Initial YPMS planning and ATO artifacts

Pre-development state; no code yet.

Delivery model: in-house build by DOES OIT on Azure Government,
matching the DCYWP / OWC / Employer 360 pattern.

Stack decision (2026-09-30): Python 3.12 / FastAPI / SQLAlchemy /
Postgres, aligning with OWC.

System Owner / ISSO / AO: Chris Tonjes (DOES CIO). Role concentration
recorded in SSP §5 with risk-acceptance rationale.

Source functional and security requirements derived from the prior
YPMS RFP (Solicitation Docxxxxx, April 2025) — 54 C.5.7 security
requirements and Appendix E non-functional requirements — treated as
source specifications, not as Contractor obligations.

Documents included:

- CLAUDE.md, OVERVIEW.md — project router and program-level summary
- SYSTEM_SECURITY_PLAN.md v0.3 — NIST 800-53 Moderate baseline SSP
- NIST_800_53_CONTROL_MAPPING.md v0.2 — full control-family mapping
  with in-house ownership tags and evidence-artifact expectations
- POAM.md v0.1 — 62-item POA&M seeded from tailorings, open decisions,
  missing companion docs, and pre-ATO deliverables; two items closed
- PRIVACY_IMPACT_ASSESSMENT.md v0.1 — full PIA covering minors, SSN,
  banking, FERPA-covered OSSE records, CFSA foster/ward flags, and
  the dormant emergency health-record path
- ARCHITECTURE.md v0.1 — forward-looking design blueprint, OWC-aligned
- PHASE0_PLAN.md v0.1 — framework vendor-in, auth, RBAC, audit,
  Registrant vertical slice, 501 stubs for remaining entities
- TODO.md — 12-section working checklist tied to POA&M IDs
- OLA_RESPONSE_2026-09-30.md — Q&A for OLA / City Administrator

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

OVERVIEW.md

@@ -0,0 +1,106 @@
+# YPMS — Overview
+
+**One line.** An in-house DOES OIT build that replaces seven legacy tools currently used by the Office of Youth Programs to run MBSYEP and related youth workforce programs. Matches the DCYWP / OWC / Employer 360 delivery pattern.
+
+## Why we're building it
+
+The current OYP system landscape is fragmented across seven tools that don't share data:
+
+| Legacy tool | Purpose | Fate under YPMS |
+|---|---|---|
+| Host/Participant Application | Program applications | Replaced by unified intake |
+| Scanning Application | Certify application information | Replaced by in-line certification |
+| Transfer Application | Place and transfer youth | Replaced by matching engine |
+| TMS (Time Management System) | Youth time tracking | Replaced by online time management |
+| MicroStrategy | Reporting and visualization | Replaced by native reporting + BI |
+| PF3 (People First backdoor) | Admin login tool for host-app edits | Replaced by RBAC admin functions |
+| Manual payroll (scripts + email approvals) | Payroll processing | Replaced by third-party payroll vendor integration |
+
+Consolidating these into a single DOES-owned system is the substance of the modernization.
+
+## Programs served
+
+| Program | Population | Notes |
+|---|---|---|
+| **MBSYEP** — Marion S. Barry Summer Youth Employment Program | Youth ages 14–24 | Locally funded; highest peak-load driver; hard summer deadlines |
+| **HSIP** — High School Internship Program | Grades 9–12 | School-year enrichment and internships |
+| **MBYLI** — Marion Barry Youth Leadership Institute | Year-round | Includes Summer Intensive Training (SIT), School Year Program (SYP), Global Education |
+| **CRESP** — Career Ready Early Scholars Program | Middle-school students | 11 career-exploration tracks (STEM, culinary, law/global affairs, etc.) |
+| Future OYP programs | — | System must accept new program definitions end-to-end (application → completion) |
+
+## User populations
+
+| User | Estimate | Access |
+|---|---|---|
+| DOES staff, contractors, vendors | ~90 | Internal portal, SSO / DOES global directory |
+| Host employers | ~1,500 | Self-service web portal |
+| Youth (registering + participating) | ~27,000 | Web / mobile; identity model under review — see CLAUDE.md open question 3 |
+| Parents / guardians | ~7,400 | Web portal |
+| Other agencies | ~100 | Web portal or interconnection |
+| **Total** | **~36,000** | Scale target: 50%/year growth |
+
+## Integrations
+
+| Partner | Purpose | Notes |
+|---|---|---|
+| SSA (Business Services Online) | SSN verification, wage data | SSA electronic-exchange requirements apply |
+| OSSE | School enrollment records | FERPA — data-sharing agreement required |
+| CFSA | Foster / ward-of-state status | DC Code Title 4 — MOU required |
+| DC MAR | Address verification | DC OCTO service |
+| Third-party payroll vendor | Time → payroll → tax forms | Vendor selection outstanding; DOES OIT owns the integration on our side |
+| Third-party LMS | Orientation completion tracking | Vendor TBD |
+| DC OCTO Sentinel | Security telemetry (SIEM stream) | Same pattern as OWC |
+| Social media IdPs | Youth account login | Risk-managed; not sufficient for payroll actions on its own |
+
+## Delivery model
+
+DOES OIT builds and operates the system. **Stack: Python 3.12 / FastAPI / SQLAlchemy / Postgres**, aligned with OWC. Hosting is Azure Government Cloud, matching OWC and Employer 360. Continuous monitoring runs into DC OCTO Sentinel.
+
+## Timeline (as of 2026-09-30)
+
+| Milestone | Target | Status |
+|---|---|---|
+| Source requirements captured (from prior YPMS RFP) | 2025-04 | Done |
+| ISSO and AO designated in writing | 2026-09-30 | ✓ Chris Tonjes (DOES CIO) as System Owner, ISSO, and AO |
+| Stack decision recorded | 2026-09-30 | ✓ Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment) |
+| FIPS 199 memo signed by AO | 2026-10-31 | Not started (`YPMS-POAM-001`) |
+| Architecture document | 2026-11-30 | Not started (see `YPMS-POAM-040` follow-on) |
+| Azure Gov tenant + non-prod environments | 2027-01-15 | Not started (`YPMS-POAM-041`) |
+| CI/CD pipeline with SAST/SCA/SBOM | 2027-01-31 | Not started (`YPMS-POAM-042`) |
+| Data-sharing agreements (OSSE, CFSA, SSA, payroll vendor) | Q1 2027 | Not started (`YPMS-POAM-020` – `YPMS-POAM-023`) |
+| ATO artifacts (SSP, PIA, IRP, CP, RoB, control mapping) | Q4 2026 – Q1 2027 | Draft SSP v0.2, control mapping v0.1, POA&M v0.1 |
+| Iterative build (Agile — matches OWC / DCYWP delivery cadence) | 2027 | Not started |
+| Independent Control Assessment (SCA) | Pre-Go-Live | Not scheduled |
+| Penetration test | Pre-Go-Live | Not scheduled |
+| ATO decision | Pre-Go-Live | Not scheduled |
+| **Go-Live** | Beginning of FY2027 per source RFP; effective slip acknowledged | Not started |
+
+## Compliance posture
+
+- **NIST SP 800-53 Rev. 5 Moderate baseline.**
+- **NIST SP 800-171 Rev. 2** for CUI handling.
+- **FIPS 140-3** target (140-2 acceptable during the deprecation window).
+- **FERPA** overlay for OSSE-sourced educational records.
+- **DC Code Title 4** for CFSA-sourced foster/ward records.
+- **SSA Electronic Information Exchange** requirements for SSN cross-match.
+- **Section 508 / WCAG 2.1 AA**.
+- **DC Language Access Act of 2004**.
+- **PCI DSS** — only if card processing is in scope (probably not).
+- **DC OCTO IT Security Policy**.
+
+## FIPS 199 (provisional)
+
+**Moderate / Moderate / Moderate**, with High-sensitivity data subsets (FERPA OSSE records, CFSA foster/ward flags, dormant COVID-era health records) treated by role-based least privilege rather than by pulling the aggregate rating up. The AO's FIPS 199 memo (`YPMS-POAM-001`) formalizes this.
+
+## What good looks like at Go-Live
+
+- Single youth portal from application through payroll for all OYP programs.
+- One host/employer portal.
+- One staff workspace replacing PF3 and the various admin tools.
+- Payroll runs off online time-tracking, not scripts and emails.
+- Reports run natively; MicroStrategy retired.
+- ATO signed by the DOES Director before production data flows in.
+- OSSE and CFSA exchanges in place with executed agreements.
+- Sentinel receiving telemetry via DC OCTO.
+- Daily backups running with tested restore.
+- POA&M managed and reviewed monthly.