Description
Special Notice. OIS-12-074 NAICS Code: 518210 Response Date: January 31, 2012 Subject: Sole Source Bridge Contract with Akamai Technologies for Public Web Site Content Delivery and Continuity of Operations Services The U.S. Nuclear Regulatory Commission (NRC) intends to negotiate and award a sole source contract to Akamai Technologies, Inc. of Cambridge, Massachusetts by January 31, 2012 for continuation of critical operational services to maintain and expand assistance to distribute and deliver HTTP content and provide COOP services for the NRC Public Web Site (www.nrc.gov). NRC currently has a contract that expires on January 31, 2012 for these services, and Akamai Technologies is the provider of those services. NRC intends to award a "bridge" contract to Akamai Technologies for continuation of those critical services so that it can ensure that there is no interruption in those services while NRC conducts additional market research to determine appropriate acquisition strategy for a longer-term requirement. The services under the bridge contract will include continued website caching, backup and spidering, content delivery, application scripting, monitoring, reporting tools, and automatic fail-over capabilities 24 hours a day, 365 day a year. The NRC anticipates a firm-fixed-price contract with a period of performance of one year, starting on February 1, 2012, and one (1) six-month option to extend the term of the contract. The authority for this sole source action is 41 U.S.C. 253 (c)( 1), as implemented in FAR 6.302-1, Only one responsible source and no other supplies or services will satisfy agency requirements. Based on NRC's current market research, Akamai Technologies is uniquely qualified to perform NRC's requirements because of the following: CURRENT COMPLIANCE WITH THE FEDERAL INFORMATION SECURITY MANAGEMENT ACT (FISMA) OF 2002 The contractor must comply with the requirements for a Moderate risk system as defined in National Institute of Standards and Technology (NIST) Special Publication 800-60, Revision 1. Because only domestic (U.S.) companies can be held to FISMA requirements, the company must also be U.S. held. Akamai Technologies holds a current FISMA-moderate certification by at least one U.S. Federal cabinet-level department for requirements materially similar to those of the NRC for this acquisition. Akamai is also an early partner in the Federal Risk and Authorization Management Program (FedRAMP) initiative sponsored by the U.S. Federal Chief Information Officer to develop a common baseline for security assessment, authorization, and continuous monitoring for cloud products and services to reduce the cost or redundant agency security assessments. By participating in the FedRAMP initiative, Akamai has demonstrated its continued commitment to maintaining its FISMA certification in a manner that is cost-effective for its Federal clients. Based on NRC's market research (discussion with other agencies, professional knowledge of the industry, internet searches), the NRC has found no other source besides Akamai Technologies that can provide a Content Delivery Network (CDN) with a current FISMA-Moderate certification or that participates in the FedRAMP initiative. CONFIDENCE OF LAST MILE DELIVERY The NRC requires market penetration to ensure that all public site content reaches the Internet Service Provider (ISP) of the end user accurately for users in every country around the world. Akamai Technologies provides end-to-end delivery and control of content with proprietary algorithms that connect over 95,000 Akamai servers strategically distributed in 71 countries on 1,900 networks. Eighty-five percent of all Internet users are within a single "network hop" of an Akamai server to ensure "last-mile" delivery. Based on its market research, NRC has found no other source for a CDN that can demonstrate the ability verify the arrival of NRC content in the ISP of the end user. CONFIDENCE OF LAST MILE REMOVAL The NRC requires programmatic tracking and control of all content delivered by or cached on the contractor's CDN servers in host ISPs such that any Uniform Resource Identifier (URI) found at the public site can be removed from all of the contractor's CDN servers in networks world-wide at the client's request. In order to ensure that content requested by the NRC for removal from the public site is in fact purged from ISP servers, the CDN must retain control of that content while at the ISP. Otherwise, if the content is passed to an externally controlled server, the CDN loses control of the content. Akamai Technologies retains control of the content by delivering it using proprietary algorithms on its own CDN servers co-located in the host ISP, rather than relying on the servers of an external partner to deliver the content to the user's ISP. This ensures that Akamai retains control of the cached content until shortly before it reaches the end user. Thus, when content is scheduled for removal or refresh by the NRC, Akamai retains the ability to remove or refresh the content (and to verify the task is complete) at most ISPs worldwide. Based on its market research, NRC has found no other source besides Akamai Technologies that can provide a CDN that can demonstrate the ability to verify the removal of NRC content from the ISPs of most end users. In addition, the NRC has invested substantial time and effort in the existing configuration and FISMA certification for the Akamai Technologies CDN to support the NRC delivery requirements. The effort needed to migrate, configure, certify for FISMA compliance, and test a new CDN implementation would be cost-prohibitive and would place at risk the NRC's effort to achieve IPv6 compliance for the public site by the OMB-mandated deadline of September 30, 2012. Therefore, awarding this bridge contract acquisition any other source besides Akamai Technologies would cause unacceptable delays in fulfilling the agency's requirements. And, as stated above, NRC's market research revealed no other sources besides Akamai Technologies that can satisfy NRC's requirements.