In an important new decision, InfoPoint LLC, B-419856, Aug. 27, 2021, the Government Accountability Office (GAO) has sustained a protest against a Department of Defense (DOD) agency that insisted that small business joint venture offerors themselves were required satisfy a solicitation’s Facility Security Clearance requirements. The GAO found that the agency’s refusal to accept Facility Security Clearances from a small business joint venture’s constituent members (rather than the joint venture itself) violated statute and governing regulations of the Small Business Administration (SBA).
Background
To promote small business growth, the SBA allows small businesses to form joint ventures with other companies (subject to strict regulations) and compete for small business set-aside procurements that a small business by itself might have difficulty winning. Historically, however, small business joint ventures faced obstacles in competitions that required “the offeror” to hold a Facility Security Clearance as a condition of award. Because small business joint ventures must be unpopulated (meaning they ordinarily have no employees of their own), and generally have a short lifetime, most small business joint ventures do not have their own Facility Security Clearances, and thus were barred from many awards. This was so, even if the joint venture’s constituent members all had the requisite clearances.
To remedy this problem, Congress included the following provision in the National Defense Authorization Act for Fiscal Year 2020 (2020 NDAA):
TERMINATION OF REQUIREMENT FOR DEPARTMENT OF DEFENSE FACILITY ACCESS CLEARANCES FOR JOINT VENTURES COMPOSED OF PREVIOUSLY-CLEARED ENTITIES. A clearance for access to a Department of Defense installation or facility may not be required for a joint venture if that joint venture is composed entirely of entities that are currently cleared for access to such installation or facility.
Pub. L. No. 116-92 § 1629; 133 Stat. 1198, 1741 (2019) (emphasis added).
The SBA, for its part, promulgated the following regulation governing the requirements for small business joint ventures:
Facility security clearances. A joint venture may be awarded a contract requiring a facility security clearance where either the joint venture itself or the individual partner(s) to the joint venture that will perform the necessary security work has (have) a facility security clearance.
(i) Where a facility security clearance is required to perform primary and vital requirements of a contract, the lead small business partner to the joint venture must possess the required facility security clearance.
(ii) Where the security portion of the contract requiring a facility security clearance is ancillary to the principal purpose of the procurement, the partner to the joint venture that will perform that work must possess the required facility security clearance.
13 C.F.R. § 121.103(h)(4). This regulation went into effect on November 16, 2020. Whereas the 2020 NDAA prohibits DOD from requiring a joint venture to hold a facility security clearance in its own name where all its constituent member companies possess the requisite clearances, the SBA regulation (which applies only to small business joint ventures) prohibits any agency from doing so and describes particular scenarios in which a joint venture may be eligible for award even if all of its constituent members do not have facility security clearances.
After the promulgation of this regulation, DOD took the position that SBA lacked the authority to regulate DOD’s security clearance processes and that DOD components would not follow the new regulation.
The Solicitation and Protest
On April 22, 2021, the Air Force issued a task order solicitation to small business holders of the OASIS contract. Among the solicitation’s terms was a requirement that, at the time of proposal submission, the “Offeror” must have a valid facility security clearance at the requisite level. In response to questions, the Air Force specified that the offeror as a legal entity must itself hold the clearance, even if it was an unpopulated joint venture, and “[t]he individual partners to the [joint venture] having the [facility clearance] is not sufficient.” In response to a question specifically citing the new SBA regulations on facility security clearances, the Air Force replied that it would disregard the SBA regulation. Instead, it would leave the solicitation unchanged, consistent with pre-existing DOD guidance, and require the legal entity that is “the Offeror” to possess the requisite facility security clearance.
Prior to the date set for receipt of proposals, InfoPoint filed a timely pre-award protest, challenging the terms of the task order solicitation. The protester argued the solicitation violated 13 C.F.R. § 121.103(h)(4) because it did not permit the individual members of a joint venture offeror to use their own clearances to satisfy the facility security clearance requirements. The SBA filed its own brief in the bid protest, taking the side of the protester and arguing that the Air Force solicitation’s restrictions were improper. After denying an Air Force request for summary dismissal of the protest, the GAO tackled the merits of InfoPoint’s argument.
Analysis
On the merits, the Air Force argued that none of the protester’s cited statutory and regulatory authorities prohibited the agency from requiring a joint venture offeror to hold a facility security clearance itself. In the alternative, the Air Force argued that DOD regulations took precedence over SBA regulations when it comes to security matters.
The GAO began with a consideration of the statutory and regulatory provisions quoted above, as well as the following section of the Small Business Act:
JOINT VENTURES.—When evaluating an offer of a joint venture of small business concerns, if the joint venture does not demonstrate sufficient capabilities or past performance to be considered for award of a contract opportunity, the head of the agency shall consider the capabilities and past performance of each member of the joint venture as the capabilities and past performance of the joint venture.
15 U.S.C. § 644(e)(4)(B)(ii). The GAO noted that SBA’s recent promulgation of 13 C.F.R. § 121.103(h)(4) sought to implement the 2020 NDAA’s security clearance provisions and the above section of the Small Business Act. The GAO found the new SBA regulation to be consistent with each statutory provision and a reasonable implementation of both. Thus, 13 C.F.R. § 121.103(h)(4) was presumptively valid, and its terms plainly prohibited agencies from requiring small business joint venture offerors from possessing facility security clearances, as long as their constituent members did.
The Air Force raised four defenses. First, it argued the 2020 NDAA was inapplicable because DOD had not yet issued regulations to implement it. The GAO rejected this argument, finding that this part of the 2020 NDAA was self-implementing, without any need or requirement for further implementing regulations from DOD: “Rather, it is an unambiguous command by Congress through a statute that DOD not require joint ventures to hold a facility clearance where the members of the joint venture hold the required facility clearances.”
Second, the Air Force pointed to the verb “may” in the operative language of the SBA regulation: “A joint venture may be awarded a contract requiring a facility security clearance where either the joint venture itself or the individual partner(s) to the joint venture that will perform the necessary security work has (have) a facility security clearance.” (Emphasis added.) Because the regulation says “may” rather than “must,” the Air Force argued the regulation was optional rather than mandatory. SBA responded that, here, “may” addresses the eligibility of the joint venture for award, not whether the regulation itself is optional. The GAO agreed that the SBA’s interpretation of its own regulation was reasonable and properly addressed eligibility for award.
Third, the Air Force argued that other statutory authorities governing national security rendered the solicitation’s challenged provision reasonable. Because Congress delegated security clearance matters to the Executive Branch, which in turn formalized its guidance by publishing the National Industrial Security Program Operating Manual (NISPOM) into regulation, effective as of February 24, 2021, and NISPOM requires a joint venture itself to hold a facility security clearance, the Air Force argued that the GAO should defer to DOD’s interpretation of the 2020 NDAA rather than SBA’s. The GAO rejected this argument, too. As the Air Force previously conceded, DOD has not yet promulgated regulations implementing the 2020 NDAA. Thus, NISPOM’s incorporation of pre-existing guidance on joint ventures is not an implementation of the 2020 NDAA, which plainly says the opposite of the outdated language contained in the NISPOM.
Finally, the Air Force argued that interpreting the 2020 NDAA to prohibit DOD agencies from requiring joint ventures to hold clearances would create a conflict because civilian agencies, which are not subject to these NDAA provisions, could continue to do so. The GAO found this argument, while hypothetically interesting, was irrelevant to this protest, which concerned an Air Force solicitation. The GAO also rejected the Air Force’s argument that the 2020 NDAA cannot mean what the protester and the SBA said it means, because there are contrary DOD regulations and policies: “The fact that the statute conflicts with what the agency contends are existing regulations does not provide a basis to avoid the requirement to follow the plain language of the statute.” Under American law, after all, statutes trump regulations.
On this basis, the GAO held that the 2020 NDAA “clearly and unambiguously prohibits DOD agencies, like the Air Force here, from issuing solicitations that require a joint venture, rather than the members of the joint venture, hold the required facility clearance.” The GAO also agreed with the protester that 13 C.F.R. § 121.103(h)(4) reasonably implements the 2020 NDAA’s requirements and rendered the solicitation terms at issue here unreasonable and contrary to law. Therefore the GAO recommended the Air Force remove the requirement for a joint venture itself to hold a facility clearance, as long as the joint venture’s constituent members do.
Takeaway: Small businesses will welcome the GAO’s decision. The DOD, not so much. It remains to be seen whether the Air Force will implement the GAO’s recommendation. By statute, the GAO must notify Congress whenever a procuring agency refuses to implement fully a GAO recommendation in a bid protest, which incentivizes agencies to comply with GAO recommendations. That incentive might be particularly strong here, where the GAO’s recommendation hinges on a clear and unambiguous command from Congress. On the other hand, the DOD is traditionally very protective of its security-related prerogatives and may want to take a stand. Because this was a task order procurement, the protester will not be able to take its protest to the Court of Federal Claims if the Air Force refuses to do as the GAO says. That leaves the fear of Congress – and the GAO’s moral authority – as the only stick to make the Air Force obey.