Small businesses selling cloud services at risk under new SBA rule

Call it the law of unintended consequences but a new acquisition regulation that went into effective June 30 just might knock small businesses out of the business of reselling cloud services.

In the 2013 National Defense Authorization Act, Congress made what on the surface is a minor tweak to requirements limiting subcontracting on set aside contracts.

Under the old law, the small business prime or a small business subcontractor had to perform more than 50 percent of the work under a set aside contract.

But with the 2013 NDAA, the language was changed from labor to the price of the contract.

The idea has always been a noble one – restrict subcontracting so that small businesses aren’t used as fronts for large businesses. The government wants to avoid small business winning a contract only to have a large business subcontractor do the bulk of the work and reap the bulk of the revenue.

But this change from labor to price might have significant ramifications for companies reselling cloud services.

As one source told me, cloud services can represent the bulk of the value of a contract, sometimes as much as 90 percent or more.

Under the new SBA rule, a small business would have to double the cost of the cloud services in order to stay in compliance. In other words, if it is a contract that has $100,000 of cloud services to be provided, the small business would have to charge the government at least $200,000 to comply with the SBA rule.

If they don’t comply, they face a $500,000 penalty.

To complicate matters even more, many small businesses that have cloud services as part of their GSA schedule generally only add a 7 percent margin to the cost of the services, according to my source.

So now, the dilemma they face is they have to charge significantly more than their GSA schedule price to avoid the penalty under the new SBA rule. But if they do that, they are exposed to the risk of a False Claims Act lawsuit because they are charging significantly more than the price on the GSA schedule.

No matter what they do, it appears that small businesses trying to sell cloud services through a set aside contract are going to violate one rule or the other.

This issue came to my attention via a bid protest decision involving a Bureau of Prisons contract for cloud services.

It was a set aside contract and the bureau wanted a small business that could sell it cloud services from Amazon Web Services. The solicitation was protested by InfoReliance, a large business. No award had been made yet.

InfoReliance argued that the bureau was going to award a contract to small business that would be unable to comply with the new regulation.

Because no small business can comply with the law, the agency violated the rule of two and couldn’t reasonably say it found two or more qualified small businesses.

The agency also would not be able to find small businesses “responsible” because they’d be unable to comply with the new regulations.

The Government Accountability Office shot InfoReliance down on the rule of two argument because this set aside contract was being run through the schedules and the rule of two doesn’t apply. GSA backed this up as well in a letter responding to questions from GAO.

Under Federal Acquisition Regulations, the government can set aside a schedule order without determining if two or more small businesses can provide the work. So, no rule of two analyses is necessary, even though the Bureau of Prisons conducted one.

As part of their investigation, GAO also reached out to SBA, and it is in that letter that the subcontracting issue gets explored more fully. (SBA provided a copy of their letter to me.)

SBA agrees with GAO and GSA that the rule of two doesn’t apply for this contract because regulations don’t require it.

But here is where it gets interesting. SBA said that if the rule of two were required, the bureau would not be able to satisfy the rule “because the solicitation requires that the contract be subcontracted almost entirely to AWS and therefore does not allow a small business awardee to comply with the limitations on subcontracting,” SBA wrote.

In other words, SBA agrees with InfoReliance’s argument in the protest.

SBA recommended that the agency restructure the solicitation so it isn’t a set aside contract. The Bureau of Prisons can target a small business prime under a different part of the FAR and the limitation on subcontracting wouldn’t apply, they said.

The Bureau of Prisons may be doing that. The agency hasn’t responded to a request for comment, and I can’t find evidence of an award being made yet.

Given SBA’s comments, it struck me as odd that GAO didn’t rule in InfoReliance’s favor. But it appears that GAO has ruled in this and previous cases that contracting officers have wide discretion to set aside schedule orders for small businesses.

There was apparently no violation of any law or regulation by setting aside this schedule order.

As for the limitations on subcontracting regulations, GAO said InfoReliance “put the cart before the proverbial horse.” The determination of whether a small business can comply with the subcontracting limitation is made as part of the award decision.

Apparently, the Bureau of Prisons hadn’t gotten that far when InfoReliance filed their protest.

In the meantime, what are small businesses who want to resell cloud services to do?

I don’t know. According to a source I have at Amazon Web Services, I know they are aware of the issue. But I received no response from AWS when I reached out for an official comment.

This regulation is very new, so it likely will take some more time before all of the ramifications come to light. Perhaps there is a simple work around as SBA suggested. We’ll just have to wait and see.