Some of you may have noticed that GSA is updating SAM.gov as part of a plan to move away from Dun and Bradstreet’s redoubtable DUNS number to its own unique identifier.  You may also have noticed that that transition has gone poorly.

We’ve been impacted by this transition both as a government contractor and as a representative of our clients, most of whom are government contractors.  It is important that everyone be aware of what is going on so they can take steps to protect themselves and anticipate such failures in the future.

Background: Why is this happening

GSA claims that it disrupted decades of dependability with Dun and Bradstreet to “make it easier and less burdensome for entities to do business with the federal government.”  If that is its goal, GSA has certainly failed.  But why is this unique number so critical?

To do business with the federal government, contractors must register in SAM.gov.  The System for Award Management is the central portal for entities seeking to register to do business with the government, search for entities and exclusion records, search for other key information, and perform a grab bag of other related tasks.  In short, organizations cannot be paid by the government, compete for contracts, or seek grants without registration.

Registration requires the submission of a significant amount of information, which GSA validates against several sources.  These include the home state corporate registry, the IRS, DLA, and GSA’s internal database.  Until April, GSA looked to the DUNS registry to confirm a unique corporate identifier.  Also, until April, the normal differences in business names across these myriad sources did not matter.  After April, however, when GSA moved to its own system, small differences created catastrophic consequences.  As an example, a difference in a comma between the proper name and business type is sufficient to prevent registration.

A number of contractors have landed in help desk purgatory.  Slight deviations in names require that the contractors avail themselves to GSA’s helpdesk, which is less than helpful.  Most aspects of the process are outside of the helpdesk’s visibility or ability to affect, leaving them in a position to tell contractors that they must be patient.  Organizations must then reach out to an already overburdened ombudsman within GSA or outside of GSA altogether, including Congress.

The SAM.gov issue is not an isolated incident.  The websites that GSA manages are a confused mess.  Some modifications to the contractors’ GSA Schedule come through the eMod system, while others come through different systems.  Contractors must upload duplicate information through different programs, leading to conflicting information as to offerings.  GSA’s program to upload catalogs, SIP, looks more at home in the 1990s.  Each of these failings create difficulties for government contractors.

Consequences: What does this mean

Rather than addressing the significant problems with GSA’s websites, GSA decided to tinker with a system that worked (and was run by a private company).  As a result, government contractors are left unpaid for work done and unable to compete for new work.  Some organizations may go out of business.

Even if work is completed under a contract properly awarded, federal agencies cannot remit payment to organizations not properly registered in SAM.gov.  This is because all of the representations that a contractor must make to the government are stored in SAM.gov.  There is no system for a contractor to manually make those representations.

To win an award, contractors must be registered.  With multi-year awards being made while the system is broken, otherwise worthy organizations will be excluded from competition due to government action.  This hurts the excluded contractor, but in some cases the excluded contractor will be the best option, which will hurt the government.

Contracting officers also review SAM.gov to determine how to structure an RFP.  As one example, contracting officers can determine the viability of a small business set aside for a particular contract by looking at how many small businesses operate under the relevant NAICS code.  If those small businesses do not appear because of the registration issue, the contracting officer will modify the offering itself.

From the outside looking in, these problems appear to be the result of a lack of basic testing.  Or testing was done and the results ignored in order to meet an arbitrary deadline.  Regardless, the system was not production ready, and its failures were not obscure.[1]  GSA soldiered on.  Even now, in light of widespread problems, GSA continues down this path instead of rolling back to a system that worked.

This is in stark contrast to the requirements of the Executive Order issued in May 2021 concerning cybersecurity and software development.  One is left to wonder, in light of the apparent lack of functional testing, how much security testing was done, especially concerning the central role of SAM.gov

What happens next: How do I protect myself

Eventually, the problems with SAM.gov will be resolved, but the consequences will be with us for years.  Government contractors (and I include in that term non-profits seeking grants, which are similarly impacted) must take steps to protect themselves from similar issues in the future.

First, contractors should be aware of government modernization efforts.  Every effort is prone to delays and system disfunction.  If a contractor relies on a system subject to modernization, they should conduct as much business as possible through the legacy systems.  As an example, GSA is preparing to replace SIP with a new web-based system, the Common Catalog Platform.  Contractors should ensure that the most up to date catalog is submitted through SIP immediately before the transition date, because they may be stuck with that version for a while.

Second, contractors should familiarize themselves with alternative methods to these systems.  While the government does not offer an alternative to SAM.gov registration, for other systems they may.  Contractors should also make sure they have redundant accounts on these systems, in case a key employee leaves the company or is locked out of the system for other reasons.

Third, contractors should know how to seek assistance.  GSA offers an ombudsman.  Other agencies may offer similar services.  The relevant inspector general may be appropriate for some issues.  In some case, a court may be the appropriate venue to seek relief.  Understanding which method to use in which circumstance before an emergency occurs is critical to addressing the issue quickly.

[1] One of my favorite examples is that the new codes were autogenerated and 10,000 had to be changed because they included inappropriate words within the codes themselves.