that none of the FSS labor

categories listed by the agency can be found on Vision’s FSS contract, although there

are similarities. 12 Comments & 2nd Supp. Protest at 4-7.

The agency argues that the LAAFB order is within the scope of Vision’s FSS contract

because a review shows a number of Vision’s labor categories that could meet the

requirements of the order. COS at 25. Additionally, the contracting officer maintains

Ares acknowledges that some of Vision’s labor categories are similar to those

identified by the agency, but points out that at no point has the agency attempted to

map the required labor categories to those on Vision’s FSS contract (or required Vision

to do so). Comments & 2nd Supp. Protest at 7.

12

Page 18

B-424548 et al.

that the EITaaS Wave 1 Ordering Guide permits the use of any CTA member’s labor

categories, not just the firm receiving the order, when it states that “prices for all labor

categories must be on CACI and/or CTA members[’] Schedule contract.” Id. As a

result, the agency contends there is no credible basis on which to argue that Vision

lacks the requisite labor categories to perform the LAAFB order. Id. at 26.

For its part, Vision argues that the factual premise of Ares’s argument is incorrect

because “Ares presumes that the [g]overnment is ordering from the labor categories on

Vision IT’s GSA Schedule.” Intervenor’s Comments at 7. Vision contends that Ares

lacks evidence that the agency failed to determine that the “function of [a] job category

listed in the [s]olicitation [wa]s sufficiently close to the service offered in the vendor’s

FSS contract,” and that an ordering agency is not required to determine that a vendor’s

FSS has the same “job titles and qualifications.” Id. (citing HomeSource Real Estate

Asset Servs., Inc. v. United States, 94 Fed. Cl. 466, 486–87 (2010)).

FSS delivery orders that are outside the scope of the underlying FSS or BPA are

subject to the general requirement for full and open competition. See Onix Networking

Corp., B-411841, Nov. 9, 2015, at 6-7. In determining whether a delivery order is

outside the scope of the underlying FSS contract, our Office considers whether there is

a material difference between the delivery order and the underlying BPA. Id. Where an

agency orders from an existing FSS, all items quoted and ordered are required to be on

the vendor’s schedule contract as a precondition to receiving an order. Science

Applications Int’l Corp., B-401773, Nov. 10, 2009, at 2.

Our review of the record shows that the agency lacks a factual basis for its conclusion

that the LAAFB order is within the scope of Vision’s FSS contract. While the agency

offers that it is possible that several of Vision’s labor categories could meet the

requirements, the agency and Vision both contend that an order issued to a CTA

member need not fall within the scope of that firm’s FSS contract, so long as it might fall

within the scope of another CTA member’s FSS contract. We disagree that existence of

a CTA relieves an agency of the requirement to order only those services that are within

the scope of the order recipient/CTA member’s FSS contract. That basic legal principle

is unchanged. As explained above, under a CTA, each team member is a prime

contractor and in privity of contract with the government with respect to its underlying

FSS contract. A CTA simply allows the agency to place orders with more than one CTA

member for a single requirement, but the agency indicates the LAAFB order was placed

with Vision.

Neither the agency nor Vision points to any basis in law or regulation to support the idea

that the rules requiring FSS contractors to operate within the scope of their FSS

contracts can effectively be ignored after the formation of a CTA. The agency merely

references the EITaaS Wave 1 ordering guide for the unremarkable notion that all labor

categories must be on CACI’s or a CTA member’s FSS contract. The agency, however,

does not indicate where the ordering guide says that a CTA member can perform labor

Page 19

B-424548 et al.

categories that are not on its own FSS contract. 13 Absent such support, we are

unwilling to adopt such a proposition because the conclusion is at odds with the very

notion that each team member is a prime contractor that has privity of contract with the

government. Since each team member is a prime contractor, it is axiomatic that the

terms of each contract must be the basis of that relationship, which necessarily includes

the requirement for the FSS contractor to operate within the scope of its contract. Here,

the agency has not shown that the LAAFB order is within the scope of Vision’s FSS

contract and, on the contrary, indicates that neither the agency nor Vision believed that

it had to do so, or in fact did so. Accordingly, we also sustain the protest on this basis.

RECOMMENDATION

During the protest, the agency notified our Office that the head of the contracting activity

had authorized continued performance under the LAAFB order as being in the

government’s best interests, as provided in 31 U.S.C. § 3554(b)(2). Under those

circumstances, we are to recommend relief “without regard to any cost or disruption

from terminating, recompeting, or reawarding the contract.” We therefore recommend

that the agency terminate the LAAFB order issued to Vision and issue a new solicitation

to meet its requirements consistent with the rules for full and open competition. We also

recommend that the agency reimburse Ares its costs of filing and pursuing the protest,

including reasonable attorneys’ fees. 4 C.F.R. § 21.8(d)(1). In accordance with

4 C.F.R. § 21.8(f)(1), the protester's certified claim for such costs, detailing the time

expended and costs incurred, must be submitted directly to the agency within 60 days

after receipt of this decision.

The protest is sustained.

Edda Emmanuelli Perez

General Counsel

In so noting, we express no view whether, if such language were to be added to the

ordering guide, it would control.

13

Page 20

B-424548 et al.