Two protests, two corrective actions, and the company that filed both of them ended up watching its competitor keep the work with no competition at all. Not as a punishment, and not through anything anybody did wrong. The corrective action itself was the legal reason.
The decision is B-424528; B-424528.2; B-424528.3, DLH, LLC, decided August 31, 2026 and released on the GAO bid protest docket on September 8, 2026. The protest was denied.
The requirement
The National Institutes of Health runs an Office of Innovation and Information Technology that provides IT support for more than 3,000 employees across NIH's Office of Research Services and Office of Research Facilities. The work covers project management, application development and hosting, desktop support, customer care, network account administration, web development and IT security, across two separate environments: the NIH Enterprise Network and the Facilities Network, which includes the network and security engineering for the industrial control systems in NIH's buildings.
That is not a requirement an agency can let lapse for a few months while it thinks.
The five step timeline
May 2025. NIH issues RFQ No. C-120673-SB to holders of NITAAC CIO-SP3 Small Business contracts, a competitive procurement for the work.
July 3, 2025. NIH issues the task order to Dynanet Corporation of Elkridge, Maryland.
Protest one. DLH, LLC of Bethesda, Maryland and another disappointed vendor protest the award. NIH promptly tells GAO it will take corrective action by reevaluating quotations and making a new source selection decision. The protests go away.
May 4, 2026. NIH reevaluates and issues the task order to Dynanet again.
Protest two. More protests follow. This time NIH tells GAO it will take corrective action by cancelling the solicitation entirely, reconsidering its requirements and running a new competitive procurement. On June 4, 2026 GAO dismisses those protests as academic.
Read that sequence from DLH's side and it looks like two wins. The award it did not like was pulled back twice, and the second time the whole competition was thrown out and started again. That is close to the best outcome a protest can produce.
What the second win actually created
Cancelling a solicitation does not create a contractor. It creates a hole.
NIH now had a live requirement supporting 3,000 people and building control systems, an expired incumbent task order, and no competitive vehicle to put the work on while it rebuilt the procurement from the start. So it issued a sole source bridge: a 3.6 million dollar task order against a Federal Supply Schedule contract, a 3 month base period with three 1 month options, to Dynanet.
DLH protested that too, and this is the protest GAO just decided.
The argument, and why it lost
DLH's central argument was the strongest one available: an agency is not allowed to manufacture its own emergency. The Competition in Contracting Act says in terms that noncompetitive procedures may not be used as a result of a lack of advance planning by contracting officials, and GAO has long applied the same principle to non-competitive orders under the Federal Supply Schedule even though FSS orders are not subject to CICA's specific competition requirements.
NIH had been trying to compete this work since May 2025. Fifteen months later it had no contractor and was buying sole source. If that is not a planning failure, DLH asked, what is?
GAO's answer is one sentence and it is the whole decision:
we do not consider an immediate need for services that arises as a result of an agency's implementation of corrective action in response to a protest to be the result of a lack of advanced planning
The sole source justification said the short term order was necessary to let the agency implement corrective action in response to the protests. GAO found the urgency real and the justification consistent with the regulatory requirements of GSAR 538.7104-3, and denied the protest.
The part that stings
DLH was the incumbent. Its task order expired. And before it expired, Dynanet had already been transitioning and onboarding DLH's employees.
DLH raised that. It did not work, for a reason that had nothing to do with the merits. GAO found DLH was likely aware of the transition no later than May 11, 2026, the date of its own email to NIH raising concerns about Dynanet moving its people before the incumbent order ended, and that by May 20 it certainly knew the employees had gone, that the agency had issued a stop work order on the competitive task order, and that Dynanet was still performing the requirement.
Raising the detail later, after the agency report, made it piecemeal. GAO's rule on that is settled: a protester who states a broad ground up front and holds the specifics inside its own knowledge until later, so that the agency would have to respond again, does not get those later issues considered. The citation GAO used is 22nd Century Technologies, Inc., B-413210, B-413210.2, September 2, 2016.
What to take from it
Corrective action is not free to the protester. Every time an agency pulls an award back, the clock keeps running on a requirement that still has to be met by somebody. The firm performing it while the competition is rebuilt is usually the firm that just won, not the firm that just protested.
The advance planning bar is narrower than it reads. Fifteen months of failed procurement is not, by itself, lack of advance planning. What matters is the cause of the immediate need at the moment the sole source is issued, and if the cause is the agency's own corrective action, GAO will not count it against the agency.
An expiring incumbent order is leverage that expires with it. DLH's staff were gone before its order was. By the time the bridge was issued, the argument that only the incumbent could perform had already been answered by events.
Say everything you know in the initial protest. The transition ground was dismissed on timing and piecemeal presentation, not on whether it was true.
Source: GAO decision B-424528; B-424528.2; B-424528.3, DLH, LLC, Department of Health and Human Services, National Institutes of Health, decided August 31, 2026, public release version read from the GAO bid protest docket on September 8, 2026. All figures, dates and quoted language are from that decision. LOLSBA is not a law firm and this is not legal advice.