# YPMS — OLA Questions Response

**Re:** Modernization of the Marion Barry Summer Youth Employment Program Web-Based Data Management System (YPMS) — DOES Strategic Initiative FY27
**Prepared for:** OLA / City Administrator
**Date:** 2026-09-30

---

## 1. What data will populate in this system?

Applicant and participant records (youth, hosts/employers, parents/guardians, DOES staff) including:

- **Identity:** name, DOB, address, phone/email, parent/guardian contact
- **SSN** (for SSA cross-match; masked in display)
- **Education:** school enrollment status ingested from OSSE
- **Eligibility:** age, residency (validated against DC MAR), foster/ward-of-state flag from CFSA
- **Program participation:** applications, certifications, orientation completion, enrollments, job matches, worksite assignments
- **Employment:** hours worked, resumes, job preferences
- **Financial:** banking for direct-deposit payroll, tax info, W-2/1099 records via the third-party payroll integration
- **Operational:** host/employer registrations, worksites, job postings, transportation vouchers, communications, audit logs

## 2. How much of this data will be provided to the public?

Very little. The public surface is limited to available programs and dates, host-employer job postings, application forms, static help and training content, and aggregate program information. No individual PII is exposed publicly. Press and public reporting uses de-identified counts; FOIA responses go through DOES OGC with PII redacted.

## 3. Will the system contain information on students served across fiscal years, broken out by sub-programs?

Yes. The system tracks program details year-over-year and supports each OYP sub-program as a first-class object — MBSYEP, HSIP, MBYLI (SIT / School Year / Global Education), CRESP, and any future OYP program. Reporting is in scope; MicroStrategy (the current reporting tool) is one of the legacy components YPMS replaces. Historical participant data with sub-program breakdowns is retained per DOES records schedule.

## 4. Is there something similar for other workforce programs at DOES?

Partially, but nothing consolidated the way YPMS will be:

- **Adult unemployment insurance:** UIBS — being modernized separately.
- **Adult workforce services:** Geographic Solutions' Virtual One-Stop (VOS).
- **Workers' compensation:** OWC — a separate DOES modernization on its own ATO path.
- **Youth today:** fragmented across seven legacy tools (Host/Participant Application, Scanning, Transfer, TMS timekeeping, MicroStrategy, PF3 admin backdoor, manual payroll scripts) — YPMS consolidates these.

YPMS is the youth-specific consolidation; it doesn't replace anything on the adult side.

## 5. Will the system house SYEP participants' personal information — addresses, SSN, banking, etc. — and are there privacy concerns?

Yes. YPMS will store address, SSN, DOB, banking for direct-deposit payroll, tax info, parent/guardian contact, school records (FERPA-covered, from OSSE), foster/ward status (from CFSA), and — under emergency scenarios — health records.

Privacy concerns and how they are addressed:

| Concern | Mitigation |
|---|---|
| Population is primarily minors — heightened stewardship required | Strict role-based access; data minimization by reusing eligibility across programs; parental co-authentication under consideration |
| SSN is a high-value identity-theft target | Masked/anonymized in display; encrypted at rest and in transit using FIPS-validated cryptography |
| Banking data | Encrypted; passed to the third-party payroll vendor via secured integration; payroll processing itself lives outside YPMS |
| School records (OSSE) | Handled under FERPA; requires a formal DOES–OSSE data-sharing agreement |
| Foster/ward status (CFSA) | Confidential under DC Code Title 4; access limited on need-to-know |
| Detection and response | IDS/IPS and SIEM required; unauthorized disclosures are reported immediately through the DOES OIT → DC OCTO CISO chain, with a full internal report within 24 hours and a remediation plan within 2 business days |
| Assurance baseline | NIST 800-53 Moderate; DC OCTO IT policies; SSA electronic exchange requirements |
| Records-access oversight | DOES OIT maintains and reviews a full list of personnel with data access, updated at least quarterly with additions and deletions tracked |

**Open questions flagged for the AO:** whether social-media login is acceptable for minors without full identity proofing before payroll actions, and treatment of the dormant health-record ingest path. YPMS will be built in-house by DOES OIT and hosted on Azure Government, matching the OWC and Employer 360 posture.