Initial YPMS planning and ATO artifacts

Pre-development state; no code yet.

Delivery model: in-house build by DOES OIT on Azure Government,
matching the DCYWP / OWC / Employer 360 pattern.

Stack decision (2026-09-30): Python 3.12 / FastAPI / SQLAlchemy /
Postgres, aligning with OWC.

System Owner / ISSO / AO: Chris Tonjes (DOES CIO). Role concentration
recorded in SSP §5 with risk-acceptance rationale.

Source functional and security requirements derived from the prior
YPMS RFP (Solicitation Docxxxxx, April 2025) — 54 C.5.7 security
requirements and Appendix E non-functional requirements — treated as
source specifications, not as Contractor obligations.

Documents included:

- CLAUDE.md, OVERVIEW.md — project router and program-level summary
- SYSTEM_SECURITY_PLAN.md v0.3 — NIST 800-53 Moderate baseline SSP
- NIST_800_53_CONTROL_MAPPING.md v0.2 — full control-family mapping
  with in-house ownership tags and evidence-artifact expectations
- POAM.md v0.1 — 62-item POA&M seeded from tailorings, open decisions,
  missing companion docs, and pre-ATO deliverables; two items closed
- PRIVACY_IMPACT_ASSESSMENT.md v0.1 — full PIA covering minors, SSN,
  banking, FERPA-covered OSSE records, CFSA foster/ward flags, and
  the dormant emergency health-record path
- ARCHITECTURE.md v0.1 — forward-looking design blueprint, OWC-aligned
- PHASE0_PLAN.md v0.1 — framework vendor-in, auth, RBAC, audit,
  Registrant vertical slice, 501 stubs for remaining entities
- TODO.md — 12-section working checklist tied to POA&M IDs
- OLA_RESPONSE_2026-09-30.md — Q&A for OLA / City Administrator

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

TODO.md

@@ -0,0 +1,190 @@
+# YPMS — TODO Checklist
+
+**Owner:** DOES CIO
+**Last touched:** 2026-09-30
+**Scope:** everything from team formation through Go-Live and steady-state operations. Companion tracker: [`POAM.md`](POAM.md) holds the numbered, dated, milestone-tracked version of the ATO items below.
+
+Legend: `[ ]` open · `[~]` in progress · `[x]` done · `[!]` blocked · `[?]` needs decision
+
+---
+
+## 0. Team formation and governance
+
+- [x] ISSO assigned in writing for YPMS (Chris Tonjes; `YPMS-POAM-090` closed 2026-09-30)
+- [x] AO designated in writing (Chris Tonjes; `YPMS-POAM-002` closed 2026-09-30; role-concentration acceptance in SSP §5)
+- [ ] Business Owner named (OYP)
+- [ ] DOES OIT delivery lead named
+- [ ] Backend engineer(s) assigned
+- [ ] Frontend engineer(s) assigned
+- [ ] Data/integration engineer assigned (owns OSSE, CFSA, SSA, DC MAR, payroll)
+- [ ] Test/QA lead assigned
+- [ ] DC OCTO cloud coordination POC identified
+
+## 1. Stack and architecture decisions
+
+- [x] **Stack decision** — Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment; recorded 2026-09-30)
+- [x] Azure Government confirmed as hosting (aligned with OWC and Employer 360)
+- [?] **Level 3 security clarification** — source RFP `C.5.7.24` (`YPMS-POAM-051`)
+- [?] **Youth identity model** — social-media login scope, IAL2-equivalent proofing before payroll actions, parental co-auth for under-18 (`YPMS-POAM-050`)
+- [?] **PCI DSS applicability** — expected out of scope since payroll is ACH via vendor (`YPMS-POAM-052`)
+- [?] **Health-record CSV path disposition** — in-boundary vs. emergency extension (`YPMS-POAM-053`)
+- [?] **Retention policy** — audit logs, case records, backups (`YPMS-POAM-054`)
+- [ ] SORN applicability determination (`YPMS-POAM-094`)
+- [ ] Correct the youth-age typo from the source RFP (glossary says "99–24"; should be 14–24) in derived requirements
+- [x] High-level architecture document v0.1 drafted (`ypms/ARCHITECTURE.md`, 2026-09-30)
+- [x] Conceptual data model in `ARCHITECTURE.md` §6 (25 core entities enumerated); logical + physical ERDs remain
+- [ ] Logical and physical ERDs, full data dictionary, CRUD matrix (extends `ARCHITECTURE.md` §6)
+- [ ] Security architecture review with DC OCTO (referenced in `ARCHITECTURE.md` §8)
+
+## 2. Environments and pipeline
+
+- [ ] Azure Government subscription requested and provisioned (`YPMS-POAM-041`)
+- [ ] Dev environment
+- [ ] Test environment
+- [ ] Production environment (later)
+- [ ] CIS Azure Foundations baseline applied to all environments
+- [ ] Azure Key Vault (FIPS 140-3 HSM) provisioned (`YPMS-POAM-032`)
+- [ ] Managed Identity model for service-to-service auth
+- [ ] Postgres flexible server provisioned (private endpoint)
+- [ ] Git repo initialized under `ypms/` (this directory) with branch protection
+- [ ] CI/CD pipeline scaffold (`YPMS-POAM-042`)
+  - [ ] Build + unit-test gate
+  - [ ] SAST gate
+  - [ ] SCA (dependency vulnerability) gate
+  - [ ] Secret scanning gate
+  - [ ] SBOM generation per release (CycloneDX)
+  - [ ] Container image scanning
+- [ ] Sentinel integration for log streaming (`YPMS-POAM-043`)
+- [ ] Backup + restore procedure documented and tested (`YPMS-POAM-044`)
+
+## 3. Data-sharing agreements & interconnections
+
+Existing DOES agreements cover the current OYP workflows; YPMS-scope amendments or renewals are the path, not new drafts.
+
+- [ ] **DOES–OSSE data-sharing agreement (FERPA)** — renewal / YPMS-scope amendment (`YPMS-POAM-020`) — **blocks OSSE ingest build**
+- [ ] **DOES–CFSA MOU (DC Code Title 4)** — renewal / YPMS-scope amendment (`YPMS-POAM-021`) — **blocks CFSA ingest build**
+- [ ] **SSA Electronic Information Exchange agreement** — renewal / YPMS-scope confirmation (`YPMS-POAM-022`) — **blocks SSN cross-match build**
+- [ ] **DC MAR service agreement** — confirm coverage under existing OCTO umbrella
+- [ ] **Payroll vendor selection + security review + ISA/DPA** (`YPMS-POAM-023`) — **blocks payroll integration build**
+- [ ] **LMS vendor selection + security review** — blocks orientation-tracking build
+- [ ] **DC OCTO Sentinel MOU / ingestion agreement**
+- [ ] **NOC coordination arrangement** — 30-day maintenance-window notice cadence
+- [ ] **Emergency health-record CSV path** — either MOU with source or scoping decision to defer (`YPMS-POAM-053`)
+- [ ] ISAs / NIST 800-47 Rev. 1 documents for each of the above (`YPMS-POAM-084`)
+
+## 4. ATO artifacts
+
+- [x] Draft SSP v0.3 (`ypms/SYSTEM_SECURITY_PLAN.md`) — in-house build reframe complete (`YPMS-POAM-010`)
+- [x] Draft NIST 800-53 control mapping v0.2 (`ypms/NIST_800_53_CONTROL_MAPPING.md`) — in-house build reframe complete (`YPMS-POAM-015`)
+- [x] Draft POA&M v0.1 (`ypms/POAM.md`) — reflects in-house build model
+- [ ] **FIPS 199 categorization memo** signed by AO (`YPMS-POAM-001`)
+- [x] **Privacy Impact Assessment v0.1 drafted** (`YPMS-POAM-011`; `ypms/PRIVACY_IMPACT_ASSESSMENT.md`; 2026-09-30) — awaiting Privacy Officer + OGC review, then AO signature
+- [ ] **Incident Response Plan** — tabletop with DC OCTO SOC (`YPMS-POAM-012`)
+- [ ] **Contingency Plan** — functional restore drill (`YPMS-POAM-013`)
+- [ ] **Rules of Behavior** — staff / host / youth+parent variants with parental-consent flow (`YPMS-POAM-014`)
+- [ ] **Continuous Monitoring Strategy** document (`YPMS-POAM-074`)
+- [ ] **Independent Control Assessment (SCA)** commissioned and executed (`YPMS-POAM-060`)
+- [ ] **Penetration test** commissioned and executed (`YPMS-POAM-061`)
+- [ ] **ATO decision package** compiled and submitted to AO
+- [ ] **ATO signed** before production data flows in
+
+## 5. Build
+
+Iterative Agile delivery (Scrum/Kanban/SAFe — match OWC's phased approach). Illustrative phase breakdown; refine at architecture kickoff.
+
+- [ ] **Phase 1 — Foundation.** Auth, user model, RBAC, base UI shell, admin skeleton, audit-logging framework.
+- [ ] **Phase 2 — Application intake.** Youth registration, application form, save/resume, document upload with malware scanning.
+- [ ] **Phase 3 — Eligibility engine.** Rules-driven auto-eligibility from Appendix D of source RFP; categorical eligibility across programs.
+- [ ] **Phase 4 — External integrations.** DC MAR address verification, SSA SSN verify (blocked on `YPMS-POAM-022`), OSSE ingest (blocked on `YPMS-POAM-020`), CFSA ingest (blocked on `YPMS-POAM-021`).
+- [ ] **Phase 5 — Certification and orientation.** Certification event workflow, LMS integration.
+- [ ] **Phase 6 — Host/employer.** Host registration, worksite management, job posting.
+- [ ] **Phase 7 — Matching and enrollment.** Job matching engine, program enrollment.
+- [ ] **Phase 8 — Time and payroll.** Online timekeeping, payroll vendor integration (blocked on `YPMS-POAM-023`), transportation vouchers, tax forms.
+- [ ] **Phase 9 — Reporting.** Native reports replacing MicroStrategy; audit-log search.
+- [ ] **Phase 10 — Admin functions.** Broadcast notifications, workflow rule maintenance, user profile management.
+
+## 6. Security implementation (crosscuts all phases)
+
+- [ ] MFA for staff and admin (Entra ID conditional access) (`YPMS-POAM-030`)
+- [ ] TLS 1.2+ enforced everywhere; SSL Labs A+ on public endpoints (`YPMS-POAM-031`)
+- [ ] FIPS 140-3 cryptography (`YPMS-POAM-032`)
+- [ ] IAL2-equivalent identity proofing before payroll actions (`YPMS-POAM-033`)
+- [ ] SSN masking + at-rest encryption (`YPMS-POAM-080`)
+- [ ] System-use notification banner (`YPMS-POAM-070`)
+- [ ] Auto-disable inactive accounts (`YPMS-POAM-071`)
+- [ ] Quarterly privileged-access recert process (`YPMS-POAM-072`)
+- [ ] Annual all-user access recert process (`YPMS-POAM-073`)
+- [ ] Language Access Act compliance (`YPMS-POAM-081`)
+- [ ] Section 508 / WCAG 2.1 AA compliance audit (`YPMS-POAM-082`)
+- [ ] Parental consent workflow for under-18 (`YPMS-POAM-083`)
+- [ ] Anti-bot / rate-limit for MBSYEP peak windows (`YPMS-POAM-101`)
+
+## 7. Testing
+
+- [ ] Unit-test coverage target set and enforced in CI
+- [ ] Functional tests per feature
+- [ ] Non-functional tests: performance (99.5% SLA envelope, <1s response), load (50%/year growth headroom)
+- [ ] Accessibility tests (Section 508)
+- [ ] Language-access tests
+- [ ] UAT plan and test scripts approved
+- [ ] Vulnerability scanning cadence in production (`YPMS-POAM-062`)
+
+## 8. Legacy retirement & data migration
+
+- [ ] Data-migration plan from each of the seven legacy tools (`YPMS-POAM-105`)
+- [ ] Data-quality baselines documented per source
+- [ ] PII handling during migration
+- [ ] Cutover strategy — big-bang vs. phased-by-program
+- [ ] Read-only archive of legacy data for audit / statute-of-limitations retention
+- [ ] Legacy system decommission schedule and destruction evidence (`YPMS-POAM-106`)
+
+## 9. Training & change management
+
+- [ ] Training plan for OYP staff, host/employer, youth self-service (`YPMS-POAM-091`)
+- [ ] System overview intro video (MP4, closed captioned)
+- [ ] Role-based training materials
+- [ ] Help / KB content with an updateable help system
+
+## 10. Go-Live & steady-state
+
+- [ ] Go/No-Go decision meeting with AO
+- [ ] Cutover runbook rehearsed
+- [ ] Go-Live
+- [ ] Post-Go-Live retrospective
+
+## 11. Continuous monitoring (steady-state cadence)
+
+- [ ] Monthly vulnerability scans
+- [ ] Monthly POA&M review by DOES ISSO
+- [ ] Quarterly privileged access recertification
+- [ ] Annual full access recertification
+- [ ] Annual Contingency Plan test (tabletop + functional element)
+- [ ] Annual Independent Control Assessment
+- [ ] Annual penetration test
+- [ ] Annual SSP refresh
+- [ ] Monthly availability performance report against 99.5% SLA
+
+---
+
+## Immediate next actions (this week)
+
+1. ~~SSP v0.3 in in-house build framing~~ ✓
+2. ~~Control mapping v0.2 in in-house build framing~~ ✓
+3. ~~POA&M v0.1 seeded~~ ✓
+4. ~~ISSO / AO / System Owner: Chris Tonjes (with role-concentration risk acceptance)~~ ✓
+5. ~~Stack: Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment)~~ ✓
+6. ~~Draft the PIA — minors + FERPA + CFSA is the substantive part~~ ✓ (v0.1 drafted 2026-09-30)
+7. Get **existing OSSE, CFSA, and SSA agreements pulled from OGC files** to scope renewals (`YPMS-POAM-020`, `YPMS-POAM-021`, `YPMS-POAM-022`)
+8. Draft the **FIPS 199 categorization memo** for AO signature (`YPMS-POAM-001`)
+9. ~~Start the architecture document~~ ✓ (`ypms/ARCHITECTURE.md` v0.1 drafted 2026-09-30)
+10. Route PIA v0.1 to Privacy Officer + OGC review
+11. ~~Author PHASE0_PLAN.md~~ ✓ (`ypms/PHASE0_PLAN.md` v0.1 drafted 2026-09-30)
+12. DC OCTO security architecture review meeting scheduled
+
+## Parking lot (not yet triaged)
+
+- Emerging-tech (GenAI/ML) posture — ethical measures required; data must stay in DOES domain (`YPMS-POAM-103`)
+- FOIA response workflow with PII redaction (`YPMS-POAM-102`)
+- Records schedule alignment with DOES records officer
+- Approved-software list governance (`YPMS-POAM-100`)
+- Employer 360 dependency: once E360 lands, YPMS host/employer records should consume it rather than re-implementing employer matching