When Can a Small Business Challenge an SBIR Follow-On Award at the Court of Federal Claims in 2026?

According to SBA guidance, SBIR follow-on awards are meant to move successful research forward without unnecessary competition, but only when the new work stays within the program’s statutory and policy boundaries. The legal issue usually appears when a disappointed small business says the agency treated a broader, different, or newly competed requirement as if it were still a protected SBIR continuation. That dispute matters because 15 U.S.C. § 638 gives agencies SBIR authority, yet the SBA SBIR/STTR Policy Directive still requires agencies to document why the award is truly a follow-on. According to GSA guidance on SAM.gov, offerors also need current registration and accurate representations, because a protest loses force if the challenger is not an eligible prospective contractor. The result is a narrow but important question: was this a lawful SBIR follow-on, or was it really a new procurement dressed up as one?

Per the Court of Federal Claims protest rules and the Tucker Act, the plaintiff must show a procurement connection, injury, and timely filing. That makes SBIR follow-on cases very fact-specific. The court is not a forum for abstract frustration with agency science policy or internal program management. It wants the award record, the solicitation, the technical evaluation, and the basis for the award decision. Inside Government Contracts reported in August 2026 that the Court of Federal Claims found jurisdiction over an SBIR protest, underscoring that the forum can hear these cases when the agency action looks like a procurement decision. GAO decisions in G2 Ops, Inc. and Digital Force Technologies, Inc. also show that the outcome often turns on whether the protester can tie the award to a concrete rule violation and actual competitive prejudice.

According to SBA’s SBIR/STTR Policy Directive, the agency record should explain why the award qualifies as a follow-on and why the selected firm remains eligible and responsible. The strongest protests usually focus on scope creep, missing justification, or an award that appears to bypass competition for reasons unrelated to the original Phase I or Phase II work. Per FAR 19.502, ordinary small business set-aside logic is not the same thing as SBIR authority, so agencies cannot rely on generic small business labels to defend a decision that should have been documented under SBIR-specific rules. If the follow-on work adds a different technical objective, a much larger funding level, or a materially longer period of performance, the challenger can argue the government created a new procurement and should have competed it. That is why the paper trail matters so much: the Court of Federal Claims will not infer a violation from suspicion alone.

Per the Court of Federal Claims’ protest framework, timing and injury determine whether the case lives or dies. A small business generally must prove it was an actual or prospective bidder and that the agency’s SBIR decision changed the competitive field. According to GAO’s treatment of SBIR-related disputes in G2 Ops, Inc. and Digital Force Technologies, Inc., the decisive issue is often whether the agency had a defensible reason to treat the award as a continuation rather than a new competition. Under OMB Circular A-123, agencies also need internal controls that document high-risk decisions, which matters when the protest alleges inadequate review of foreign ties, cybersecurity, or responsibility. DoD’s CMMC framework can become relevant if the work involves CUI, and NIH’s 2026 foreign-disclosure notice shows the government is taking a harder line on foreign risk. Those facts do not automatically win the protest, but they sharpen the argument that the award file should have been tighter.

According to GSA guidance on procurement integrity and document retention, the challenger should preserve every award email, debriefing note, solicitation amendment, and agency memo within the first 24 hours. That record becomes the backbone of the case. Per FAR and SBA policy, the protester should compare the awarded scope against the Phase II statement of work, the deliverables, and any transition plan. If the follow-on is substantially larger, shifts to a new mission area, or includes foreign-disclosure or cyber requirements not present in the earlier phase, the company should flag those differences immediately. The court cares less about labels and more about whether the agency’s decision was rational, documented, and consistent with the statute. That is why many SBIR cases turn on the first written record, not on later testimony. The company that organizes the file quickly usually has the better chance of showing prejudice and obtaining meaningful relief.

Under OMB and agency internal-control standards, contracting officers should be able to explain why a follow-on award was not re-competed and why any eligibility or responsibility issue did not bar the award. For a protester, that means looking for gaps in the file: missing market research, missing legal review, or a justification that copies SBIR language without proving the facts. According to the SBA SBIR/STTR Policy Directive, the agency must keep the award within the program’s structure, and that point becomes especially important when DoD attaches CMMC requirements or when the work touches FedRAMP-authorized systems. A company does not win by alleging every control failure; it wins by linking one failure to the award decision. If the missing step is the one that would have changed the outcome, the Court of Federal Claims is far more likely to treat the issue as a real procurement protest rather than a policy complaint.

According to SBA, GSA, and OMB, the smartest protest strategy is to separate legal error from technical disagreement. The Court of Federal Claims is more receptive when the complaint points to a missing SBIR justification, a scope change, or an award made outside the statute, rather than simply arguing that the protester’s solution was better. A small business should also decide whether the case raises cybersecurity or foreign-risk issues that can be proved with documents. If the agency later says the awardee was disqualified for a CMMC or foreign-disclosure reason, the protester must be ready to show how the file handled those issues. Per FAR-based acquisition practice, the record is king. The cleaner the company’s chronology, the more credible the challenge. That means building a timeline, identifying every change in the requirement, and matching each change to a missing or weak agency document. This is not a place for general grievances; it is a place for specific, dated, evidence-backed allegations.

Under the SBA SBIR/STTR Policy Directive and the Court of Federal Claims’ protest standards, the best cases are those where the protester can say, in one sentence, what rule the agency broke and how the error changed the award. That sentence should include the dollar amount, the changed scope, and the missing justification. If the award is tied to DoD work, the protester should check whether CMMC or other cybersecurity requirements were applied consistently. If the work involved cloud services, FedRAMP can matter too. If the agency used foreign-risk screening, the company should verify that the record shows the same screening applied to all offerors. The point is not to raise every possible issue. The point is to raise the one issue that makes the award look unlawful. That is the difference between a protest that survives and one that gets dismissed after the government files its first jurisdictional brief.