# YPMS — Overview

**One line.** An in-house DOES OIT build that replaces seven legacy tools currently used by the Office of Youth Programs to run MBSYEP and related youth workforce programs. Matches the DCYWP / OWC / Employer 360 delivery pattern.

## Why we're building it

The current OYP system landscape is fragmented across seven tools that don't share data:

| Legacy tool | Purpose | Fate under YPMS |
|---|---|---|
| Host/Participant Application | Program applications | Replaced by unified intake |
| Scanning Application | Certify application information | Replaced by in-line certification |
| Transfer Application | Place and transfer youth | Replaced by matching engine |
| TMS (Time Management System) | Youth time tracking | Replaced by online time management |
| MicroStrategy | Reporting and visualization | Replaced by native reporting + BI |
| PF3 (People First backdoor) | Admin login tool for host-app edits | Replaced by RBAC admin functions |
| Manual payroll (scripts + email approvals) | Payroll processing | Replaced by third-party payroll vendor integration |

Consolidating these into a single DOES-owned system is the substance of the modernization.

## Programs served

| Program | Population | Notes |
|---|---|---|
| **MBSYEP** — Marion S. Barry Summer Youth Employment Program | Youth ages 14–24 | Locally funded; highest peak-load driver; hard summer deadlines |
| **HSIP** — High School Internship Program | Grades 9–12 | School-year enrichment and internships |
| **MBYLI** — Marion Barry Youth Leadership Institute | Year-round | Includes Summer Intensive Training (SIT), School Year Program (SYP), Global Education |
| **CRESP** — Career Ready Early Scholars Program | Middle-school students | 11 career-exploration tracks (STEM, culinary, law/global affairs, etc.) |
| Future OYP programs | — | System must accept new program definitions end-to-end (application → completion) |

## User populations

| User | Estimate | Access |
|---|---|---|
| DOES staff, contractors, vendors | ~90 | Internal portal, SSO / DOES global directory |
| Host employers | ~1,500 | Self-service web portal |
| Youth (registering + participating) | ~27,000 | Web / mobile; identity model under review — see CLAUDE.md open question 3 |
| Parents / guardians | ~7,400 | Web portal |
| Other agencies | ~100 | Web portal or interconnection |
| **Total** | **~36,000** | Scale target: 50%/year growth |

## Integrations

| Partner | Purpose | Notes |
|---|---|---|
| SSA (Business Services Online) | SSN verification, wage data | SSA electronic-exchange requirements apply |
| OSSE | School enrollment records | FERPA — data-sharing agreement required |
| CFSA | Foster / ward-of-state status | DC Code Title 4 — MOU required |
| DC MAR | Address verification | DC OCTO service |
| Third-party payroll vendor | Time → payroll → tax forms | Vendor selection outstanding; DOES OIT owns the integration on our side |
| Third-party LMS | Orientation completion tracking | Vendor TBD |
| DC OCTO Sentinel | Security telemetry (SIEM stream) | Same pattern as OWC |
| Social media IdPs | Youth account login | Risk-managed; not sufficient for payroll actions on its own |

## Delivery model

DOES OIT builds and operates the system. **Stack: Python 3.12 / FastAPI / SQLAlchemy / Postgres**, aligned with OWC. Hosting is Azure Government Cloud, matching OWC and Employer 360. Continuous monitoring runs into DC OCTO Sentinel.

## Timeline (as of 2026-09-30)

| Milestone | Target | Status |
|---|---|---|
| Source requirements captured (from prior YPMS RFP) | 2025-04 | Done |
| ISSO and AO designated in writing | 2026-09-30 | ✓ Chris Tonjes (DOES CIO) as System Owner, ISSO, and AO |
| Stack decision recorded | 2026-09-30 | ✓ Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment) |
| FIPS 199 memo signed by AO | 2026-10-31 | Not started (`YPMS-POAM-001`) |
| Architecture document | 2026-11-30 | Not started (see `YPMS-POAM-040` follow-on) |
| Azure Gov tenant + non-prod environments | 2027-01-15 | Not started (`YPMS-POAM-041`) |
| CI/CD pipeline with SAST/SCA/SBOM | 2027-01-31 | Not started (`YPMS-POAM-042`) |
| Data-sharing agreements (OSSE, CFSA, SSA, payroll vendor) | Q1 2027 | Not started (`YPMS-POAM-020` – `YPMS-POAM-023`) |
| ATO artifacts (SSP, PIA, IRP, CP, RoB, control mapping) | Q4 2026 – Q1 2027 | Draft SSP v0.2, control mapping v0.1, POA&M v0.1 |
| Iterative build (Agile — matches OWC / DCYWP delivery cadence) | 2027 | Not started |
| Independent Control Assessment (SCA) | Pre-Go-Live | Not scheduled |
| Penetration test | Pre-Go-Live | Not scheduled |
| ATO decision | Pre-Go-Live | Not scheduled |
| **Go-Live** | Beginning of FY2027 per source RFP; effective slip acknowledged | Not started |

## Compliance posture

- **NIST SP 800-53 Rev. 5 Moderate baseline.**
- **NIST SP 800-171 Rev. 2** for CUI handling.
- **FIPS 140-3** target (140-2 acceptable during the deprecation window).
- **FERPA** overlay for OSSE-sourced educational records.
- **DC Code Title 4** for CFSA-sourced foster/ward records.
- **SSA Electronic Information Exchange** requirements for SSN cross-match.
- **Section 508 / WCAG 2.1 AA**.
- **DC Language Access Act of 2004**.
- **PCI DSS** — only if card processing is in scope (probably not).
- **DC OCTO IT Security Policy**.

## FIPS 199 (provisional)

**Moderate / Moderate / Moderate**, with High-sensitivity data subsets (FERPA OSSE records, CFSA foster/ward flags, dormant COVID-era health records) treated by role-based least privilege rather than by pulling the aggregate rating up. The AO's FIPS 199 memo (`YPMS-POAM-001`) formalizes this.

## What good looks like at Go-Live

- Single youth portal from application through payroll for all OYP programs.
- One host/employer portal.
- One staff workspace replacing PF3 and the various admin tools.
- Payroll runs off online time-tracking, not scripts and emails.
- Reports run natively; MicroStrategy retired.
- ATO signed by the DOES Director before production data flows in.
- OSSE and CFSA exchanges in place with executed agreements.
- Sentinel receiving telemetry via DC OCTO.
- Daily backups running with tested restore.
- POA&M managed and reviewed monthly.