GAO Denies Protest Challenging SAM Registration

One of the first things a prospective government contractor (including a joint venture) must do to be eligible for an award is to create a business profile in the System for Award Management (or “SAM”). Before making an award, in fact, the contracting officer is obligated to verify the prospective contractor is registered in SAM.

Not only must a business be registered in SAM, but its registration should be up-to-date. It’s an enduring myth of government contracting that a business’s SAM profile only has to be updated annually. But as FAR 4.1201(b)(1) instructs, an offeror’s SAM profile has to be updated as necessary to ensure that it is “kept current, accurate, and complete.”

What happens if a prospective awardee fails to update its SAM profile? Can a disappointed bidder challenge the basis of the award? The answer, according to GAO, is “it depends.”

GAO recently considered the question of an outdated SAM profile in Cyber Protection Technologies, LLC, B-416297.2 et al. (July 30, 2018). That protest involved an Air Force procurement for cyber realization, integration, and operational support services. After conducting a best value tradeoff, the Air Force named Cyber Systems & Services Solutions (“CS3”)—a joint venture—as the awardee. Cyber Protection Technologies protested the award determination.

According to Cyber Protection, CS3 should have been found ineligible for award because its SAM profile did not disclose its status as a joint venture or otherwise identify its corporate parents. Because joint ventures are required to disclose this information in their SAM registrations, Cyber Protection argued that this deficient registration should have kept CS3 from being named the awardee.

Analyzing this argument, GAO noted that it “has generally recognized that minor informalities related to SAM (or its predecessor systems) registration generally do not undermine the validity of the award and are waivable by the agency without prejudice to the other offerors.” GAO will often not find competitive prejudice from an awardee’s deficient SAM registration because the registration status does not implicate the terms of its proposal “and there is nothing to suggest that another offeror would have altered its proposal to its competitive advantage in response to a relaxed SAM registration requirement.”

Under this standard, GAO denied Cyber Protection’s protest. Doing so, it noted that Cyber Protection did not establish any prejudice from CS3’s deficient registration: Cyber Protection “has not, for example, demonstrated that CS3’s SAM registration provided the intervenor with any competitive advantage, or explained how CPT would have amended its proposal had it known that the agency would not strictly enforce the SAM registration requirements.” In a nutshell, because Cyber Protection didn’t show any prejudice from CS3’s deficient registration, its protest was denied.

As Cyber Protection demonstrates, it is difficult for a protester to argue that a SAM registration problem should upend an evaluation decision. But don’t read GAO’s decision as giving contractors a free pass at having an outdated SAM profile—offerors are still required to keep their SAM profile current, accurate and complete. If a profile isn’t updated, a contracting officer might rely on the outdated profile to find an offeror ineligible for award.

In my opinion, the best practice is to simply do what the FAR requires: keep your SAM profile “current, accurate, and complete.”