Initial YPMS planning and ATO artifacts

Pre-development state; no code yet.

Delivery model: in-house build by DOES OIT on Azure Government,
matching the DCYWP / OWC / Employer 360 pattern.

Stack decision (2026-09-30): Python 3.12 / FastAPI / SQLAlchemy /
Postgres, aligning with OWC.

System Owner / ISSO / AO: Chris Tonjes (DOES CIO). Role concentration
recorded in SSP §5 with risk-acceptance rationale.

Source functional and security requirements derived from the prior
YPMS RFP (Solicitation Docxxxxx, April 2025) — 54 C.5.7 security
requirements and Appendix E non-functional requirements — treated as
source specifications, not as Contractor obligations.

Documents included:

- CLAUDE.md, OVERVIEW.md — project router and program-level summary
- SYSTEM_SECURITY_PLAN.md v0.3 — NIST 800-53 Moderate baseline SSP
- NIST_800_53_CONTROL_MAPPING.md v0.2 — full control-family mapping
  with in-house ownership tags and evidence-artifact expectations
- POAM.md v0.1 — 62-item POA&M seeded from tailorings, open decisions,
  missing companion docs, and pre-ATO deliverables; two items closed
- PRIVACY_IMPACT_ASSESSMENT.md v0.1 — full PIA covering minors, SSN,
  banking, FERPA-covered OSSE records, CFSA foster/ward flags, and
  the dormant emergency health-record path
- ARCHITECTURE.md v0.1 — forward-looking design blueprint, OWC-aligned
- PHASE0_PLAN.md v0.1 — framework vendor-in, auth, RBAC, audit,
  Registrant vertical slice, 501 stubs for remaining entities
- TODO.md — 12-section working checklist tied to POA&M IDs
- OLA_RESPONSE_2026-09-30.md — Q&A for OLA / City Administrator

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

OLA_RESPONSE_2026-09-30.md

@@ -0,0 +1,58 @@
+# YPMS — OLA Questions Response
+
+**Re:** Modernization of the Marion Barry Summer Youth Employment Program Web-Based Data Management System (YPMS) — DOES Strategic Initiative FY27
+**Prepared for:** OLA / City Administrator
+**Date:** 2026-09-30
+
+---
+
+## 1. What data will populate in this system?
+
+Applicant and participant records (youth, hosts/employers, parents/guardians, DOES staff) including:
+
+- **Identity:** name, DOB, address, phone/email, parent/guardian contact
+- **SSN** (for SSA cross-match; masked in display)
+- **Education:** school enrollment status ingested from OSSE
+- **Eligibility:** age, residency (validated against DC MAR), foster/ward-of-state flag from CFSA
+- **Program participation:** applications, certifications, orientation completion, enrollments, job matches, worksite assignments
+- **Employment:** hours worked, resumes, job preferences
+- **Financial:** banking for direct-deposit payroll, tax info, W-2/1099 records via the third-party payroll integration
+- **Operational:** host/employer registrations, worksites, job postings, transportation vouchers, communications, audit logs
+
+## 2. How much of this data will be provided to the public?
+
+Very little. The public surface is limited to available programs and dates, host-employer job postings, application forms, static help and training content, and aggregate program information. No individual PII is exposed publicly. Press and public reporting uses de-identified counts; FOIA responses go through DOES OGC with PII redacted.
+
+## 3. Will the system contain information on students served across fiscal years, broken out by sub-programs?
+
+Yes. The system tracks program details year-over-year and supports each OYP sub-program as a first-class object — MBSYEP, HSIP, MBYLI (SIT / School Year / Global Education), CRESP, and any future OYP program. Reporting is in scope; MicroStrategy (the current reporting tool) is one of the legacy components YPMS replaces. Historical participant data with sub-program breakdowns is retained per DOES records schedule.
+
+## 4. Is there something similar for other workforce programs at DOES?
+
+Partially, but nothing consolidated the way YPMS will be:
+
+- **Adult unemployment insurance:** UIBS — being modernized separately.
+- **Adult workforce services:** Geographic Solutions' Virtual One-Stop (VOS).
+- **Workers' compensation:** OWC — a separate DOES modernization on its own ATO path.
+- **Youth today:** fragmented across seven legacy tools (Host/Participant Application, Scanning, Transfer, TMS timekeeping, MicroStrategy, PF3 admin backdoor, manual payroll scripts) — YPMS consolidates these.
+
+YPMS is the youth-specific consolidation; it doesn't replace anything on the adult side.
+
+## 5. Will the system house SYEP participants' personal information — addresses, SSN, banking, etc. — and are there privacy concerns?
+
+Yes. YPMS will store address, SSN, DOB, banking for direct-deposit payroll, tax info, parent/guardian contact, school records (FERPA-covered, from OSSE), foster/ward status (from CFSA), and — under emergency scenarios — health records.
+
+Privacy concerns and how they are addressed:
+
+| Concern | Mitigation |
+|---|---|
+| Population is primarily minors — heightened stewardship required | Strict role-based access; data minimization by reusing eligibility across programs; parental co-authentication under consideration |
+| SSN is a high-value identity-theft target | Masked/anonymized in display; encrypted at rest and in transit using FIPS-validated cryptography |
+| Banking data | Encrypted; passed to the third-party payroll vendor via secured integration; payroll processing itself lives outside YPMS |
+| School records (OSSE) | Handled under FERPA; requires a formal DOES–OSSE data-sharing agreement |
+| Foster/ward status (CFSA) | Confidential under DC Code Title 4; access limited on need-to-know |
+| Detection and response | IDS/IPS and SIEM required; unauthorized disclosures are reported immediately through the DOES OIT → DC OCTO CISO chain, with a full internal report within 24 hours and a remediation plan within 2 business days |
+| Assurance baseline | NIST 800-53 Moderate; DC OCTO IT policies; SSA electronic exchange requirements |
+| Records-access oversight | DOES OIT maintains and reviews a full list of personnel with data access, updated at least quarterly with additions and deletions tracked |
+
+**Open questions flagged for the AO:** whether social-media login is acceptable for minors without full identity proofing before payroll actions, and treatment of the dormant health-record ingest path. YPMS will be built in-house by DOES OIT and hosted on Azure Government, matching the OWC and Employer 360 posture.