chris.tonjes/YPMS
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 0 milestone 0.9: docs + acceptance
ci / test (push) Has been cancelled
Details

Browse Source 
- README rewritten: Docker and native quickstarts, try-it flow, gate
  commands, promote-a-stub steps.
- CONTRIBUTING rules 9-13 (pii_read on PII reads, __audit_redact__ for
  encrypted columns, retention policy per table, models.py registry,
  vendored-code change discipline); PR checklist updated.
- docs/nist-mapping.md: per-control file:line evidence and remaining gap.
- NIST_800_53_CONTROL_MAPPING.md v0.3: Phase 0 notes on 28 rows
  (12 implemented, 12 partial, 4 progress notes on hybrid/tailored rows)
  plus a status-shift table.
- PHASE0_PLAN: 0.9 complete; Definition of Done 12/14 checked with how
  each was verified. Open: first green Gitea CI run, Docker/Postgres boot.
- POA&M and status handoff updated; status TL;DR no longer claims an
  unverified Docker boot.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Chris TonjesandClaude Opus 5.5 committed 2026-10-01 14:37:40 -04:00
1 parent 99a50dc86c
commit e3c4cb0cdc
7 files changed
+241 -111
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

NIST_800_53_CONTROL_MAPPING.md
+46 -30
View File
@@ -2,8 +2,8 @@
**System:** Youth Program Management System (YPMS)
**System Owner:** District of Columbia Department of Employment Services (DOES)
**Document version:** 0.2 (draft — in-house build reframe)
**Date:** 2026-09-30
**Document version:** 0.3 (draft — Phase 0 evidence populated)
**Date:** 2026-10-01
**Author:** DOES CIO
**Companion to:** [`SYSTEM_SECURITY_PLAN.md`](SYSTEM_SECURITY_PLAN.md)
@@ -85,6 +85,22 @@ The Moderate baseline contains ~261 controls including enhancements; the ~80 not
Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materializes; refresh at every phase gate.
### Phase 0 status shift (2026-10-01)
Rows touched by Phase 0 code. Each carries a dated **Phase 0** note with file:line evidence and the remaining gap; the same list with links is in [`docs/nist-mapping.md`](docs/nist-mapping.md). Rows whose status is 🤝 or ⚠️ keep it and gain a progress note.
| Family | ✅ Implemented | 🟡 Partial | Note only (🤝 / ⚠️ kept) |
|---|---:|---:|---:|
| AC | 5 | 2 | — |
| AU | 4 | 1 | 1 |
| CM | — | 1 | 1 |
| IA | 1 | 3 | — |
| RA | — | 1 | — |
| SA | — | 1 | — |
| SC | — | 3 | 1 |
| SI | 2 | — | 1 |
| **Totals** | **12** | **12** | **4** |
---
## 4. Detailed Control Mapping
@@ -94,23 +110,23 @@ Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materia
| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **AC-1 Policy and Procedures** | 📋 | D | — | DOES OCTO IT Security Policy applies (`C.5.7.53`). DOES ISSO owns YPMS access-control procedure document. **Evidence:** signed DOES Access Control Policy, RoB (`ypms/RULES_OF_BEHAVIOR.md`). |
| **AC-2 Account Management** | 📝 | O | `C.5.7.4`, `C.5.7.5`, `C.5.7.7`, `C.5.7.29`, `C.5.7.47` | Admin enable/disable; auto-disable on inactivity; 12–64 char alphanumeric IDs; group + individual assignment via Entra ID; no re-issue of deleted or previously-assigned IDs. **Evidence:** account-lifecycle event samples from Sentinel; documented account-provisioning workflow in `ypms/RULES_OF_BEHAVIOR.md`; quarterly access-recert records; DOES OIT personnel-access roster per source RFP `C.5.8.16`, `C.5.8.17` adopted as internal policy. |
| **AC-2 Account Management** | 🟡 | O | `C.5.7.4`, `C.5.7.5`, `C.5.7.7`, `C.5.7.29`, `C.5.7.47` | Admin enable/disable; auto-disable on inactivity; 12–64 char alphanumeric IDs; group + individual assignment via Entra ID; no re-issue of deleted or previously-assigned IDs. **Evidence:** account-lifecycle event samples from Sentinel; documented account-provisioning workflow in `ypms/RULES_OF_BEHAVIOR.md`; quarterly access-recert records; DOES OIT personnel-access roster per source RFP `C.5.8.16`, `C.5.8.17` adopted as internal policy. **Phase 0 (2026-10-01):** User model with active flag; inactive accounts rejected at authentication. Evidence: `src/ypms/users/models.py:48`, `src/ypms/auth/deps.py:43`. Gap: No admin enable/disable endpoint (admin module, Phase 8); inactivity auto-disable is YPMS-POAM-071. |
| **AC-2(1) Automated Account Management** | 📝 | O | `C.5.7.4`, `C.5.7.31` | Automated inactivity-disable; real-time and scheduled access-right changes. **Evidence:** configuration screenshot of inactivity threshold; audit log showing an auto-disable event. |
| **AC-2(3) Disable Inactive Accounts** | 📝 | O | `C.5.7.4` | Organization-defined inactivity threshold (`[TBD]` — recommend 90 days for staff, 180 days for youth accounts). **Evidence:** configured threshold value + audit sample. |
| **AC-2(4) Automated Audit Actions** | 📝 | O | `C.5.7.36`, `C.5.7.39` | All account create/modify/enable/disable/remove actions auto-logged. **Evidence:** log samples. |
| **AC-3 Access Enforcement** | 📝 | O | `C.5.7.21`, `C.5.7.27`, `C.5.7.28`, `C.5.7.31`, `C.5.7.48` | Server-side authorization on every action; admin-only view/change of access rights; enforce authorizations per access-control policies. **Evidence:** access-control matrix showing every role × object; penetration-test evidence that unauthenticated and lower-role users cannot reach protected functions. |
| **AC-3 Access Enforcement** | ✅ | O | `C.5.7.21`, `C.5.7.27`, `C.5.7.28`, `C.5.7.31`, `C.5.7.48` | Server-side authorization on every action; admin-only view/change of access rights; enforce authorizations per access-control policies. **Evidence:** access-control matrix showing every role × object; penetration-test evidence that unauthenticated and lower-role users cannot reach protected functions. **Phase 0 (2026-10-01):** `require_permission` runs on every protected route, including all 208 stub routes; portal-only callers restricted to their own Registrant row. Evidence: `src/ypms/security/rbac.py:46`, `src/ypms/youth/router.py:67`, `tests/test_stubs.py`. Gap: Row-level scoping beyond Registrant is Phase 2+. |
| **AC-4 Information Flow Enforcement** | 📝 | O | `C.5.7.23` | Trusted / transition / untrusted zone segmentation; untrusted systems cannot reach trusted-zone systems directly. **Evidence:** network architecture diagram (from the DOES OIT architecture document — `YPMS-POAM-040`); Azure NSG / firewall rule export. |
| **AC-6 Least Privilege** | 📝 | O | `C.5.7.32`, `C.5.7.33`, `C.5.7.34` | RBAC over defined objects; one login per staff, role-mediated access; admin maintains role-based security. CFSA foster/ward data and OSSE FERPA records reachable only by role-flagged users. **Evidence:** role catalogue with data-class access mapping. |
| **AC-6(1) Authorize Access to Security Functions** | 📝 | O | `C.5.7.28` | Only administrators can view/change access rights. **Evidence:** role catalogue. |
| **AC-6 Least Privilege** | ✅ | O | `C.5.7.32`, `C.5.7.33`, `C.5.7.34` | RBAC over defined objects; one login per staff, role-mediated access; admin maintains role-based security. CFSA foster/ward data and OSSE FERPA records reachable only by role-flagged users. **Evidence:** role catalogue with data-class access mapping. **Phase 0 (2026-10-01):** Data-driven RBAC (8 roles × 30 entities × 8 actions); FERPA/CFSA entities limited to ELIGIBILITY_EXAMINER; super-role explicit. Evidence: `src/ypms/seed/permissions_matrix.json`, `src/ypms/security/rbac.py:22`, `tests/test_stubs.py`. Gap: Four matrix review items open (PHASE0_STATUS.md). |
| **AC-6(1) Authorize Access to Security Functions** | ✅ | O | `C.5.7.28` | Only administrators can view/change access rights. **Evidence:** role catalogue. **Phase 0 (2026-10-01):** Only DOES_SYSTEM_ADMIN holds RBAC-table rights (User/Role not granted to any other role). Evidence: `src/ypms/seed/permissions_matrix.json`. |
| **AC-6(2) Non-Privileged Access for Non-Security Functions** | 📝 | O | `C.5.7.33` | Staff use non-privileged accounts by default for routine work. **Evidence:** account-inventory review. |
| **AC-6(5) Privileged Accounts** | 📝 | O | | Named, approved list of privileged users. **Evidence:** privileged-user roster + quarterly recert. |
| **AC-6(9) Log Use of Privileged Functions** | 📝 | O | `C.5.7.36` | Auto-log all admin actions including account create/modify/enable/disable/remove. **Evidence:** log samples. |
| **AC-6(10) Prohibit Non-Privileged Users from Executing Privileged Functions** | 📝 | O | `C.5.7.27`, `C.5.7.32` | Enforced server-side. **Evidence:** pentest evidence. |
| **AC-7 Unsuccessful Logon Attempts** | 📝 | O | `C.5.7.10`, `C.5.7.11` | Lockout after 5 attempts; user notified on revocation. **Evidence:** configured threshold; audit sample of a lockout event and notification. |
| **AC-6(10) Prohibit Non-Privileged Users from Executing Privileged Functions** | ✅ | O | `C.5.7.27`, `C.5.7.32` | Enforced server-side. **Evidence:** pentest evidence. **Phase 0 (2026-10-01):** Delete and Restore (super-role only today) and Registrant VersionHistory (OYP_STAFF and ELIGIBILITY_EXAMINER only) enforced server-side; 403 asserted for every other role. Evidence: `src/ypms/security/rbac.py:29`, `tests/test_stubs.py`, `tests/youth/test_registrant_api.py`. |
| **AC-7 Unsuccessful Logon Attempts** | 🟡 | O | `C.5.7.10`, `C.5.7.11` | Lockout after 5 attempts; user notified on revocation. **Evidence:** configured threshold; audit sample of a lockout event and notification. **Phase 0 (2026-10-01):** 5 failed logins per source IP per 15 minutes → 429; every failure (bad credentials, unknown user, inactive, throttled) audited as `login_failed`. Evidence: `src/ypms/auth/rate_limit.py:47`, `src/ypms/auth/router.py:86`, `src/ypms/auth/router.py:65`. Gap: Per-account lockout (`locked_until`) and user notification not built; in-memory limiter is per-process. |
| **AC-8 System Use Notification** | 📝 | O | `C.5.7.37` | Notification banner before granting access. **Evidence:** screenshot of banner; DOES-approved banner text on file. |
| **AC-11 Session Lock** | 📝 | O | `C.5.7.3` | Idle-timeout session lock with re-authentication. **Evidence:** configured timeout value. |
| **AC-11(1) Pattern-Hiding Displays** | 📝 | O | | Screen obscured on lock. **Evidence:** UX walkthrough. |
| **AC-12 Session Termination** | 📝 | O | `C.5.7.3` | Idle session termination with re-authentication. **Evidence:** configured timeout value; log sample of a session-terminated event. |
| **AC-12 Session Termination** | ✅ | O | `C.5.7.3` | Idle session termination with re-authentication. **Evidence:** configured timeout value; log sample of a session-terminated event. **Phase 0 (2026-10-01):** Access tokens expire (default 60 min, `exp` claim verified); refresh tokens cannot access resources. Evidence: `src/ypms/auth/security.py:59`, `src/ypms/auth/deps.py:35`. Gap: Idle-timeout UI behaviour lands with the portal (Phase 3). |
| **AC-14 Permitted Actions Without Identification or Authentication** | 📝 | O | | Limited to public content (program info, job postings, application intake as unauthenticated entry). **Evidence:** enumeration of unauthenticated endpoints. |
| **AC-17 Remote Access** | 🤝 | O, D | | All access is remote by architecture. MFA required for staff and admin via Entra ID conditional access (see IA-2). **Evidence:** Entra CA policy export; endpoint-compliance policy (source RFP `C.5.6.30`). |
| **AC-17(1) Monitoring and Control** | 📝 | O | `C.5.6.9` #19 | SIEM monitoring of remote access. **Evidence:** SIEM feed. |
@@ -135,18 +151,18 @@ Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materia
| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **AU-1 Policy and Procedures** | 📋 | D | `C.5.7.53` | DOES OCTO logging policy applies. **Evidence:** policy. |
| **AU-2 Event Logging** | 📝 | O | `C.5.7.39`, `C.5.6.9` #4 | Comprehensive event set: root/admin actions, audit-log access/modification, successful and unsuccessful logon attempts, password changes, system-level object create/delete, all PII/sensitive-data interactions, role changes, shutdown/restart, file access authorized and unauthorized, user logon events, plus DOES-defined additions. **Evidence:** event-catalog document; SIEM sample stream. |
| **AU-3 Content of Audit Records** | 📝 | O | `C.5.7.15`, `C.5.7.48`, `C.5.7.49`, `C.5.6.9` #8, #11, #12, #13 | What/when/where/source/outcome/identity; sufficient to reconstruct events; unique transaction ID per transaction; before-and-after transaction history; communication send/access logging. **Evidence:** log-record specification; log sample. |
| **AU-2 Event Logging** | 🟡 | O | `C.5.7.39`, `C.5.6.9` #4 | Comprehensive event set: root/admin actions, audit-log access/modification, successful and unsuccessful logon attempts, password changes, system-level object create/delete, all PII/sensitive-data interactions, role changes, shutdown/restart, file access authorized and unauthorized, user logon events, plus DOES-defined additions. **Evidence:** event-catalog document; SIEM sample stream. **Phase 0 (2026-10-01):** Audited today: login success/failure, password change, every create/update/delete/restore, every PII read, every stub invocation, each retention run. Evidence: `src/ypms/audit/service.py:17`, `src/ypms/framework/crud.py:111`, `src/ypms/auth/router.py:65`, `src/ypms/auth/router.py:104`. Gap: Event catalogue items not yet applicable (role changes, shutdown, file access) arrive with their features. |
| **AU-3 Content of Audit Records** | ✅ | O | `C.5.7.15`, `C.5.7.48`, `C.5.7.49`, `C.5.6.9` #8, #11, #12, #13 | What/when/where/source/outcome/identity; sufficient to reconstruct events; unique transaction ID per transaction; before-and-after transaction history; communication send/access logging. **Evidence:** log-record specification; log sample. **Phase 0 (2026-10-01):** Each row: actor id + username, action, entity, entity id, before/after, timestamp, IP; app-layer ciphertext redacted from before/after. Evidence: `src/ypms/audit/models.py:18`, `src/ypms/framework/crud.py:46`. Gap: Request id is in logs, not yet on the audit row. |
| **AU-3(1) Additional Audit Information** | 📝 | O | | Extended fields for financial-adjustment events (payroll approval, banking change, eligibility change). **Evidence:** log sample. |
| **AU-4 Audit Log Storage Capacity** | 📝 | O | | Sized for `[TBD]` retention (see AU-11). **Evidence:** capacity plan. |
| **AU-5 Response to Audit Logging Process Failures** | 📝 | O | `C.5.7.26`, `C.5.6.9` #23 | Alerts to admins and additional roles on security compromise; user-account lockout alerts; logging-pipeline health monitoring. **Evidence:** runbook + alert-configuration screenshot. |
| **AU-6 Audit Record Review, Analysis, and Reporting** | 🤝 | O, D | `C.5.6.9` #19–22 | Sentinel aggregation into meaningful security intelligence; alerts on business-rule/workflow thresholds. DC OCTO SOC consumes the feed. **Evidence:** Sentinel correlation-rule inventory; SOC alert-triage runbook. |
| **AU-7 Audit Record Reduction and Report Generation** | 📝 | O | `C.5.6.9` #20 | Configurable aggregation and reporting. **Evidence:** report templates. |
| **AU-8 Time Stamps** | 📝 | O | `C.5.7.40` | All critical system times synchronized. **Evidence:** NTP configuration; sample logs showing consistent UTC/ISO-8601 timestamps. |
| **AU-8 Time Stamps** | ✅ | O | `C.5.7.40` | All critical system times synchronized. **Evidence:** NTP configuration; sample logs showing consistent UTC/ISO-8601 timestamps. **Phase 0 (2026-10-01):** All timestamps timezone-aware UTC; Postgres container pinned to UTC. Evidence: `src/ypms/audit/models.py:24`, `docker-compose.yml:8`. Gap: NTP is inherited from Azure at deployment. |
| **AU-9 Protection of Audit Information** | 📝 | O | `C.5.7.41`, `C.5.6.9` #6 | Audit information and audit tools protected from unauthorized access, modification, and deletion; role-based access to audit logs. Sentinel ingestion moves logs to a separate trust boundary. **Evidence:** ACL export on audit store; Sentinel workspace RBAC. |
| **AU-11 Audit Record Retention** | 🤝 | O, D | `C.5.7.42` | Organization-defined; **DOES recommendation: 1 year online, 3 years archived** (align to DOES records schedule — `[TBD]`). **Evidence:** written retention policy; archive location and format. |
| **AU-12 Audit Record Generation** | 📝 | O | `C.5.7.39`, `C.5.6.9` #17, #18 | Automated audit trails for all system components; system-generated security audit trail; SANS Information Logging Standard compliance. **Evidence:** component inventory × logging coverage table. |
| **AU-14 Session Audit** | 📝 | O | `C.5.6.9` #5, #7 | Searchable log of all screens accessed by user; sensitive-data screen access monitored and recorded. **Evidence:** search-tool demo; log sample. |
| **AU-11 Audit Record Retention** | 🤝 | O, D | `C.5.7.42` | Organization-defined; **DOES recommendation: 1 year online, 3 years archived** (align to DOES records schedule — `[TBD]`). **Evidence:** written retention policy; archive location and format. **Phase 0 (2026-10-01):** Retention scaffold: audit log carries the PIA §9 interim policy (archive at 1 year); report-only job. Evidence: `src/ypms/retention_classes.py`, `src/ypms/framework/retention.py:150`. Gap: Period unapproved until YPMS-POAM-054; archive tier is deployment work. |
| **AU-12 Audit Record Generation** | ✅ | O | `C.5.7.39`, `C.5.6.9` #17, #18 | Automated audit trails for all system components; system-generated security audit trail; SANS Information Logging Standard compliance. **Evidence:** component inventory × logging coverage table. **Phase 0 (2026-10-01):** Audit generation is in the framework (CRUDService, stub router, auth), not per-handler. Evidence: `src/ypms/framework/crud.py:111`, `src/ypms/framework/stub_router.py:66`. |
| **AU-14 Session Audit** | ✅ | O | `C.5.6.9` #5, #7 | Searchable log of all screens accessed by user; sensitive-data screen access monitored and recorded. **Evidence:** search-tool demo; log sample. **Phase 0 (2026-10-01):** `pii_read` audit on Registrant GET, list (ids recorded), and history. Evidence: `src/ypms/framework/pii_audit.py:36`, `src/ypms/youth/router.py:99`, `src/ypms/youth/router.py:115`. Gap: Extends to Guardian/TaxDocument/Attachment as they are built. |
### CA — Assessment, Authorization, and Monitoring
@@ -170,13 +186,13 @@ Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materia
| **CM-2 Baseline Configuration** | 📝 | O | `C.5.6.13`, IEEE 828-2012 | Application baseline in the repo (Dockerfile / compose / IaC); DOES-approved tool/software list. **Evidence:** baseline files in `ypms/`; CM plan (see CM-9). |
| **CM-2(2) Automation Support for Accuracy and Currency** | 📝 | O | | IaC (Bicep or Terraform) maintains Azure baseline. **Evidence:** tool inventory; IaC repo path. |
| **CM-2(3) Retention of Previous Configurations** | 📝 | O | | Rollback-capable baseline history via git. **Evidence:** git log. |
| **CM-3 Configuration Change Control** | 🤝 | O, D | `C.5.6.13`, `C.5.6.17` | DOES CIO approves changes; 30-day advance notice for maintenance windows; NOC coordination; emergency-change track. **Evidence:** change-record register; monthly change-review minutes. |
| **CM-3 Configuration Change Control** | 🤝 | O, D | `C.5.6.13`, `C.5.6.17` | DOES CIO approves changes; 30-day advance notice for maintenance windows; NOC coordination; emergency-change track. **Evidence:** change-record register; monthly change-review minutes. **Phase 0 (2026-10-01):** Merged migrations pinned by SHA-256; CI fails on any edit. Every change ships through a reviewed commit. Evidence: `migrations/IMMUTABLE.sha256`, `tests/test_migration_immutability.py:31`. Gap: Maintenance-window process is organizational. |
| **CM-4 Impact Analysis** | 📝 | O | `C.5.8.12` | Required before database migrations affecting programs already in production. **Evidence:** impact-analysis template + sample; migration review discipline. |
| **CM-5 Access Restrictions for Change** | 📝 | O | | Only DOES OIT delivery leads have merge rights on `main`; branch protection + code review required. **Evidence:** git branch-protection settings; Entra group ACL. |
| **CM-6 Configuration Settings** | 📝 | O | `C.5.6.5`, `C.5.6.6`, `C.5.6.7` | Admin-configurable security controls; CA configuration; DB/space/performance configuration. DOES OIT establishes secure baseline (CIS Azure Foundations benchmark + DOES overlays). **Evidence:** baseline settings export; Azure Policy assignment. |
| **CM-7 Least Functionality** | 📝 | O | | Unused features disabled. **Evidence:** enabled-feature inventory. |
| **CM-7(1) Periodic Review** | 📝 | O | | Quarterly review of enabled features. **Evidence:** review record. |
| **CM-8 System Component Inventory** | 📝 | O | `C.5.6.13` | Comprehensive tool/software list with licensing and upgrade path. **Evidence:** SBOM (CycloneDX, per release, from CI) + tool inventory. |
| **CM-8 System Component Inventory** | 🟡 | O | `C.5.6.13` | Comprehensive tool/software list with licensing and upgrade path. **Evidence:** SBOM (CycloneDX, per release, from CI) + tool inventory. **Phase 0 (2026-10-01):** CycloneDX 1.6 SBOM of the runtime dependency set generated in CI. Evidence: `.gitea/workflows/ci.yml:70`. Gap: Pending first green CI run (Gitea runner); per-release retention of SBOMs not yet defined. |
| **CM-8(1) Updates During Installation and Removal** | 📝 | O | | Inventory auto-updated via CI pipeline. **Evidence:** tooling. |
| **CM-9 Configuration Management Plan** | 📝 | O | | `ypms/CONFIGURATION_MANAGEMENT_PLAN.md` (to be authored; also serves source RFP §C.5.12 Change Management Plan). **Evidence:** signed plan. |
| **CM-10 Software Usage Restrictions** | 📋 | D | `C.5.6.13` | DOES-approved software list; license terms respected. **Evidence:** approved-software list. |
@@ -205,15 +221,15 @@ Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materia
| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **IA-1 Policy and Procedures** | 📋 | D | | DOES identity policy. **Evidence:** policy. |
| **IA-2 Identification and Authentication (Organizational Users)** | 📝 | O | `C.5.7.38`, `C.5.7.36` | Unique user ID per user; admin actions tied to individual identity. **Evidence:** IdP integration record. |
| **IA-2 Identification and Authentication (Organizational Users)** | ✅ | O | `C.5.7.38`, `C.5.7.36` | Unique user ID per user; admin actions tied to individual identity. **Evidence:** IdP integration record. **Phase 0 (2026-10-01):** Every non-public route requires a valid bearer token bound to a unique, active user. Evidence: `src/ypms/auth/deps.py:25`. Gap: MFA enhancements (IA-2(1)/(2)) arrive with Entra ID in Phase 1. |
| **IA-2(1) MFA to Privileged Accounts** | ⚠️ | O | `C.5.7.6` | Source RFP `C.5.7.6` permits "unique identifier + shared secret answer" — **insufficient by NIST 800-63B AAL2**. **SSP tailors above the source RFP: MFA required for all privileged and staff accounts** via Entra ID conditional access. **Evidence:** Entra CA policy export; sample log showing MFA challenge (`YPMS-POAM-030`). |
| **IA-2(2) MFA to Non-Privileged Accounts** | ⚠️ | O | | Same tailoring: MFA for all staff-role accounts. **Evidence:** as IA-2(1). |
| **IA-2(8) Access to Accounts — Replay Resistant** | 📝 | O | | Modern MFA protocols. **Evidence:** protocol inventory. |
| **IA-2(12) Acceptance of PIV Credentials** | 📋 | D | | DC OCTO enterprise: no PIV in scope; DOES employee credentials via DOES SSO. **Evidence:** IdP config. |
| **IA-3 Device Identification and Authentication** | 📝 | O | | Device certificates for managed endpoints. **Evidence:** MDM cert deployment. |
| **IA-4 Identifier Management** | 📝 | O | `C.5.7.7`, `C.5.7.38`, `C.5.7.47` | 12-alphanumeric minimum; unique per user; no re-issue of deleted IDs. **Evidence:** IdP configuration; audit sample. |
| **IA-5 Authenticator Management** | 📝 | O | `C.5.7.8`, `C.5.7.12`, `C.5.7.13`, `C.5.7.14`, `C.5.7.45`, `C.5.7.46` | User-established and changeable passwords; admin reset with forced change; expiration; email/SMS notification on change; complexity/reuse/length policy; masked entry. **Evidence:** password-policy configuration; user-communication template. |
| **IA-5(1) Password-Based Authentication** | 📝 | O | `C.5.7.9`, `C.5.7.45` | FIPS 140-2 crypto (SSP tailors to FIPS 140-3 forward alignment); policy per RFP. **Evidence:** cryptographic-module cert; policy document. |
| **IA-4 Identifier Management** | 🟡 | O | `C.5.7.7`, `C.5.7.38`, `C.5.7.47` | 12-alphanumeric minimum; unique per user; no re-issue of deleted IDs. **Evidence:** IdP configuration; audit sample. **Phase 0 (2026-10-01):** Usernames unique (DB constraint); no user-delete path exists, so identifiers are never re-issued. Evidence: `migrations/versions/0002_framework_tables.py:54`. Gap: 12-character minimum identifier and explicit tombstoning arrive with registration (Phase 1). |
| **IA-5 Authenticator Management** | 🟡 | O | `C.5.7.8`, `C.5.7.12`, `C.5.7.13`, `C.5.7.14`, `C.5.7.45`, `C.5.7.46` | User-established and changeable passwords; admin reset with forced change; expiration; email/SMS notification on change; complexity/reuse/length policy; masked entry. **Evidence:** password-policy configuration; user-communication template. **Phase 0 (2026-10-01):** Users change their own password (12-character floor, current password required); hashes only. Evidence: `src/ypms/auth/router.py:138`, `src/ypms/auth/router.py:147`. Gap: Password-change notification (C.5.7.14) and admin reset arrive with notifications/admin. |
| **IA-5(1) Password-Based Authentication** | 🟡 | O | `C.5.7.9`, `C.5.7.45` | FIPS 140-2 crypto (SSP tailors to FIPS 140-3 forward alignment); policy per RFP. **Evidence:** cryptographic-module cert; policy document. **Phase 0 (2026-10-01):** PBKDF2-SHA256 (NIST SP 800-132) via passlib. Evidence: `src/ypms/auth/security.py:30`. Gap: FIPS 140-3 validated module is deployment-dependent (YPMS-POAM-032). |
| **IA-6 Authenticator Feedback** | 📝 | O | `C.5.7.46` | Masked password entry. **Evidence:** UI walkthrough. |
| **IA-7 Cryptographic Module Authentication** | 📝 | O | `C.5.7.9` | FIPS 140-2 validated modules (SSP tailors: FIPS 140-3 where available). **Evidence:** module cert; usage inventory. |
| **IA-8 Identification and Authentication (Non-Organizational Users)** | ❓ | O | `C.5.3.2`, `C.5.7.30` | Youth and host authentication; LDAP-compliant; social-media login option. **Open decision (SSP §17.D):** identity model for minors — recommend social-media login for browsing/pre-application only, with IAL2-equivalent identity proofing (Login.gov or SSA verification) before banking/payroll actions. **Evidence:** identity-flow design; risk-acceptance memo. |
@@ -349,7 +365,7 @@ Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materia
| **RA-2 Security Categorization** | 📋 | D | | `ypms/FIPS_199_MEMO.md`. |
| **RA-3 Risk Assessment** | 🤝 | O, D | | Initial RA before ATO; annually thereafter; on major change. **Evidence:** RA report. |
| **RA-3(1) Supply Chain Risk Assessment** | 📝 | O | | Third-party and fourth-party disclosure in architecture document. **Evidence:** SBOM + third/fourth-party register. |
| **RA-5 Vulnerability Monitoring and Scanning** | 📝 | O | `C.5.7.52` | Cyber-threat detection and remediation; authenticated and unauthenticated scans monthly; container image scans in CI on push (`YPMS-POAM-062`). **Evidence:** scan schedule + reports. |
| **RA-5 Vulnerability Monitoring and Scanning** | 🟡 | O | `C.5.7.52` | Cyber-threat detection and remediation; authenticated and unauthenticated scans monthly; container image scans in CI on push (`YPMS-POAM-062`). **Evidence:** scan schedule + reports. **Phase 0 (2026-10-01):** pip-audit on runtime dependencies gates CI; an unfixable `ecdsa` advisory was removed by changing JWT library. Evidence: `.gitea/workflows/ci.yml:59`. Gap: Pending first green CI run; infrastructure scanning is deployment work. |
| **RA-5(2) Update Vulnerabilities to be Scanned** | 📝 | O | | Feed updates. **Evidence:** feed configuration. |
| **RA-5(5) Privileged Access** | 📝 | O | | Authenticated scans with privileged access. **Evidence:** scan configuration. |
| **RA-7 Risk Response** | 📋 | D | | POA&M-driven. **Evidence:** POA&M. |
@@ -368,7 +384,7 @@ Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materia
| **SA-8 Security and Privacy Engineering Principles** | 📝 | O | | SSDLC adherence. **Evidence:** SSDLC document. |
| **SA-9 External System Services** | 📝 | O | `C.5.6.3` | Payroll, LMS, address verification, social-media IdPs, DC MAR — each with security assurance. **Evidence:** vendor register + SIG-Lite / SOC 2 collection. |
| **SA-10 Developer Configuration Management** | 📝 | O | `C.5.8.4`–`C.5.8.11` | Data-model deliverables (conceptual/logical/physical ERDs, data dictionary, integrity rules, CRUD matrix, denormalization rationale). **Evidence:** deliverables in `ypms/`. |
| **SA-11 Developer Testing and Evaluation** | 📝 | O | source RFP §C.5.10 | Unit / functional / non-functional / UAT with evidence. **Evidence:** test reports; CI test results. |
| **SA-11 Developer Testing and Evaluation** | 🟡 | O | source RFP §C.5.10 | Unit / functional / non-functional / UAT with evidence. **Evidence:** test reports; CI test results. **Phase 0 (2026-10-01):** 167 automated tests, 80% coverage floor, ruff, strict mypy, bandit SAST, migration-drift test. Evidence: `.gitea/workflows/ci.yml:53`, `.gitea/workflows/ci.yml:56`. Gap: Pending first green CI run. |
| **SA-15 Development Process, Standards, and Tools** | 📝 | O | | DOES OIT SSDLC standards. **Evidence:** SSDLC document. |
| **SA-22 Unsupported System Components** | 📝 | O | `C.5.6.13` | Third-party dependencies tracked in SBOM with upgrade path. **Evidence:** SBOM + upgrade-path statement. |
@@ -384,11 +400,11 @@ Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materia
| **SC-7(4) External Telecommunications Services** | 📝 | O | | Documented external services with ISAs. |
| **SC-7(5) Deny by Default / Allow by Exception** | 📝 | O | | Default-deny firewall posture. **Evidence:** ruleset export. |
| **SC-7(7) Split Tunneling for Remote Devices** | 📝 | O | | No split tunneling from managed devices. |
| **SC-8 Transmission Confidentiality and Integrity** | ⚠️ | O | `C.5.6.15`, `C.5.7.25`, `C.5.7.20` | Source RFP says SSL; **SSP tailors to TLS 1.2 minimum, TLS 1.3 preferred, FIPS-approved cipher suites**. All PII encrypted in transit. **Evidence:** SSL Labs–style report; TLS config (`YPMS-POAM-031`). |
| **SC-8 Transmission Confidentiality and Integrity** | ⚠️ | O | `C.5.6.15`, `C.5.7.25`, `C.5.7.20` | Source RFP says SSL; **SSP tailors to TLS 1.2 minimum, TLS 1.3 preferred, FIPS-approved cipher suites**. All PII encrypted in transit. **Evidence:** SSL Labs–style report; TLS config (`YPMS-POAM-031`). **Phase 0 (2026-10-01):** Not wired in Phase 0 (no local TLS proxy). Gap: TLS terminates at Front Door / App Gateway at deployment (YPMS-POAM-031). |
| **SC-8(1) Cryptographic Protection** | 📝 | O | `C.5.7.9` | FIPS 140-2/-3 cryptography for transmission. **Evidence:** module cert. |
| **SC-10 Network Disconnect** | 📝 | O | `C.5.7.3` | Idle-session network disconnect. **Evidence:** timeout config. |
| **SC-12 Cryptographic Key Establishment and Management** | 📝 | O | `C.5.7.9` | Key management via Azure Key Vault (Gov / HSM). **Evidence:** key-management design; rotation policy (`YPMS-POAM-032`). |
| **SC-13 Cryptographic Protection** | 📝 | O | `C.5.7.9`, `C.5.7.25` | FIPS 140-3 cryptography (140-2 acceptable during deprecation window) at rest and in transit. **Evidence:** module cert + usage map. |
| **SC-12 Cryptographic Key Establishment and Management** | 🟡 | O | `C.5.7.9` | Key management via Azure Key Vault (Gov / HSM). **Evidence:** key-management design; rotation policy (`YPMS-POAM-032`). **Phase 0 (2026-10-01):** Column key derived with HKDF-SHA256; ≥32-byte key material and ≥32-byte JWT secret enforced at startup. Evidence: `src/ypms/security/column_crypto.py:49`, `src/ypms/settings.py:15`. Gap: Keys come from env vars; Key Vault (Gov/HSM) in Phase 1. |
| **SC-13 Cryptographic Protection** | 🟡 | O | `C.5.7.9`, `C.5.7.25` | FIPS 140-3 cryptography (140-2 acceptable during deprecation window) at rest and in transit. **Evidence:** module cert + usage map. **Phase 0 (2026-10-01):** FIPS-approved algorithms only: AES-256-GCM, HKDF-SHA256, HMAC-SHA256 (JWT), PBKDF2-SHA256. Evidence: `src/ypms/security/column_crypto.py:55`. Gap: Validated-module status is deployment-dependent (YPMS-POAM-032). |
| **SC-15 Collaborative Computing Devices** | 📝 | O | | Camera/mic access disabled by default in workspace tooling. |
| **SC-17 Public Key Infrastructure Certificates** | 📝 | O | `C.5.6.5` | Certificate Authority configuration for integrations. **Evidence:** CA config. |
| **SC-18 Mobile Code** | 📝 | O | | Only signed mobile code allowed. |
@@ -396,7 +412,7 @@ Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materia
| **SC-21 Secure Name/Address Resolution Service (Recursive)** | 🔵 | I | | Inherited. |
| **SC-22 Architecture and Provisioning for Name/Address Resolution** | 🔵 | I | | Inherited. |
| **SC-23 Session Authenticity** | 📝 | O | `C.5.7.20` | Anti-CSRF, secure cookies, per-transaction integrity for financial actions. **Evidence:** session-management design. |
| **SC-28 Protection of Information at Rest** | 📝 | O | `C.5.7.25`, `C.5.7.50` | Encryption at rest for all PII (Postgres TDE + envelope encryption for blobs); SSN masked/anonymized in display (`YPMS-POAM-080`). **Evidence:** DB encryption config; SSN-handling design. |
| **SC-28 Protection of Information at Rest** | 🟡 | O | `C.5.7.25`, `C.5.7.50` | Encryption at rest for all PII (Postgres TDE + envelope encryption for blobs); SSN masked/anonymized in display (`YPMS-POAM-080`). **Evidence:** DB encryption config; SSN-handling design. **Phase 0 (2026-10-01):** SSN encrypted at the app layer (AES-256-GCM, column-bound AAD); write-only on the model; masked in every response. Evidence: `src/ypms/security/column_crypto.py:55`, `src/ypms/youth/models.py:83`. Gap: Banking columns not yet built; Postgres TDE and blob encryption are deployment. |
| **SC-28(1) Cryptographic Protection** | 📝 | O | `C.5.7.9` | FIPS-approved cryptography for at-rest data via Azure Key Vault. **Evidence:** module cert. |
| **SC-39 Process Isolation** | 🔵 | I | | Inherited from IaaS + COTS platform. |
@@ -416,9 +432,9 @@ Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materia
| **SI-7 Software, Firmware, and Information Integrity** | 📝 | O | | Signed artifacts + integrity checks on deploy. |
| **SI-7(1) Integrity Checks** | 📝 | O | | On startup and periodically. |
| **SI-8 Spam Protection** | 🤝 | O, D | | Inbound-email spam protection at DOES enterprise level. |
| **SI-10 Information Input Validation** | 📝 | O | `C.5.7.44`, `C.5.6.2`, `C.5.6.3.b`, `C.5.6.3.d` | Character set / length / numerical range / format / content validation with trusted-source restriction; address, age, residency data checks; SSA SSN verification; DC MAR address validation. **Evidence:** input-validation rules; sample validation-failure log. |
| **SI-11 Error Handling** | 📝 | O | `C.5.7.43`, `C.5.6.9` #2, #3 | Corrective information without adversary-exploitable disclosure; consistent error handling; all errors logged. **Evidence:** error-response inventory. |
| **SI-12 Information Management and Retention** | 🤝 | O, D | | Aligned with DOES records schedule. **Evidence:** retention policy. |
| **SI-10 Information Input Validation** | ✅ | O | `C.5.7.44`, `C.5.6.2`, `C.5.6.3.b`, `C.5.6.3.d` | Character set / length / numerical range / format / content validation with trusted-source restriction; address, age, residency data checks; SSA SSN verification; DC MAR address validation. **Evidence:** input-validation rules; sample validation-failure log. **Phase 0 (2026-10-01):** Pydantic validation on every request body; SSN format and never-issued ranges, DOB, ZIP, email, lengths. Evidence: `src/ypms/youth/schemas.py:21`. |
| **SI-11 Error Handling** | ✅ | O | `C.5.7.43`, `C.5.6.9` #2, #3 | Corrective information without adversary-exploitable disclosure; consistent error handling; all errors logged. **Evidence:** error-response inventory. **Phase 0 (2026-10-01):** Unhandled errors return a generic body with request id; logs record type and frames, not messages; SQL parameters hidden. Evidence: `src/ypms/main.py:56`, `src/ypms/db.py:24`, `tests/test_app_guards.py`. |
| **SI-12 Information Management and Retention** | 🤝 | O, D | | Aligned with DOES records schedule. **Evidence:** retention policy. **Phase 0 (2026-10-01):** Every table carries a retention policy; app refuses to boot otherwise; nightly report-only job. Evidence: `src/ypms/framework/retention.py:135`, `src/ypms/main.py:34`. Gap: Disposal execution is Phase 5; periods await YPMS-POAM-054. |
| **SI-16 Memory Protection** | 🔵 | I | | Inherited from IaaS / OS. |
### SR — Supply Chain Risk Management