LSJ_FPKI_Terremark.pdf

December 13, 2012

QTA0013AWB1008

LIMITED SOURCE JUSTIFICATION FOR MULTIPLE AWARD SCHEDULE

PROGRAM

Upon the basis of the following justification, I, as the Contracting Officer, hereby approve the use of sources limited to fewer than those required in FAR 8.405-2 pursuant to the authority of 41 U.S.C. 251 as implemented by FAR 8.405-6 (b) Only one source is capable of responding due to the unique or specialized nature of the work;

1. Identification of the agency and the contracting activity and specific identification of the document as a limited source justification (LSJ).

Approval under FAR 8.405-6 (b)(3) is sought for GSA, Federal Acquisition Service (FAS), Integrated Technology Services (ITS), Office of Acquisition Operations (QTA) to place a noncompetitive Task Order with Terremark Federal Group, Inc., to provide Data Center Floor Collocation at Culpepper, Virginia. Services include maintaining existing controlled and managed space with connectivity for computing, storage, telecom and accommodations needed to run the Federal Public Key Infrastructure (FPKI).

A limited-source award to Terremark Federal Group of these collocation services is justified to make possible the continuation of these essential mission-critical operations while allowing sufficient time to consider consolidation of these requirements into a competitive acquisition for all program services. The Federal Public Key Infrastructure (FPKI) program services contract will end December 31, 2012. The complexity of the PKI technology, the limited experienced personnel pool, and the need to create a contract vehicle designed to accommodate a ubiquitous technology and policy environment have delayed anticipated award of a five year support contract until the third quarter of 2013 (May 2013).

A request is being made to extend the current FPKI operations contract through December 2013. In order to ensure continuity of operations through award and transition to a new contract, it was determined that the FPKI production sites should remain at their current locations. Maintaining these sites will ensure sufficient time to allow possible relocation and required Assessment & Authorization (A&A) for Authorization to Operation (ATO) without risk to the mission critical FPKI system and its customers.

The importance of the Federal Public Key Infrastructure is evident in the nature of the service it provides (personal electronic authentication services to buildings and information technology systems); the integral nature of the service to all Federal Agencies and related State, industry and academic partners; and the sheer number and complexity of the actual system linkages within customer’s systems and security processes. The system supports mission essential personnel identity verification and encryption based electronic transaction functions for the DoD, Department of State, and other agencies entrusted with the protection of our national security and support to our warfighter. The FPKI system provides capability for these Agencies to employ encryption based technology to share data securely with their industry partners/suppliers across the internet.

GSA is entrusted with the ongoing operation of this critical infrastructure for the Federal Government and cannot allow operations to be interrupted. The downstream impact of a failure or interruption of services is not easily calculated due to the inherent anonymity of stakeholder transaction patterns. However, the scope of stakeholder membership (all Federal Agencies and partners) and the current reported level of expenditures for PKI related implementations indicate that there would be a heavy financial loss in sunk cost to the Federal government.

In 2003, the General Accounting Office conducted a study on 24 major federal departments and agencies to obtain information on PKI initiatives. The results of the study found that a significant investment, estimated at about $1billion had been spent on the PKI initiatives. The US Government IT Dashboard for 2012 reported, an additional investment on PKI initiatives, estimated upward $1.5 billion. If the FPKI Infrastructure failed to operate the government would lose the benefits of $2.5 billion in sunk costs. In addition to the sunk cost there would be cost in implementing alternative methods for logical and physical access that are incalculable.

Additional costs would be incurred by all agencies and partners now invested heavily in the system and dependant on the infrastructure to transact business securely. If the FPKI failed, every stakeholder would have to immediately implement architectural reconfiguration, testing, and implementation of alternate authentication solutions for their logical and physical access needs. The resultant cost would be related to the solution and instances required by each.

There is now insufficient time to award a new five year FPKI operations support contract by December 2012. Therefore GSA is pursuing a continuity of operations bridge contract that will allow the incumbent to maintain the system and allow sufficient time to award an appropriate contract. This task order to Terremark Federal Group will allow continued provision of telecommunications services for the FPKI production site currently housed at Culpeper, VA. The limited-source award will allow provision of telecommunications services for (1) year, at which time completion of the main FPKI program contract may provide opportunity to combine telecommunications requirements within a single venue.

2. Nature and/or description of the action being approved.

GSA FAS will issue a non-competitive Task Order under IT Schedule 70, 132-52 Electronic Commerce and Subscription Services for value added network services, e-mail services, Internet access services, electronic subscription services, data transmission services, and emerging electronic commerce technologies. The Task Order shall provide continuity of collocation services at the FPKI production site currently located within the Terremark Federal Group owned Culpepper, VA facility.

The Federal Public Key Infrastructure provides the framework for strong authentication assurance for the Federal Government through the use of public key technology. All agencies of the Federal Government are mandated to use this infrastructure for physical and logical access control.

Relocation of services currently operating at the Terremark Federal Group facility would represent enormous risk to program operations and service to government wide operations. The Federal PKI currently provides services to the entire Federal government via facilities at two locations. Shutting down one location would result in all services being rendered at the remaining single location for the duration of an infrastructure relocation. Any failure at that remaining location would result in the inability for departments and agencies to perform validation of the over 5 million HSPD- 12/Personal Identity Verification credentials that have been issued. This would result in the inability for Federal employees and contractors to enter facilities and log into their workstations and applications using HSPD-12/PIV credentials.

A secondary risk exists should any FPKI equipment be damaged during the relocation, it will impact our ability to restore service at a new location in a timely fashion. Any delay in re-establishing service at the new location will extend the period of the primary risk of a single point of failure. Depending on the extent of the damage, remediation may require break/fix support from the associated vendor or may require a complete procurement cycle combined with the need to completely install, configure and deploy the replacement component.

The FPKIMA has designed its facilities to be able to support existing usage requirements from either one of its two sites. However, this design is predicated on the existing usage requirements and depends on the combined capacity of the two sites to support major changes in usage. The FPKI currently supports over 1.1 billion transactions per month.

Extended operations from a single site will put the program at risk of being able to service additional usage demands anticipated as more government agencies implement OMB Memorandum 11-11.

OMB M11-11 requires agencies to aggressively step up their full use of PIV credentials for access to federal facilities and information systems. The following provisions of the memorandum will have impact on current operation of the FPKI:

• Effective immediately, all new systems under development must be enabled to use PIV credentials, in accordance with NIST guidelines, prior to being made operational.

• Effective the beginning of FY2012, existing physical and logical access control systems must be upgraded to use PIV credentials, in accordance with NIST guidelines, prior to the agency using development and technology refresh funds to complete other activities.

• Agency processes must accept and electronically verify PIV credentials issued by other federal agencies.

3. A complete description of the supplies and/or services required to meet the agency’s needs

This is a firm fixed price task order to acquire collocation services that include dedicated space to deploy, operate and maintain some of the Federal Public Key Infrastructure Architecture’s (FPKIA) components. Service at the data center must meet or exceed Tier-3 requirements as specified in the performance statement of work. The total estimated fixed price ceiling is $168,101.52.

4. An identification of the LSJ rationale, and if applicable, a demonstration of the contractor’s unique qualifications to provide the required supply or service.

The statutory authority which permits acquisition of the required collocation services in support of the FPKI, on a limited source basis, FAR 8.405-6 (b)

- Only one source is capable of responding due to the unique or specialized nature of the work;

Collocation services of the type being acquired have been in operation at the Terremark Federal Group in Culpeper, VA since 2010. Movement of these services would incur enormous risk to the program operation and the downstream dependencies of federal agencies mandated to use PIV credentials for physical and logical access.

In 2010, when services were first requested at the Terremark Culpeper facility, market research showed that very few commercial facilities existed that met the Federal PKI Policy Authority requirements for operation of a PKI and offered security controls commensurate to the storage of cryptographic hardware components.

Current market research suggests that there are still very few companies that specialize in providing data center, physical security and redundant connectivity services of the caliber needed to protect the FPKI production sites. According to a recent Gartner research report, 2012 the following companies are listed as market leaders and challengers in this market. Leaders: AT&T, Rackspace, Savvis, Terremark and Challengers: NaviSite, GoGrid, Opsource, Datapipe, Hosting.com, BT Global Services.

Of these companies, AT&T, Savvis, Terremark, Hosting.com and Datapipe have the elements of collocation services listed on Schedule 70 132 52, Upon further discussions with these companies, AT&T, Savvis, Terremark, had facilities located close to 50 miles, and Hosting.com held facilities located within 100 miles. These four companies appear to have the capability to provide collocation services of the level of security required for the FPKI. However, due to need to provide customized security services for the FPKI (dedicated space for FPKI, install custom GFE physical security systems) and logistical considerations (move GFE and set up both production site and administration space requirements).only one could provide these services within the date of delivery December 28, 2012: Terremark.

The performance risks associated with moving services should the system go offline, combined with the fact that only Terremark can deliver services by the date required;

indicate that it is in the best interest of the government to place a noncompetitive task order with Terremark until competition of the main FPKI program contract can be performed in 2013 and possible incorporation of the production site requirements.

5. A determination by the ordering activity Contracting Officer that the Task

Order represents the best value consistent with FAR 8.404(d).

This will be a fixed price contract based on one year of established costs for operations at the same facility and with the same requirements. Current market research suggests that there are some facilities available in the Washington DC and surrounding area that cater to the particular combination of services and accommodations needed to operate this FPKI production site. Specific collocation services and pricing is specified in the Terremark contract (GS-35F-0073U) on IT Schedule 70, SIN 132 52. With the established historical cost information and the solid past performance, Terremark represents a solid value for the government. Verizon Business has merged with Terremark and is currently reconciling their Schedule 70 contracts. Through recent contact with the company, the government anticipates discounted prices as a direct result of this merger. Factoring in the fact that no sources can make date of delivery, it is determined to be highly improbable that the government could obtain the necessary services through any other source for the government estimated costs.

6. A description of the market research conducted among schedule holders, and the results of the research, or a statement why market research was not conducted.

In 2010, the Government assessed the availability of commercial facilities capable of providing the collocation services required in the Washington DC area. No other facilities were found that offered the level of security and other collocation services required to operate the FPKI site.

Current market research suggests that there are still only a few companies that specialize in providing data center, physical security and redundant connectivity services of the caliber needed to protect the FPKI production sites. The recent trend in data center consolidation and providing cloud services may be the reason for the increase in commercial services that offer a variety of managed network services services at secure levels. According to a recent Gartner research report, 2012 the following companies are listed as market leaders and challengers in this market. Leaders: AT&T, Rackspace, Savvis, Terremark and Challengers: NaviSite, GoGrid, Opsource, Datapipe, Hosting.com, BT Global Services. Of these companies, AT&T, Savvis, Terremark, Hosting.com and Datapipe have the elements of collocation services listed on Schedule 70 132 52, Upon further discussions with these companies, AT&T, Savvis, Terremark, had facilities located close to 50 miles, and Hosting.com held facilities located within 100 miles. These four companies appear to have the capability to provide collocation services of the level of security required for the FPKI. However, due to need to provide customized security services for the FPKI (dedicated space for FPKI, install custom GFE physical security systems) and logistical considerations (move GFE and set up both production site and administration space requirements).only one could provide these services within the date of delivery December 28, 2012: Terremark.

7. Any other facts supporting the limited source justification.

There are no other factors.

8. A statement of the actions, if any, the agency will take to remove or overcome any barriers that led to restricted consideration before any subsequent acquisition for supplies and services is made.

In 2010 and 2011, the Government assessed the availability of commercial facilities capable of providing the collocation services required in the Washington DC area.

No other facilities were found that offered the level of security and other collocation services required to operate the FPKI site. One year later, there appears to be additional service offerings available on Schedule 70 that are capable of providing the service required. The market could be responding to the government’s needs for managed networking services both as a part of its solution to consolidate data centers and to receive cost benefits from the provision of commercially provided cloud services. The importance of the FPKI system by virtue of its being mandated for use by all Federal Agencies, and the current linkages in place between stakeholders systems downstream, mean that this system cannot be allowed to go offline. The cost impact is estimated to include both the loss of benefits from sunk cost of approximately $2.5 Billion, and the additional incurred costs associated with agencies having to implement alternative methods for logical and physical access.

The government intends to award a competitive task order by FY13 Q3 that allows possible solutions that would consolidate all requirements under a single contract.

This strategy should allow for possible reduction in administrative and management costs associated with multiple contracts for contractor managed service, lease space, and communications services. This one year acquisition with Terremark will allow time for the government to pursue including these services into one venue for the entire FPKI program services scheduled for late 2013.

9. The ordering activity Contracting Officer’s certification that the justification is accurate and complete to the best of the Contracting Officer’s knowledge and belief and evidence that the supporting data that form a basis for the justification have been certified as complete and accurate by technical/program personnel.

Both the technical and requirements personnel are required to certify each justification as to its accuracy and completeness. By signing the justification the Contracting Officer certifies that the facts and statements made are accurate and complete.

Certification

I certify that this justification is accurate and complete to the best of my knowledge and belief.

Darlene Gore Date Program Manager Security Services Division

Samuel Barksdale Date Contract Specialist Strategic Solutions Contract Operations Division (QTAAA)

Audrea Michelle White Date Contracting Officer Strategic Solutions Contract Operations Division (QTAAA)

ALL QUESTIONS REGARDING THIS LIMITED SOURCE JUSTIFICATION

ARE TO BE REFERRED TO:

Ms. Audrea M. White Contracting Specialist Contract Operations Division (QTAA) 10304 Eaton place 4th Floor Fairfax, VA 22030 703-306-6264