441 G St. N.W.
Washington, DC 20548
Comptroller General
of the United States
Decision
Matter of: KARL STORZ Endoscopy-America, Inc.
File: B-419404; B-419404.2
Date: February 9, 2021
G. Matthew Koehl, Esq., Gary J. Campbell, Esq., and Lidiya Kurin, Esq., Womble Bond
Dickinson (US) LLP, for the protester.
Major Matthew W. Ramage-White, and Colonel Patricia S. Wiegman-Lenz, Department
of the Air Force, for the agency.
Kasia Dourney, Esq., and Evan C. Williams, Esq., Office of the General Counsel, GAO,
participated in the preparation of the decision.
DIGEST
Protest challenging the agency’s evaluation of the awardee’s quotation, including the
cybersecurity requirement, is denied where the evaluation was conducted in
accordance with the solicitation criteria.
DECISION
KARL STORZ Endoscopy-America, Inc. (Karl Storz), of El Segundo, California, protests
the award of a contract to Stryker Communications under request for quotations (RFQ)
No. FA8601-20-Q-0093, issued by the Department of the Air Force for an integrated
operating room (IOR) system at the Wright-Patterson Air Force Base medical center in
Ohio. Karl Storz argues that the agency’s evaluation of Stryker’s quotation was
unreasonable.
We deny the protest.
BACKGROUND
On May 4, 2020, the agency published a notice of intent to award a brand name
contract, announcing its intent to issue the requirement for an IOR solution as a brand
name justification under Federal Acquisition Regulation (FAR) part 13 for Stryker IOR
equipment. Agency Report (AR), Tab 3, Notice of Intent to Award a Brand Name
Contract at 3. The notice was based on the agency’s determination that only Stryker
was capable of providing the requirement, including replacement of surgical lights and
booms, video integration system, and monitors in eleven operating rooms at the
Wright-Patterson medical center. Id.; Contracting Officer’s Statement (COS) at 2.
DOCUMENT FOR PUBLIC RELEASE
The decision issued on the date below was subject to
a GAO Protective Order. This redacted version has
been approved for public release.
Page 2
B-419404; B-419404.2
On May 11, 2020, Karl Storz challenged the notice of intent with the agency, asserting
not only that it was capable of fulfilling the agency’s requirement, but also that Karl Storz
was “currently the only company” that had a conditional authority to operate
1
(ATO-C)
for a complete IOR solution sought by the agency. AR, Tab 4, Notice of Intent of Brand
Name Challenge at 1-2. Additionally, Karl Storz stated that Stryker did not have an
Based on the information provided by Karl Storz, the Air Force requested additional
information from Stryker concerning its system and its ATO status, and made a
preliminary determination that Stryker’s ATO was sufficient to meet the agency needs.
2
AR Tab 5, Stryker Email Exchange at 2; COS at 4. Subsequently, based on the
information provided by Karl Storz regarding its conditional ATO status, the agency
decided to remove the brand name requirement for Stryker equipment and solicit this
requirement on an unrestricted basis. COS at 4.
On July 14, 2020, the agency issued the RFQ under the simplified acquisition
procedures for commercial items set forth in FAR subparts 12.6 and 13.5. AR, Tab 12,
RFQ, Vendor Instructions at 1; COS at 4. The solicitation anticipated award of a fixed-
price contract, on a best-value tradeoff basis, considering the evaluation factors of
cybersecurity, technical capability, and price. AR, Tab 11, RFQ at 1, 4, 42; COS at 2, 4.
Vendors were instructed to submit quotations comprised of a narrative describing the
vendor’s project management approach as well as line item pricing for equipment,
integration, installation, and costs for at least one year of a full service standard warranty
As relevant to this protest, the RFQ stated that “
[c]ybersecurity will serve as a gate for
further evaluation,” and further provided that
:
1
An authority to operate (ATO)--sometimes called authorization to operate--is the
official management decision given by a senior organizational official to authorize
operation of an information system and to explicitly accept the risk to organizational
operations (including mission, functions, image, or reputation), organizational assets,
individuals, other organizations, and the nation based on the implementation of an
agreed-upon set of security controls. DATA Act: OMB and Treasury Have Issued
Additional Guidance and Have Improved Pilot Design but Implementation Challenges
Remain, GAO-17-156 at 28 n.37 (Dec. 2016) (citing the definition for ATO set forth in
National Institute of Standards and Technology Special Publication 800-37). Here, as
we discuss below, the requirement included critical medical equipment for operating
rooms which were to be connected to the hospital’s internet network and for which
vendors had to have an ATO certification. Memorandum of Law (MOL) at 2.
2
As the Air Force explains, after reviewing the information provided by Stryker, the
agency “determined that [its] ATO was sufficient as [DELETED] of the Stryker solution
eliminated the need for [DELETED] to have a separate ATO.” COS at 4.
Page 3
B-419404; B-419404.2
All vendors must have a valid ATO or ATO-C to obtain further
evaluation of their quote. Vendors’ quotes without an ATO or ATO-C
will not be further evaluated. Vendors must provide a copy of their
ATO certificate to demonstrate that they possess the ATO or ATO-C.
RFQ, Vendor Instructions at 2.
In addition, the solicitation required that the ATO be valid at the time of
connecting to the Department of Defense (DOD) network, in compliance with
applicable cybersecurity regulations, as follows:
the contractor shall not connect to the network without having obtained
permission from Defense Health Agency (DHA) for [an ATO or ATO-C] on
the DOD cyber network.
AR, Tab 18, RFQ, Statement of Objectives (SOO) at 5-6.
Vendors were instructed that to be compliant, their ATO had to be valid at the time of
“final delivery,” id., and that they “shall only quote items which already have an
Authorization to Connect (ATC).” AR, Tab 20, Vendor Requirements and Objectives
Questionnaire at 3.
In addition to the first ATO requirement, which was a gate criterion for further
evaluation, the RFQ had a second ATO requirement, related to technical capability,
which mandated that the proposed equipment was covered by ATO. Supp. MOL at 7
(citing RFQ, Vendor Instructions at 2; RFQ, SOO at 5-6).
The SOO described the minimum characteristics required for the equipment in each of
the operating rooms, including surgical lights and booms, monitors, and video
integration system. RFQ, SOO at 5-6. With respect to the
video integration system,
t
he SOO required it to
be fully interoperable in-suite and have the capability to
integrate, i.e., transmit images, with two central workstations
which could monitor all
operating rooms
.
AR, Tab 20, Vendor Requirements and Objectives Questionnaire
at 2; Decl. of Contracting Officer (CO) at 2.
Technical capability was to be evaluated on a pass/fail basis, based upon an
assessment of whether the vendor’s proposed solution met the
49 specific
requirements
outlined in the r
equirements and objectives questionnaire, and the SOO.
one of the stated requirements was that the proposed IOR equipment be covered by an
ATO. RFQ, Vendor Instructions at 2; RFQ, SOO at 5-6; AR, Tab 20, Vendor
Requirements and Objectives Questionnaire at 3.
3
3
After issuing the RFQ, on July 28, 2020, the agency arranged a site visit at the
Medical Center for vendors interested in the current procurement. COS at 5. During
Page 4
B-419404; B-419404.2
The agency received four quotations by the due date of August 21, 2020, including from
Karl Storz and Stryker. COS at 6. As relevant here, Karl Storz’s quotation did not
include proof that it possessed an ATO. AR, Tab 27, Karl Storz’s Submission at 6.
Instead, the protester provided an explanation that it “would be submitting documents to
DHA to receive an ATO-C,” and it provided a letter from DHA that granted a “6-month
Rapid ATO on date of signature” with conditions.
4
COS at 6.
Based on Karl Storz’s submission, on September 2, 2020, the agency asked the
company to clarify the status of its ATO or ATO-C. AR, Tab 29, Agency Interchange
with Karl Storz at 1. In response, the protester confirmed that it did not have a valid
ATO or ATO-C; rather, Karl Storz explained that it was in the process of obtaining an
extension of its ATO that expired in early August. AR, Tab 30, Karl Storz’s Interchange
Response at 1-2.
Subsequently, the agency made an inquiry to the relevant point of contact at DHA who
confirmed that Karl Storz’s rapid ATO had expired on August 5, 2020, and that the
company was still in the process of submitting an extension request. AR, Tab 31, DHA
Email regarding Karl Storz’s ATO at 1-2. Accordingly, the technical evaluation team
concluded that the protester’s quotation failed to meet the cybersecurity requirement to
have a valid ATO at the time of quotation submission, and excluded its quotation from
further consideration. AR, Tab 33, Karl Storz Technical Evaluation at 1.
In contrast, Stryker’s quotation included a valid ATO for “Stryker [DELETED] Operating
Room System,” that was granted on June 6, 2019, for an 18 month period. AR, Tab 28,
Stryker ATO Certificate at 1. To address Karl Storz’s earlier allegations that Stryker did
not have a valid qualifying ATO, the technical evaluation team contacted an individual
who was responsible for approving installation and network connectivity at Wright-
Patterson Air Force Base, and requested that this individual review the items included in
Stryker’s quotation. AR, Tab 37, Technical Team ATO Confirmation Email at 1.
In responding to this request, the approving official did not identify any issues with
connectivity or installation of Stryker’s proposed equipment. Id. Additionally, the
technical team confirmed the status of Stryker’s ATO in DHA’s tracking and reporting
system for ATOs, the Consolidated System Tracking & Reporting (CSTAR). COS at 7.
After evaluating Stryker’s quotation and receiving confirmation from both the Wright-
Patterson approving officials and DHA, the technical evaluation team concluded that
Stryker’s quotation met the RFQ’s cybersecurity requirements. AR, Tab 34, Stryker
the visit, which was attended by Karl Storz’s representatives, the Air Force reiterated
the importance of the ATO or ATO-C requirement. Id. Karl Storz’s representatives did
not ask any questions about the ATO requirement during the visit. Id.
4
The letter provided by Karl Storz was undated and unsigned. AR, Tab 27, Karl Storz’s
Submission at 8-9.
Page 5
B-419404; B-419404.2
Technical Evaluation at 1 (concluding that the quotation “meets” all the 49 minimum
requirements identified in the Vendor Requirements and Objectives Questionnaire).
Further, after evaluating Stryker’s price quotation, on October 22, 2020, the agency
awarded the contract to Stryker.
5
This protest followed.
DISCUSSION
The protester challenges the agency’s determination that Stryker met the ATO
requirements, as established by the solicitation. Protest at 14. In this regard, Karl Storz
alleges that the awardee’s ATO was limited in scope and only covered part of its quoted
IOR system--i.e., the room to room solution component--but it did not include the
in-room routing system, as it was required under the RFQ.
6
Id. at 5. In its supplemental
protest, Karl Storz also alleges that the agency conducted only cursory evaluation of
Stryker’s ability to meet the ATO requirements under the RFQ, which the agency then
failed to properly document. Comments and Supp. Protest at 7-9.
In response, the agency contends that it diligently reviewed Stryker’s quotation,
including its ATO certification, and properly concluded that it complied with the RFQ’s
cybersecurity requirements. Furthermore, the contracting officer explains that the Air
Force confirmed multiple times that Stryker’s ATO was sufficient to allow installation and
operation of all items included in its quotation. COS at 8.
5
Karl Storz alleges that it is an interested party to challenge the award because the
other two vendors who submitted quotations in response to the solicitation were also
eliminated for lacking a valid ATO and the awardee was the only vendor who submitted
an ATO with its quotation. Protest at 14 (citing Decl. of Karl Storz’s Director of U.S.
Enterprise Sales at ¶ 7). The agency does not dispute this assertion. Accordingly, we
technical acceptability of the awardee’s quotation. See Greystones Consulting Group,
Inc., B-402835, June 28, 2010, 2010 CPD ¶ 159 at 2 n.2. (“The awardee was
determined to be the only eligible offeror that had submitted an acceptable proposal,
and, if the protest were sustained, the agency would be faced with resoliciting the
requirement. Because the protester would be eligible to compete on such a
resolicitation, it is an interested party, notwithstanding the fact that its proposal was
evaluated as unacceptable.”).
6
In support of this contention, Karl Storz alleges that it is “the only company that has [a]
complete ATO (renewal pending) for the entire IOR solution, including in room routing,
capture, storage, streaming, and overview” required under the RFQ. Protest at 5
(emphasis in original).
Page 6
B-419404; B-419404.2
For the reasons discussed below, we conclude that the Air Force reasonably found that
Stryker’s quotation met the solicitation’s ATO requirements, and therefore find no basis
to sustain the protest.
7
As noted above, the Air Force conducted this procurement using simplified acquisition
procedures for commercial items. Simplified acquisition procedures are designed,
among other things, to reduce administrative costs, promote efficiency and economy in
contracting, and avoid unnecessary burdens for agencies and contractors. FAR 13.002.
When using these procedures, an agency must conduct the procurement consistent
with a concern for fair and equitable competition and must evaluate quotations in
accordance with the terms of the solicitation. ERIE Strayer Co., B-406131, Feb. 21,
2012, 2012 CPD ¶ 101 at 4.
In reviewing protests of an allegedly improper simplified acquisition evaluation, our
Office examines the record to determine whether the agency met this standard and
executed its discretion reasonably. Computers Universal, Inc., B-297552, Feb. 14,
2006, 2006 CPD ¶ 42 at 4-5. A vendor’s disagreement with an agency’s evaluation, by
itself, is not sufficient to sustain the protest. DeWitt and Co., Inc., B-417194, Mar. 25,
2019, 2019 CPD ¶ 126 at 3.
The RFQ here included two ATO requirements, which were both to be evaluated on a
pass/fail basis. Supp. MOL at 7 (citing RFQ, Vendor Instructions at 2; RFQ, SOO
at 5-6). The first requirement, which was a gate criterion for further evaluation, included
a proof of a valid ATO. RFQ, Vendor Instructions at 2. The second requirement, which
was to be evaluated under the technical capability factor, provided for the assessment
of the vendor’s proposed IOR equipment, including a requirement that the vendor’s
quoted items be covered by an ATO. RFQ, SOO at 5-6. As related to this second
requirement, the ATO was one of the 49 specific requirements that vendors’ quotations
had to satisfy, and was also evaluated on a pass/fail basis. Id.; AR, Tab 20, Vendor
Requirements and Objectives Questionnaire at 3 (stating that “[v]endors shall only
quote items which already have an Authorization to Connect (ATC).”).
As stated above, Stryker provided a valid ATO for its “[DELETED] Operating Room
System,” the validity and currency of which the agency verified in DHA’s tracking and
reporting database for ATOs, CSTAR. AR, Tab 28, Stryker ATO Certificate at 1; COS
at 7. Afterwards, the agency reviewed Stryker’s quotation to determine if it complied
with the technical capability requirements related to ATOs. Decl. of CO at 2-3. The
technical evaluation team concluded that Stryker’s quoted IOR system equipment met
all the 49 specific technical requirements, including the ATO. AR, Tab 34, Stryker
Technical Evaluation at 1.
7
Karl Storz has presented arguments that are in addition to, or variations of, those
discussed in this decision. We have considered all of the protester’s allegations and
find no basis to sustain the protest.
Page 7
B-419404; B-419404.2
The record shows that while the technical team was conducting its review of Stryker’s
quotation, the agency asked the personnel responsible for approving IOR installation
and network connectivity at Wright-Patterson Air Force Base to review Stryker’s
quotation. AR, Tab 37, Technical Team ATO Confirmation Email at 1. In response to
this inquiry, the approving official did not identify any issues with connectivity or
installation of the equipment quoted by Stryker. Id.
Karl Storz contends that the Air Force failed to confirm “whether the official fully
appreciated the scope of the [ATO] requirements under the RFQ,” and whether he fully
considered the scope of Stryker’s ATO. Comments and Supp. Protest at 8.
In response to a request from our Office for additional briefing concerning the evaluation
of the scope of Stryker’s ATO, the contracting officer states that the agency, and the
approving official at Wright-Patterson “did not find any . . . limitation on the Stryker ATO
[, as the protester asserts,] during its evaluation and review.” Decl. of CO at 2. The
contracting officer further explains that the approving official confirmed that “the ATO
associated with the Stryker quote was sufficient to cover all quoted items,” including
items “enabling in-room transmission and items enabling room to central workstation
transmission.” Id. at 3. Relying on these findings, the contracting officer states that “the
technical evaluation team found [Stryker] quote met both the cybersecurity and
technical requirements” because its IOR system was “capable of transmitting and
viewing images between specified devices within a single operating room and
transmitting images from each operating room to two central workstations,” and had “an
ATO which authorized installation of all of the quoted items and systems enabling both
in-room transmission and room to workstation transmission.” Id.
Based on our review of the record, we find nothing unreasonable regarding the
agency’s evaluation of Stryker’s quotation. As described above, the agency provided
our Office with an explanation of its efforts to confirm that Stryker possessed a valid
ATO that covered its quoted items. Id. at 2-3. The agency’s chosen method of verifying
Stryker’s ATO, on its face, appears reasonable and unobjectionable. Id.; COS at 7. On
this point, we note that the RFQ did not specify in detail how the agency would evaluate
whether an ATO was compliant; rather, the RFQ broadly stated that the agency would
determine on a pass/fail basis whether a vendor possessed an ATO for its quoted
items. RFQ, Vendor Instructions at 2; RFQ, SOO at 5-6; AR, Tab 20, Vendor
Requirements and Objectives Questionnaire at 3.
Further, the protester has not established that the agency’s conclusion is flawed. Other
than offering a declaration from a Karl Storz employee which asserts that Stryker’s ATO
does not in fact cover all of its IOR solution, the protester provides our Office with no
basis to question the agency’s finding with respect to Stryker’s ATO. Protest at 14-15;
Comments and Supp. Protest at 1-6. Thus, although Karl Storz generally disagrees
with the Air Force’s assessment of the scope of Stryker’s ATO, the protester’s
disagreement with the agency’s evaluation, without more, fails to render the agency’s
Page 8
B-419404; B-419404.2
evaluation unreasonable or provide a basis to sustain the protest.
8
See DeWitt and
Co., Inc., supra.
Karl Storz also contends that the Air Force failed to adequately document its evaluation
and conclusion regarding the scope of Stryker’s ATO. Comments and Supp. Protest
at 7-9. In response, the agency asserts that its documentation was adequate and
appropriate for this solicitation. Supp. MOL at 10-11. The Air Force argues that the
cases cited by the protester in support are inapposite, as they involved “neither pass/fail
evaluations nor simplified acquisitions.” Id.
In procurements for commercial items conducted under simplified acquisition
procedures, such as this one, limited documentation of the source selection is
permissible, as long as the agency provides a sufficient record to show that the source
selection was reasonable. FAR 13.303-5(e). Although we generally give little weight to
reevaluations and judgments prepared in the heat of the adversarial process, see
Boeing Sikorsky Aircraft Support, B-277263.2, B-277263.3, Sept. 29, 1997, 97-2 CPD
¶ 91 at 15, post-protest explanations that provide a detailed rationale for an agency’s
contemporaneous conclusions and simply fill in previously unrecorded details will
generally be considered in our review of the rationality of selection decisions, if those
explanations are credible and consistent with the contemporaneous record. McLaurin
Gen. Maint., Inc., B-411443.2, B-411443.3, Jan. 14, 2016, 2016 CPD ¶ 41 at 6.
Here, we find that the contracting officer’s explanation is credible and consistent with
the contemporaneous record. Accordingly, while we agree with the protester that the
contemporaneous record here may be limited, based on our review of the record and
the agency’s explanation, we find the record sufficient to show that the agency’s source
selection was reasonable. As a result, we find no basis to question the agency’s
8
The protester also contends that the solicitation contained a latent ambiguity with
respect to the ATO requirements. Protest at 15-17. As support, Karl Storz identifies a
conflict between the solicitation’s requirement that all items quoted by a vendor must be
covered by an ATO and an argument made by agency counsel that the RFQ only
required an ATO for those items that actually connect and operate on a network.
An ambiguity exists when two or more reasonable interpretations of the terms or
specifications of the solicitation are possible. See DocMagic, Inc., B-415702,
B-415702.2, Feb. 16, 2018, 2018 CPD ¶ 96 at 3. Here, other than the argument made
by agency counsel in response to the protest, it does not appear that the parties hold
differing interpretations of the solicitation. That is, our review of the parties’ filings and
the record as a whole shows that both parties interpret the RFQ as requiring all of a
vendor’s quoted items to be covered by an ATO. Hence, we conclude that no such
ambiguity exists and deny this protest ground.
Page 9
B-419404; B-419404.2
evaluation of Stryker’s quotation, and deny this protest ground. McLaurin Gen. Maint.,
Inc., supra.
The protest is denied.
Thomas H. Armstrong
General Counsel
