Offeror’s Policy Not Sufficient to Expeditiously Disclose Security Incidents and Protect Personally Identifiable Information; GAO B-415713, First Financial Associates, Inc.

Protest challenging the agency’s evaluation of proposals is denied, where the protester unreasonably interpreted a solicitation provision as requiring offerors to submit their currently established breach notification policies, when in fact the solicitation required offerors to notify the agency of any security incidents within one hour of discovery.