BLOG POST

Morgan Lewis Government Contractor Guidebook

YOUR GUIDE TO THE ISSUES THAT MATTER TO GOVERNMENT CONTRACTORS

OTA Bid Protests, Cybersecurity FCA Enforcement, and SBA Audits

GovCon Update

Recent developments in government contracting include a Court of Federal Claims decision expanding bid protest jurisdiction over certain other transaction (OT) agreements, a $13 million cybersecurity-related False Claims Act settlement, and a federal audit of contracts involving hundreds of firms suspended from the Small Business Administration’s 8(a) Business Development Program. Together, these developments highlight evolving judicial oversight of alternative acquisition methods and continued enforcement attention on contractor cybersecurity and small business program compliance.

COFC Confirms Protest Jurisdiction over Navy Prototype OT Competition

While OT agreements generally have not been subject to traditional bid protest jurisdiction at the Government Accountability Office or Court of Federal Claims (COFC), on October 29 the court rejected the government’s attempt to dismiss protests challenging the Navy’s down-selection for a prototype OT agreement involving medium unmanned surface vessels.

In Blue Water Autonomy, Inc. v. United States, the court held that the competition fell within its bid protest jurisdiction because it was “in connection with” a procurement. The Navy had structured the prototype competition as a direct path to production, making successful participation a prerequisite for receiving follow-on production work. The court concluded that invoking OT authority did not place the competition beyond judicial review.

The decision expressly declined to follow the approach taken in Telesto Group, which withheld protest jurisdiction during prototyping until the agency decided to acquire the successful prototype. Instead, the court focused on the acquisition’s purpose and the role of the prototype competition in the broader procurement process.

The holding is not unlimited—the court distinguished OTs intended to fund research or stimulate a commercial market without acquiring something for the government’s own use. The disagreement among COFC decisions, together with the absence of controlling Federal Circuit guidance, leaves room for further appellate clarification.

The practical implications are already apparent. In a separate merits opinion released on November 3, the court denied Blue Water’s protest but sustained Saildrone’s, ordered a 60-day reevaluation, and restricted certain production obligations pending that process.

For contractors, the decision reinforces that OT agreements remain flexible acquisition vehicles but are not necessarily insulated from bid protest review, particularly where prototype competitions are directly connected to follow-on production opportunities.

Cybersecurity Allegations Lead to $13 Million FCA Settlement

Also on November 3, the US Department of Justice announced that ILC Dover and ILC Astrospace had agreed to pay $13 million to resolve False Claims Act allegations involving cybersecurity requirements under Army, Missile Defense Agency, and NASA contracts.

The government alleged that the companies knowingly submitted claims while failing to satisfy contractual cybersecurity requirements between 2018 and 2024. The settlement resolves allegations only, without a determination of liability.

The alleged deficiencies extended beyond unimplemented technical controls: DOJ identified inadequate system security plans, remediation plans, and cybersecurity assessments as well as the use of a third-party cloud provider without ensuring compliance with FedRAMP Moderate–equivalent requirements and related incident-response obligations. The whistleblower, a former cybersecurity director for both companies, will receive $2.35 million.

The settlement reinforces the importance of treating cybersecurity documentation and vendor oversight as substantive compliance obligations. Contractors should ensure that cybersecurity assessments and representations accurately reflect actual system configurations, remediation efforts, and cloud-provider commitments.

The case also illustrates how cybersecurity compliance challenges can become FCA enforcement matters rather than remaining internal information security issues, particularly where contractors make representations concerning compliance with federal contractual requirements.

GSA Audits Contracts Held by 689 Suspended 8(a) Firms

On October 21, the General Services Administration and Small Business Administration announced that federal contracts involving 689 firms suspended from the 8(a) Business Development Program are being audited for potential fraud.

According to the agencies, the firms had not demonstrated program compliance but had received contracts with a collective ceiling of $5.5 billion. GSA will examine those contracts and refer suspected fraud to its Office of Inspector General and DOJ.

Importantly, the announcement does not establish that every suspended firm committed fraud, and the $5.5 billion figure represents contract ceilings rather than a determination of government losses.

Nevertheless, the initiative illustrates how a program eligibility issue can trigger a broader examination of a contractor’s existing federal contract portfolio.

For 8(a) participants and their teaming partners, the announcement warrants a review of program status, eligibility submissions, and supporting financial records. Companies should also preserve documentation supporting representations made when pursuing and performing affected contracts.

The immediate concern is not simply whether a firm remains eligible for future awards, but whether its existing contract portfolio can withstand scrutiny. More broadly, the audit reinforces the administration’s continued focus on fraud prevention and program integrity within SBA contracting programs.

Looking Ahead

These latest developments illustrate the expanding scope of judicial review and compliance oversight in federal contracting:

  • Contractors pursuing OT agreements should consider how the structure and purpose of prototype competitions may affect protest rights.
  • Companies handling sensitive government information should continue evaluating cybersecurity controls, documentation, and third-party compliance.
  • Small businesses participating in SBA programs, along with their teaming partners, should ensure that eligibility representations and supporting records remain accurate as agencies increase scrutiny of existing contract portfolios.