Winning an award is not the end of the eligibility question. A status or size protest is a specific challenge, filed by a competitor, arguing that the apparent winner is not actually small, or does not actually hold the certification a set-aside required. It is a different animal from a protest of the award decision itself, which argues the agency evaluated bids incorrectly. This one argues the winner should never have been in the competition at all.
Who can file, and against what
Any interested party, almost always a losing competitor, can challenge an awardee's size or status. A size protest challenges whether the business is actually under the size standard for the procurement's NAICS code. A status protest challenges a specific certification, HUBZone, WOSB, SDVOSB, or 8(a), the same way. Both route through SBA rather than through the agency itself, since SBA is the authority that owns these determinations.
The windows are short
Like most challenges in this business, the window to file is measured in days, not weeks, usually starting from when the apparent awardee is announced. Miss it and the protest is generally too late, regardless of how strong the underlying argument is. The same short clock applies if you are the business being challenged: SBA will typically ask for supporting documentation on a tight deadline, not a leisurely one.
What actually happens during review
SBA examines the specific facts behind whatever is being challenged: ownership documents and financials for a size protest, or the facts underlying the specific certification for a status protest, HUBZone residency and address records, ownership and control documents for WOSB or SDVOSB, and so on. Many of these challenges turn on affiliation, since the honest headcount or receipts number is often not the real argument, who else counts as part of your business is. The challenged business gets a chance to respond with its own documentation before SBA decides. A decision from SBA's Area Office can usually be appealed further within SBA, so a first ruling is not always the final word on either side.
How to actually protect yourself
The businesses that come through a protest cleanly are the ones who could already answer it before it was filed. Keep the documents behind every status you claim current and organized, ownership records, payroll and address records for HUBZone, disadvantage narratives for 8(a), so you can respond fast on a short deadline instead of scrambling to reconstruct your own facts under pressure. Just as important: never claim a status you would need to squint to justify. A protest only threatens a claim that was shaky to begin with.
Losing a protest can unwind the award
If SBA finds you were not actually eligible, the agency can cancel an intended award before it is finalized, or in some cases terminate one already made, and you are excluded from that competition on that basis. A finding against you is not just a lost bid either; a false claim can trigger further review well beyond the single contract in question. Treat every status you hold as something you could be asked to prove on short notice, because eventually, you might be.