YPMS/NIST_800_53_CONTROL_MAPPING.md

# NIST SP 800-53 Rev. 5 Control Mapping

**System:** Youth Program Management System (YPMS)
**System Owner:** District of Columbia Department of Employment Services (DOES)
**Document version:** 0.3 (draft — Phase 0 evidence populated)
**Date:** 2026-10-01
**Author:** DOES CIO
**Companion to:** [`SYSTEM_SECURITY_PLAN.md`](SYSTEM_SECURITY_PLAN.md)

---

## 1. System Categorization (FIPS 199 / FIPS 200)

| Security Objective | Categorization | Rationale (see SSP §2 for detail) |
|---|---|---|
| **Confidentiality** | Moderate (High-sensitivity subsets) | Minors' PII, SSN, banking, FERPA-covered OSSE records, CFSA foster/ward flags. |
| **Integrity** | Moderate | Eligibility decisions gate paid employment; wage/tax computations flow to third-party payroll. |
| **Availability** | Moderate | 99.5% SLA; MBSYEP peak windows are hard deadlines. |

**Resulting baseline:** NIST 800-53 **Moderate**. See SSP §2.3 for overlays (FERPA, SSA data-exchange, DC OCTO IT policy, PCI DSS conditional).

---

## 2. Scope and Methodology

YPMS is an **in-house build by DOES OIT** on Azure Government, matching the DCYWP / OWC / Employer 360 delivery pattern. DOES OIT writes the code, operates the Azure Gov tenant, and owns evidence collection. This document maps controls to **who implements them, where the evidence lives (repo file paths, configuration exports, log samples, DOES-authored companion docs), and what remains organizational vs. inherited**.

Ownership model matches DCYWP's SSP: the vast majority of technical controls are DOES OIT; physical/environmental controls are inherited from Azure Gov FedRAMP High; some controls are Hybrid with DC OCTO enterprise services (Entra ID for staff identity, Sentinel for SIEM, endpoint program for managed devices); a substantial number are Organizational (DOES policy, process, training).

### Status legend

- 📝 **Planned (DOES OIT)** — required, will be implemented in the codebase or Azure tenant, no evidence yet (pre-development).
- ✅ **Implemented** — evidence exists in the repo, pipeline, or Azure tenant. Populated once development starts.
- 🟡 **Partial** — some objectives met; named gaps require additional code, configuration, or operational artifacts.
- 🤝 **Hybrid** — DOES OIT + DC OCTO enterprise or a third-party vendor (payroll, LMS, IdP).
- 🔵 **Inherited** — satisfied by Azure Government FedRAMP High, DC OCTO enterprise services, or a vendor's own authorization.
- 📋 **Organizational (DOES)** — DOES policy, process, training, or governance artifact. On the DOES ATO-package punch list.
- ⚠️ **Source-RFP gap / SSP tailoring** — source-RFP wording does not fully meet the Moderate baseline; SSP tailors above the source-RFP floor. Build must reflect the tailored level.
- ❓ **Open decision** — awaiting AO or DOES CIO disposition; tracked in SSP Appendix D and `POAM.md`.

### Ownership legend

- **O** — DOES OIT (implements in code/config in this repo)
- **D** — DOES (CIO, ISSO, HR, Privacy Officer, OGC, or OYP as noted)
- **H** — Hybrid (DOES OIT + DC OCTO enterprise, or DOES OIT + third-party vendor)
- **I** — Inherited (Azure Gov FedRAMP High, DC OCTO enterprise, or third-party vendor authorization)

### Source-RFP citations

Citations like `C.5.7.9` refer to the prior YPMS RFP (Solicitation `Docxxxxx`, April 2025), used here as **source functional and security requirements**, not as Contractor obligations. Where a control has no source-RFP driver but is required by the Moderate baseline or SSP tailoring, the source-RFP-ref column is blank and the note explains the source of the obligation.

### Evidence artifacts

The "Evidence expectation" column names what DOES needs to see for that control to pass an independent assessment. Evidence sources are the DCYWP-style stack: repo file paths (`ypms/server/...`), migration files, CI/CD configuration, Azure resource configuration, DOES-authored companion docs (in `ypms/`), and continuous-monitoring output (log samples, scan reports, access-recert records).

---

## 3. Control Family Summary

| Family | Controls Mapped | 📝 DOES OIT | 🤝 Hybrid | 🔵 Inherited | 📋 Org / DOES | ⚠️ Tailoring | ❓ Open |
|---|---:|---:|---:|---:|---:|---:|---:|
| AC — Access Control | 14 | 10 | 2 | 1 | — | 1 | — |
| AT — Awareness & Training | 4 | — | 2 | — | 2 | — | — |
| AU — Audit & Accountability | 11 | 9 | 1 | — | 1 | — | — |
| CA — Assessment, Authorization, and Monitoring | 7 | 1 | 2 | — | 4 | — | — |
| CM — Configuration Management | 10 | 6 | 2 | — | 2 | — | — |
| CP — Contingency Planning | 8 | 3 | 2 | 2 | 1 | — | — |
| IA — Identification & Authentication | 11 | 8 | — | — | — | 2 | 1 |
| IR — Incident Response | 8 | 2 | 4 | — | 2 | — | — |
| MA — Maintenance | 4 | 2 | 1 | 1 | — | — | — |
| MP — Media Protection | 6 | — | — | 6 | — | — | — |
| PE — Physical & Environmental | 12 | — | — | 12 | — | — | — |
| PL — Planning | 5 | 1 | — | — | 4 | — | — |
| PM — Program Management | 12 | — | — | — | 12 | — | — |
| PS — Personnel Security | 8 | 1 | 3 | — | 4 | — | — |
| PT — PII Processing & Transparency | 6 | 1 | 2 | — | 3 | — | — |
| RA — Risk Assessment | 7 | 3 | 2 | — | 2 | — | — |
| SA — System & Services Acquisition | 12 | 8 | — | — | 4 | — | — |
| SC — System & Communications Protection | 17 | 14 | — | 3 | — | 1 | — |
| SI — System & Information Integrity | 12 | 10 | 2 | — | — | — | — |
| SR — Supply Chain Risk Management | 6 | 3 | 3 | — | — | — | — |
| **Totals** | **180** | **82** | **26** | **25** | **41** | **4** | **1** |

The Moderate baseline contains ~261 controls including enhancements; the ~80 not enumerated here are either subsumed by their parent control's row, deferred to the architecture kickoff, or apply only to specialized subsystems (e.g., AT-3(5) for practical exercises, SC-15(4) for microphone/camera). Those will be added at v0.3 once the architecture lands.

Status distribution will shift from 📝 to ✅/🟡/❌ as the codebase materializes; refresh at every phase gate.

### Phase 0 status shift (2026-10-01)

Rows touched by Phase 0 code. Each carries a dated **Phase 0** note with file:line evidence and the remaining gap; the same list with links is in [`docs/nist-mapping.md`](docs/nist-mapping.md). Rows whose status is 🤝 or ⚠️ keep it and gain a progress note.

| Family | ✅ Implemented | 🟡 Partial | Note only (🤝 / ⚠️ kept) |
|---|---:|---:|---:|
| AC | 5 | 2 | — |
| AU | 4 | 1 | 1 |
| CM | — | 1 | 1 |
| IA | 1 | 3 | — |
| RA | — | 1 | — |
| SA | — | 1 | — |
| SC | — | 3 | 1 |
| SI | 2 | — | 1 |
| **Totals** | **12** | **12** | **4** |

---

## 4. Detailed Control Mapping

### AC — Access Control

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **AC-1 Policy and Procedures** | 📋 | D | — | DOES OCTO IT Security Policy applies (`C.5.7.53`). DOES ISSO owns YPMS access-control procedure document. **Evidence:** signed DOES Access Control Policy, RoB (`ypms/RULES_OF_BEHAVIOR.md`). |
| **AC-2 Account Management** | 🟡 | O | `C.5.7.4`, `C.5.7.5`, `C.5.7.7`, `C.5.7.29`, `C.5.7.47` | Admin enable/disable; auto-disable on inactivity; 12–64 char alphanumeric IDs; group + individual assignment via Entra ID; no re-issue of deleted or previously-assigned IDs. **Evidence:** account-lifecycle event samples from Sentinel; documented account-provisioning workflow in `ypms/RULES_OF_BEHAVIOR.md`; quarterly access-recert records; DOES OIT personnel-access roster per source RFP `C.5.8.16`, `C.5.8.17` adopted as internal policy. **Phase 0 (2026-10-01):** User model with active flag; inactive accounts rejected at authentication. Evidence: `src/ypms/users/models.py:48`, `src/ypms/auth/deps.py:43`. Gap: No admin enable/disable endpoint (admin module, Phase 8); inactivity auto-disable is YPMS-POAM-071. |
| **AC-2(1) Automated Account Management** | 📝 | O | `C.5.7.4`, `C.5.7.31` | Automated inactivity-disable; real-time and scheduled access-right changes. **Evidence:** configuration screenshot of inactivity threshold; audit log showing an auto-disable event. |
| **AC-2(3) Disable Inactive Accounts** | 📝 | O | `C.5.7.4` | Organization-defined inactivity threshold (`[TBD]` — recommend 90 days for staff, 180 days for youth accounts). **Evidence:** configured threshold value + audit sample. |
| **AC-2(4) Automated Audit Actions** | 📝 | O | `C.5.7.36`, `C.5.7.39` | All account create/modify/enable/disable/remove actions auto-logged. **Evidence:** log samples. |
| **AC-3 Access Enforcement** | ✅ | O | `C.5.7.21`, `C.5.7.27`, `C.5.7.28`, `C.5.7.31`, `C.5.7.48` | Server-side authorization on every action; admin-only view/change of access rights; enforce authorizations per access-control policies. **Evidence:** access-control matrix showing every role × object; penetration-test evidence that unauthenticated and lower-role users cannot reach protected functions. **Phase 0 (2026-10-01):** `require_permission` runs on every protected route, including all 208 stub routes; portal-only callers restricted to their own Registrant row. Evidence: `src/ypms/security/rbac.py:46`, `src/ypms/youth/router.py:67`, `tests/test_stubs.py`. Gap: Row-level scoping beyond Registrant is Phase 2+. |
| **AC-4 Information Flow Enforcement** | 📝 | O | `C.5.7.23` | Trusted / transition / untrusted zone segmentation; untrusted systems cannot reach trusted-zone systems directly. **Evidence:** network architecture diagram (from the DOES OIT architecture document — `YPMS-POAM-040`); Azure NSG / firewall rule export. |
| **AC-6 Least Privilege** | ✅ | O | `C.5.7.32`, `C.5.7.33`, `C.5.7.34` | RBAC over defined objects; one login per staff, role-mediated access; admin maintains role-based security. CFSA foster/ward data and OSSE FERPA records reachable only by role-flagged users. **Evidence:** role catalogue with data-class access mapping. **Phase 0 (2026-10-01):** Data-driven RBAC (8 roles × 30 entities × 8 actions); FERPA/CFSA entities limited to ELIGIBILITY_EXAMINER; super-role explicit. Evidence: `src/ypms/seed/permissions_matrix.json`, `src/ypms/security/rbac.py:22`, `tests/test_stubs.py`. Gap: Four matrix review items open (PHASE0_STATUS.md). |
| **AC-6(1) Authorize Access to Security Functions** | ✅ | O | `C.5.7.28` | Only administrators can view/change access rights. **Evidence:** role catalogue. **Phase 0 (2026-10-01):** Only DOES_SYSTEM_ADMIN holds RBAC-table rights (User/Role not granted to any other role). Evidence: `src/ypms/seed/permissions_matrix.json`. |
| **AC-6(2) Non-Privileged Access for Non-Security Functions** | 📝 | O | `C.5.7.33` | Staff use non-privileged accounts by default for routine work. **Evidence:** account-inventory review. |
| **AC-6(5) Privileged Accounts** | 📝 | O | | Named, approved list of privileged users. **Evidence:** privileged-user roster + quarterly recert. |
| **AC-6(9) Log Use of Privileged Functions** | 📝 | O | `C.5.7.36` | Auto-log all admin actions including account create/modify/enable/disable/remove. **Evidence:** log samples. |
| **AC-6(10) Prohibit Non-Privileged Users from Executing Privileged Functions** | ✅ | O | `C.5.7.27`, `C.5.7.32` | Enforced server-side. **Evidence:** pentest evidence. **Phase 0 (2026-10-01):** Delete and Restore (super-role only today) and Registrant VersionHistory (OYP_STAFF and ELIGIBILITY_EXAMINER only) enforced server-side; 403 asserted for every other role. Evidence: `src/ypms/security/rbac.py:29`, `tests/test_stubs.py`, `tests/youth/test_registrant_api.py`. |
| **AC-7 Unsuccessful Logon Attempts** | 🟡 | O | `C.5.7.10`, `C.5.7.11` | Lockout after 5 attempts; user notified on revocation. **Evidence:** configured threshold; audit sample of a lockout event and notification. **Phase 0 (2026-10-01):** 5 failed logins per source IP per 15 minutes → 429; every failure (bad credentials, unknown user, inactive, throttled) audited as `login_failed`. Evidence: `src/ypms/auth/rate_limit.py:47`, `src/ypms/auth/router.py:86`, `src/ypms/auth/router.py:65`. Gap: Per-account lockout (`locked_until`) and user notification not built; in-memory limiter is per-process. |
| **AC-8 System Use Notification** | 📝 | O | `C.5.7.37` | Notification banner before granting access. **Evidence:** screenshot of banner; DOES-approved banner text on file. |
| **AC-11 Session Lock** | 📝 | O | `C.5.7.3` | Idle-timeout session lock with re-authentication. **Evidence:** configured timeout value. |
| **AC-11(1) Pattern-Hiding Displays** | 📝 | O | | Screen obscured on lock. **Evidence:** UX walkthrough. |
| **AC-12 Session Termination** | ✅ | O | `C.5.7.3` | Idle session termination with re-authentication. **Evidence:** configured timeout value; log sample of a session-terminated event. **Phase 0 (2026-10-01):** Access tokens expire (default 60 min, `exp` claim verified); refresh tokens cannot access resources. Evidence: `src/ypms/auth/security.py:59`, `src/ypms/auth/deps.py:35`. Gap: Idle-timeout UI behaviour lands with the portal (Phase 3). |
| **AC-14 Permitted Actions Without Identification or Authentication** | 📝 | O | | Limited to public content (program info, job postings, application intake as unauthenticated entry). **Evidence:** enumeration of unauthenticated endpoints. |
| **AC-17 Remote Access** | 🤝 | O, D | | All access is remote by architecture. MFA required for staff and admin via Entra ID conditional access (see IA-2). **Evidence:** Entra CA policy export; endpoint-compliance policy (source RFP `C.5.6.30`). |
| **AC-17(1) Monitoring and Control** | 📝 | O | `C.5.6.9` #19 | SIEM monitoring of remote access. **Evidence:** SIEM feed. |
| **AC-17(2) Cryptographic Protection** | 📝 | O | `C.5.6.15`, `C.5.7.9` | ⚠️ Source RFP says SSL; **SSP tailors to TLS 1.2 minimum, TLS 1.3 preferred, FIPS-approved suites**. **Evidence:** TLS configuration audit; qualys/ssllabs-equivalent report. |
| **AC-18 Wireless Access** | 🔵 | I | | Inherited from DOES endpoint program / DC OCTO. |
| **AC-19 Access Control for Mobile Devices** | 🤝 | O, D | `C.5.7.35`, `C.5.6.30` | Mobile-platform design conforms to encryption, access control, application security; endpoints comply with DC OCTO policy. **Evidence:** MDM configuration for DOES-managed devices; mobile-web hardening statement in the architecture document. |
| **AC-20 Use of External Systems** | 🤝 | O, D | | Governs host/employer access and third-party integrations (payroll, LMS, social-media login, DC MAR). **Evidence:** ISA/MOU inventory (see §11 of SSP). |
| **AC-22 Publicly Accessible Content** | 📝 | O | | Public content reviewed before publication; PII filters. **Evidence:** editorial workflow doc. |

### AT — Awareness and Training

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **AT-1 Policy and Procedures** | 📋 | D | | DOES annual security awareness policy. **Evidence:** policy document. |
| **AT-2 Literacy Training and Awareness** | 🤝 | O, D | `C.5.9` | DOES annual awareness for staff and any contracted individual developers. Source RFP §C.5.9 informs the user-population training plan. **Evidence:** training completion records; content library. |
| **AT-2(2) Insider Threat** | 📋 | D | | Insider-threat awareness content in the annual training. **Evidence:** module inclusion. |
| **AT-3 Role-Based Training** | 🤝 | O, D | `C.5.9`, `C.5.27.3` | Adjudicators, eligibility examiners, payroll admins, hearing-adjacent staff; two DOES team members trained on Requirements Management Tool. **Evidence:** role-training matrix, completion records. |
| **AT-4 Training Records** | 📋 | D | | DOES-maintained. **Evidence:** training records system. |

### AU — Audit and Accountability

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **AU-1 Policy and Procedures** | 📋 | D | `C.5.7.53` | DOES OCTO logging policy applies. **Evidence:** policy. |
| **AU-2 Event Logging** | 🟡 | O | `C.5.7.39`, `C.5.6.9` #4 | Comprehensive event set: root/admin actions, audit-log access/modification, successful and unsuccessful logon attempts, password changes, system-level object create/delete, all PII/sensitive-data interactions, role changes, shutdown/restart, file access authorized and unauthorized, user logon events, plus DOES-defined additions. **Evidence:** event-catalog document; SIEM sample stream. **Phase 0 (2026-10-01):** Audited today: login success/failure, password change, every create/update/delete/restore, every PII read, every stub invocation, each retention run. Evidence: `src/ypms/audit/service.py:17`, `src/ypms/framework/crud.py:111`, `src/ypms/auth/router.py:65`, `src/ypms/auth/router.py:104`. Gap: Event catalogue items not yet applicable (role changes, shutdown, file access) arrive with their features. |
| **AU-3 Content of Audit Records** | ✅ | O | `C.5.7.15`, `C.5.7.48`, `C.5.7.49`, `C.5.6.9` #8, #11, #12, #13 | What/when/where/source/outcome/identity; sufficient to reconstruct events; unique transaction ID per transaction; before-and-after transaction history; communication send/access logging. **Evidence:** log-record specification; log sample. **Phase 0 (2026-10-01):** Each row: actor id + username, action, entity, entity id, before/after, timestamp, IP; app-layer ciphertext redacted from before/after. Evidence: `src/ypms/audit/models.py:18`, `src/ypms/framework/crud.py:46`. Gap: Request id is in logs, not yet on the audit row. |
| **AU-3(1) Additional Audit Information** | 📝 | O | | Extended fields for financial-adjustment events (payroll approval, banking change, eligibility change). **Evidence:** log sample. |
| **AU-4 Audit Log Storage Capacity** | 📝 | O | | Sized for `[TBD]` retention (see AU-11). **Evidence:** capacity plan. |
| **AU-5 Response to Audit Logging Process Failures** | 📝 | O | `C.5.7.26`, `C.5.6.9` #23 | Alerts to admins and additional roles on security compromise; user-account lockout alerts; logging-pipeline health monitoring. **Evidence:** runbook + alert-configuration screenshot. |
| **AU-6 Audit Record Review, Analysis, and Reporting** | 🤝 | O, D | `C.5.6.9` #19–22 | Sentinel aggregation into meaningful security intelligence; alerts on business-rule/workflow thresholds. DC OCTO SOC consumes the feed. **Evidence:** Sentinel correlation-rule inventory; SOC alert-triage runbook. |
| **AU-7 Audit Record Reduction and Report Generation** | 📝 | O | `C.5.6.9` #20 | Configurable aggregation and reporting. **Evidence:** report templates. |
| **AU-8 Time Stamps** | ✅ | O | `C.5.7.40` | All critical system times synchronized. **Evidence:** NTP configuration; sample logs showing consistent UTC/ISO-8601 timestamps. **Phase 0 (2026-10-01):** All timestamps timezone-aware UTC; Postgres container pinned to UTC. Evidence: `src/ypms/audit/models.py:24`, `docker-compose.yml:8`. Gap: NTP is inherited from Azure at deployment. |
| **AU-9 Protection of Audit Information** | 📝 | O | `C.5.7.41`, `C.5.6.9` #6 | Audit information and audit tools protected from unauthorized access, modification, and deletion; role-based access to audit logs. Sentinel ingestion moves logs to a separate trust boundary. **Evidence:** ACL export on audit store; Sentinel workspace RBAC. |
| **AU-11 Audit Record Retention** | 🤝 | O, D | `C.5.7.42` | Organization-defined; **DOES recommendation: 1 year online, 3 years archived** (align to DOES records schedule — `[TBD]`). **Evidence:** written retention policy; archive location and format. **Phase 0 (2026-10-01):** Retention scaffold: audit log carries the PIA §9 interim policy (archive at 1 year); report-only job. Evidence: `src/ypms/retention_classes.py`, `src/ypms/framework/retention.py:150`. Gap: Period unapproved until YPMS-POAM-054; archive tier is deployment work. |
| **AU-12 Audit Record Generation** | ✅ | O | `C.5.7.39`, `C.5.6.9` #17, #18 | Automated audit trails for all system components; system-generated security audit trail; SANS Information Logging Standard compliance. **Evidence:** component inventory × logging coverage table. **Phase 0 (2026-10-01):** Audit generation is in the framework (CRUDService, stub router, auth), not per-handler. Evidence: `src/ypms/framework/crud.py:111`, `src/ypms/framework/stub_router.py:66`. |
| **AU-14 Session Audit** | ✅ | O | `C.5.6.9` #5, #7 | Searchable log of all screens accessed by user; sensitive-data screen access monitored and recorded. **Evidence:** search-tool demo; log sample. **Phase 0 (2026-10-01):** `pii_read` audit on Registrant GET, list (ids recorded), and history. Evidence: `src/ypms/framework/pii_audit.py:36`, `src/ypms/youth/router.py:99`, `src/ypms/youth/router.py:115`. Gap: Extends to Guardian/TaxDocument/Attachment as they are built. |

### CA — Assessment, Authorization, and Monitoring

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **CA-1 Policy and Procedures** | 📋 | D | | DOES ATO governance. **Evidence:** policy. |
| **CA-2 Control Assessments** | 📋 | D | | Independent assessment (SCA) prior to ATO; annual reassessment. **Evidence:** SCA report. |
| **CA-2(1) Independent Assessors** | 📋 | D | | Independent from DOES OIT delivery team. **Evidence:** engagement letter. |
| **CA-3 Information Exchange** | 🤝 | O, D | `C.5.6.3`, `C.5.6.4` | ISAs/MOUs per SSP §11 (SSA, OSSE, CFSA, DC MAR, payroll vendor, LMS vendor, DC OCTO Sentinel, NOC). **Evidence:** executed ISA/MOU inventory. |
| **CA-5 Plan of Action and Milestones (POA&M)** | 📋 | D | | Maintained as `ypms/POAM.md`. This document's ⚠️ tailoring rows and ❓ open items seed the initial POA&M. **Evidence:** POA&M with monthly review cadence. |
| **CA-6 Authorization** | 📋 | D | | AO decision required pre-Go-Live. **Evidence:** signed ATO letter. |
| **CA-7 Continuous Monitoring** | 🤝 | O, D | | SSP §15 defines cadence. **Evidence:** monthly monitoring reports. |
| **CA-8 Penetration Testing** | 📝 | O (supports), D (commissions) | | Annually and after major releases (`YPMS-POAM-061`). **Evidence:** pentest report + remediation POA&M items. |
| **CA-9 Internal System Connections** | 📝 | O | | Documented internal component connections. **Evidence:** component-connection register. |

### CM — Configuration Management

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **CM-1 Policy and Procedures** | 📋 | D | | DOES CM policy. **Evidence:** policy. |
| **CM-2 Baseline Configuration** | 📝 | O | `C.5.6.13`, IEEE 828-2012 | Application baseline in the repo (Dockerfile / compose / IaC); DOES-approved tool/software list. **Evidence:** baseline files in `ypms/`; CM plan (see CM-9). |
| **CM-2(2) Automation Support for Accuracy and Currency** | 📝 | O | | IaC (Bicep or Terraform) maintains Azure baseline. **Evidence:** tool inventory; IaC repo path. |
| **CM-2(3) Retention of Previous Configurations** | 📝 | O | | Rollback-capable baseline history via git. **Evidence:** git log. |
| **CM-3 Configuration Change Control** | 🤝 | O, D | `C.5.6.13`, `C.5.6.17` | DOES CIO approves changes; 30-day advance notice for maintenance windows; NOC coordination; emergency-change track. **Evidence:** change-record register; monthly change-review minutes. **Phase 0 (2026-10-01):** Merged migrations pinned by SHA-256; CI fails on any edit. Every change ships through a reviewed commit. Evidence: `migrations/IMMUTABLE.sha256`, `tests/test_migration_immutability.py:31`. Gap: Maintenance-window process is organizational. |
| **CM-4 Impact Analysis** | 📝 | O | `C.5.8.12` | Required before database migrations affecting programs already in production. **Evidence:** impact-analysis template + sample; migration review discipline. |
| **CM-5 Access Restrictions for Change** | 📝 | O | | Only DOES OIT delivery leads have merge rights on `main`; branch protection + code review required. **Evidence:** git branch-protection settings; Entra group ACL. |
| **CM-6 Configuration Settings** | 📝 | O | `C.5.6.5`, `C.5.6.6`, `C.5.6.7` | Admin-configurable security controls; CA configuration; DB/space/performance configuration. DOES OIT establishes secure baseline (CIS Azure Foundations benchmark + DOES overlays). **Evidence:** baseline settings export; Azure Policy assignment. |
| **CM-7 Least Functionality** | 📝 | O | | Unused features disabled. **Evidence:** enabled-feature inventory. |
| **CM-7(1) Periodic Review** | 📝 | O | | Quarterly review of enabled features. **Evidence:** review record. |
| **CM-8 System Component Inventory** | 🟡 | O | `C.5.6.13` | Comprehensive tool/software list with licensing and upgrade path. **Evidence:** SBOM (CycloneDX, per release, from CI) + tool inventory. **Phase 0 (2026-10-01):** CycloneDX 1.6 SBOM of the runtime dependency set generated in CI. Evidence: `.gitea/workflows/ci.yml:70`. Gap: Pending first green CI run (Gitea runner); per-release retention of SBOMs not yet defined. |
| **CM-8(1) Updates During Installation and Removal** | 📝 | O | | Inventory auto-updated via CI pipeline. **Evidence:** tooling. |
| **CM-9 Configuration Management Plan** | 📝 | O | | `ypms/CONFIGURATION_MANAGEMENT_PLAN.md` (to be authored; also serves source RFP §C.5.12 Change Management Plan). **Evidence:** signed plan. |
| **CM-10 Software Usage Restrictions** | 📋 | D | `C.5.6.13` | DOES-approved software list; license terms respected. **Evidence:** approved-software list. |
| **CM-11 User-Installed Software** | 📋 | D | | End-user installation prohibited on managed endpoints (DOES OCTO endpoint policy). **Evidence:** MDM policy. |

### CP — Contingency Planning

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **CP-1 Policy and Procedures** | 📋 | D | | DOES contingency policy. **Evidence:** policy. |
| **CP-2 Contingency Plan** | 🤝 | O, D | `C.5.6.17`, `C.5.6.13` | `ypms/CONTINGENCY_PLAN.md` (to be authored). RTO/RPO envelope set by 99.5% SLA; failover-during-patching required. **Evidence:** signed plan. |
| **CP-2(1) Coordinate with Related Plans** | 🤝 | O, D | | Aligned with DOES BC/DR, DC OCTO enterprise plans, and payroll-vendor continuity plan. **Evidence:** cross-reference matrix. |
| **CP-2(3) Resume Mission and Business Functions** | 🤝 | O, D | | Recovery within SLA. **Evidence:** test results. |
| **CP-3 Contingency Training** | 🤝 | O, D | | Role-based CP training. **Evidence:** completion records. |
| **CP-4 Contingency Plan Testing** | 🤝 | O, D | | Annual tabletop + functional element (failover exercise). **Evidence:** exercise report. |
| **CP-4(1) Coordinate with Related Plans** | 🤝 | O, D | | Joint test with payroll vendor and DC OCTO. **Evidence:** joint after-action. |
| **CP-6 Alternate Storage Site** | 🔵 | I | | Inherited from Azure Government (geo-redundant storage / paired region). **Evidence:** Azure FedRAMP High artifact. |
| **CP-6(1) Separation from Primary Site** | 🔵 | I | | Inherited. |
| **CP-7 Alternate Processing Site** | 🔵 | I | `C.5.6.18`, `C.5.6.29` | Redundant multi-tier architecture with paired-region failover. **Evidence:** architecture doc; failover test. |
| **CP-9 System Backup** | 📝 | O | `C.5.8.14`, `C.5.8.21` | Azure Backup with daily cadence; documented backup and restore procedures. **Evidence:** backup schedule, restore-drill result (`YPMS-POAM-044`). |
| **CP-9(1) Testing for Reliability and Integrity** | 📝 | O | | Annual restore drill. **Evidence:** drill report. |
| **CP-10 System Recovery and Reconstitution** | 📝 | O | | Documented reconstitution runbook. **Evidence:** runbook. |

### IA — Identification and Authentication

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **IA-1 Policy and Procedures** | 📋 | D | | DOES identity policy. **Evidence:** policy. |
| **IA-2 Identification and Authentication (Organizational Users)** | ✅ | O | `C.5.7.38`, `C.5.7.36` | Unique user ID per user; admin actions tied to individual identity. **Evidence:** IdP integration record. **Phase 0 (2026-10-01):** Every non-public route requires a valid bearer token bound to a unique, active user. Evidence: `src/ypms/auth/deps.py:25`. Gap: MFA enhancements (IA-2(1)/(2)) arrive with Entra ID in Phase 1. |
| **IA-2(1) MFA to Privileged Accounts** | ⚠️ | O | `C.5.7.6` | Source RFP `C.5.7.6` permits "unique identifier + shared secret answer" — **insufficient by NIST 800-63B AAL2**. **SSP tailors above the source RFP: MFA required for all privileged and staff accounts** via Entra ID conditional access. **Evidence:** Entra CA policy export; sample log showing MFA challenge (`YPMS-POAM-030`). |
| **IA-2(2) MFA to Non-Privileged Accounts** | ⚠️ | O | | Same tailoring: MFA for all staff-role accounts. **Evidence:** as IA-2(1). |
| **IA-2(8) Access to Accounts — Replay Resistant** | 📝 | O | | Modern MFA protocols. **Evidence:** protocol inventory. |
| **IA-2(12) Acceptance of PIV Credentials** | 📋 | D | | DC OCTO enterprise: no PIV in scope; DOES employee credentials via DOES SSO. **Evidence:** IdP config. |
| **IA-3 Device Identification and Authentication** | 📝 | O | | Device certificates for managed endpoints. **Evidence:** MDM cert deployment. |
| **IA-4 Identifier Management** | 🟡 | O | `C.5.7.7`, `C.5.7.38`, `C.5.7.47` | 12-alphanumeric minimum; unique per user; no re-issue of deleted IDs. **Evidence:** IdP configuration; audit sample. **Phase 0 (2026-10-01):** Usernames unique (DB constraint); no user-delete path exists, so identifiers are never re-issued. Evidence: `migrations/versions/0002_framework_tables.py:54`. Gap: 12-character minimum identifier and explicit tombstoning arrive with registration (Phase 1). |
| **IA-5 Authenticator Management** | 🟡 | O | `C.5.7.8`, `C.5.7.12`, `C.5.7.13`, `C.5.7.14`, `C.5.7.45`, `C.5.7.46` | User-established and changeable passwords; admin reset with forced change; expiration; email/SMS notification on change; complexity/reuse/length policy; masked entry. **Evidence:** password-policy configuration; user-communication template. **Phase 0 (2026-10-01):** Users change their own password (12-character floor, current password required); hashes only. Evidence: `src/ypms/auth/router.py:138`, `src/ypms/auth/router.py:147`. Gap: Password-change notification (C.5.7.14) and admin reset arrive with notifications/admin. |
| **IA-5(1) Password-Based Authentication** | 🟡 | O | `C.5.7.9`, `C.5.7.45` | FIPS 140-2 crypto (SSP tailors to FIPS 140-3 forward alignment); policy per RFP. **Evidence:** cryptographic-module cert; policy document. **Phase 0 (2026-10-01):** PBKDF2-SHA256 (NIST SP 800-132) via passlib. Evidence: `src/ypms/auth/security.py:30`. Gap: FIPS 140-3 validated module is deployment-dependent (YPMS-POAM-032). |
| **IA-6 Authenticator Feedback** | 📝 | O | `C.5.7.46` | Masked password entry. **Evidence:** UI walkthrough. |
| **IA-7 Cryptographic Module Authentication** | 📝 | O | `C.5.7.9` | FIPS 140-2 validated modules (SSP tailors: FIPS 140-3 where available). **Evidence:** module cert; usage inventory. |
| **IA-8 Identification and Authentication (Non-Organizational Users)** | ❓ | O | `C.5.3.2`, `C.5.7.30` | Youth and host authentication; LDAP-compliant; social-media login option. **Open decision (SSP §17.D):** identity model for minors — recommend social-media login for browsing/pre-application only, with IAL2-equivalent identity proofing (Login.gov or SSA verification) before banking/payroll actions. **Evidence:** identity-flow design; risk-acceptance memo. |
| **IA-11 Re-authentication** | 📝 | O | `C.5.7.3` | On session timeout; SSP tailors: also on privilege elevation and sensitive-action (banking change, eligibility change, payroll approval). **Evidence:** flow diagrams. |
| **IA-12 Identity Proofing** | ⚠️ | O | | RFP silent; SSP requires IAL2 equivalent for payroll-eligible actions. **Evidence:** identity-proofing design; vendor selection (Login.gov / SSA). |
| **IA-12(2) Identity Evidence** | 📝 | O | | Documentary evidence collected during proofing. **Evidence:** proofing runbook. |
| **IA-12(5) Address Confirmation** | 📝 | O | `C.5.6.3.d`, `C.5.6.2` | DC MAR address validation. **Evidence:** integration record. |

### IR — Incident Response

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **IR-1 Policy and Procedures** | 📋 | D | | DOES / DC OCTO CISO IR policy. **Evidence:** policy. |
| **IR-2 Incident Response Training** | 🤝 | O, D | | DOES OIT and DC OCTO CISO IR-role training. **Evidence:** completion records. |
| **IR-3 Incident Response Testing** | 🤝 | O, D | | Annual IR exercise. **Evidence:** exercise report. |
| **IR-4 Incident Handling** | 🤝 | O, D | `C.5.7.26`, `C.5.6.9` #19 | `ypms/INCIDENT_RESPONSE_PLAN.md`. DOES OIT IDS/IPS + Sentinel feed the pipeline. **Evidence:** signed IRP; playbooks. |
| **IR-4(1) Automated Incident Handling Processes** | 📝 | O | `C.5.6.9` #21–23 | Alerts on business-rule/workflow thresholds and account lockouts. **Evidence:** playbook automation. |
| **IR-5 Incident Monitoring** | 🤝 | O, D | | SIEM + SOC monitoring. **Evidence:** monitoring dashboard. |
| **IR-6 Incident Reporting** | 🤝 | O, D | `C.5.8.18`, `C.5.8.19`, `C.5.8.20` | **Immediate** notification of unauthorized disclosure through DOES OIT → DC OCTO CISO; **24-hour** disclosure report; **2-business-day** remediation report. Plus federal-agency notification for SSA/OSSE/CFSA exchanges per each agreement. **Evidence:** SLA in internal policy; notification-template inventory. |
| **IR-7 Incident Response Assistance** | 📝 | O | | DOES OIT on-call rotation. **Evidence:** on-call roster. |
| **IR-8 Incident Response Plan** | 📋 | D | | `ypms/INCIDENT_RESPONSE_PLAN.md`. **Evidence:** signed plan. |

### MA — Maintenance

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **MA-1 Policy and Procedures** | 📋 | D | | DOES maintenance policy. **Evidence:** policy. |
| **MA-2 Controlled Maintenance** | 📝 | O | `C.5.6.17` | 30-day advance notice for maintenance windows; NOC coordination. **Evidence:** maintenance-window log. |
| **MA-3 Maintenance Tools** | 🤝 | O, D | | Approved-tools list. **Evidence:** tool inventory. |
| **MA-4 Nonlocal Maintenance** | 📝 | O | | Remote maintenance via MFA + audited channels. **Evidence:** access-method design. |
| **MA-5 Maintenance Personnel** | 🤝 | O, D | `C.5.8.16`, `C.5.8.17` | DOES OIT roster of personnel with production data access, refreshed at least quarterly. **Evidence:** access roster. |
| **MA-6 Timely Maintenance** | 📝 | O | `C.5.6.13` | DOES OIT patch cadence; failover during patching. **Evidence:** patch-window log. |

### MP — Media Protection

*No physical media in the target architecture. Endpoint media controls inherited from DC OCTO endpoint program for DOES-managed devices; storage media controls inherited from Azure Government.*

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **MP-1 Policy and Procedures** | 🔵 | I | | DC OCTO endpoint policy. **Evidence:** policy. |
| **MP-2 Media Access** | 🔵 | I | | DC OCTO endpoint policy. |
| **MP-3 Media Marking** | 🔵 | I | | N/A — no removable media in scope. |
| **MP-4 Media Storage** | 🔵 | I | | DC OCTO endpoint policy. |
| **MP-6 Media Sanitization** | 🔵 | I | | Inherited from Azure Government. **Evidence:** Azure FedRAMP High artifact. |
| **MP-7 Media Use** | 🔵 | I | | DC OCTO endpoint policy. |

### PE — Physical and Environmental Protection

*Fully inherited from Azure Government FedRAMP High authorization for hosted components; DC OCTO endpoint program for DOES-managed devices.*

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **PE-1 Policy and Procedures** | 🔵 | I | | Inherited. |
| **PE-2 Physical Access Authorizations** | 🔵 | I | | Inherited. |
| **PE-3 Physical Access Control** | 🔵 | I | | Inherited. |
| **PE-4 Access Control for Transmission** | 🔵 | I | | Inherited. |
| **PE-5 Access Control for Output Devices** | 🔵 | I | | Inherited. |
| **PE-6 Monitoring Physical Access** | 🔵 | I | | Inherited. |
| **PE-8 Visitor Access Records** | 🔵 | I | | Inherited. |
| **PE-9 Power Equipment and Cabling** | 🔵 | I | | Inherited. |
| **PE-10 Emergency Shutoff** | 🔵 | I | | Inherited. |
| **PE-11 Emergency Power** | 🔵 | I | | Inherited. |
| **PE-12 Emergency Lighting** | 🔵 | I | | Inherited. |
| **PE-13 Fire Protection** | 🔵 | I | | Inherited. |
| **PE-14 Environmental Controls** | 🔵 | I | | Inherited. |
| **PE-15 Water Damage Protection** | 🔵 | I | | Inherited. |
| **PE-16 Delivery and Removal** | 🔵 | I | | Inherited. |
| **PE-17 Alternate Work Site** | 🔵 | I | | Inherited (DC OCTO remote-work policy for DOES staff). |

**Evidence for PE family:** Microsoft Azure Government SSP (referenced), FedRAMP High authorization letter, and Customer Responsibility Matrix showing PE-family inheritance.

### PL — Planning

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **PL-1 Policy and Procedures** | 📋 | D | | DOES planning policy. |
| **PL-2 System Security and Privacy Plan** | 📝 | D | | `ypms/SYSTEM_SECURITY_PLAN.md`. |
| **PL-4 Rules of Behavior** | 📋 | D | | `ypms/RULES_OF_BEHAVIOR.md` with variants for staff, host, youth/parent. |
| **PL-4(1) Social Media and External Site Restrictions** | 📋 | D | | Include in RoB. |
| **PL-8 Security and Privacy Architecture** | 📝 | O | `C.5.5.5` | DOES OIT architecture document — `YPMS-POAM-040`. **Evidence:** signed architecture document in `ypms/`. |
| **PL-10 Baseline Selection** | 📋 | D | | Moderate baseline documented (SSP §2.3). |
| **PL-11 Baseline Tailoring** | 📋 | D | | Tailoring documented in this file (⚠️ rows). |

### PM — Program Management

*Organizational; DOES / DC OCTO CISO Office. Inheritance documented in DOES organization-wide security program plan (`[TBD]`).*

| Control | Status | Owner | Implementation & Evidence |
|---|---|---|---|
| **PM-1 Information Security Program Plan** | 📋 | D | DOES ISPP. |
| **PM-2 Information Security Program Leadership Role** | 📋 | D | DOES CIO / ISSO. |
| **PM-3 Information Security and Privacy Resources** | 📋 | D | Budget planning. |
| **PM-4 POA&M Process** | 📋 | D | Enterprise POA&M process. |
| **PM-5 System Inventory** | 📋 | D | DC OCTO system inventory. |
| **PM-6 Measures of Performance** | 📋 | D | Enterprise metrics program. |
| **PM-7 Enterprise Architecture** | 📋 | D | DC OCTO enterprise architecture. |
| **PM-8 Critical Infrastructure Plan** | 📋 | D | DC infrastructure plan. |
| **PM-9 Risk Management Strategy** | 📋 | D | DOES risk-management strategy. |
| **PM-10 Authorization Process** | 📋 | D | DOES / DC OCTO authorization process. |
| **PM-11 Mission and Business Process Definition** | 📋 | D | OYP mission documentation. |
| **PM-14 Testing, Training, and Monitoring** | 📋 | D | Enterprise T&T program. |

### PS — Personnel Security

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **PS-1 Policy and Procedures** | 📋 | D | | DOES personnel-security policy. |
| **PS-2 Position Risk Designation** | 📋 | D | | DOES HR position risk designation. |
| **PS-3 Personnel Screening** | 🤝 | O, D | | DOES HR for staff and any contracted individual developers; DC OCTO clearance requirements apply. **Evidence:** background-check records. |
| **PS-4 Personnel Termination** | 🤝 | O, D | `C.5.8.17` | Access removed on termination; quarterly personnel-with-data-access roster review highlights deletions. **Evidence:** termination checklist; roster. |
| **PS-5 Personnel Transfer** | 🤝 | O, D | | Role-change access adjustment. **Evidence:** transfer checklist. |
| **PS-6 Access Agreements** | 🤝 | O, D | | RoB acknowledgment binding at onboarding and role change. **Evidence:** signed RoB records. |
| **PS-7 External Personnel Security** | 🤝 | O, D | `C.5.8.16`, `C.5.8.17` | Applies to any external (non-DOES-OIT) personnel granted YPMS data access — payroll vendor, LMS vendor, contracted individual developers. Quarterly personnel-with-data-access roster review flags external names. **Evidence:** roster. |
| **PS-8 Personnel Sanctions** | 📋 | D | | DOES HR sanction processes. **Evidence:** policy. |

### PT — PII Processing and Transparency

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **PT-1 Policy and Procedures** | 📋 | D | | DOES privacy policy. |
| **PT-2 Authority to Process PII** | 📋 | D | | Documented in `ypms/PRIVACY_IMPACT_ASSESSMENT.md`. Legal basis: DC Code Title 32. |
| **PT-3 Personally Identifiable Information Processing Purposes** | 📋 | D | | Documented in PIA. |
| **PT-4 Consent** | 🤝 | O, D | | Consent flows for youth and parents; separate parental co-authentication under consideration. **Evidence:** consent-flow screens. |
| **PT-5 Privacy Notice** | 🤝 | O, D | `C.5.7.19` | Presented at first youth/host contact; language-access variants. **Evidence:** notice content on file. |
| **PT-6 System of Records Notice (SORN)** | ❓ | D | | Applicability review by DOES Privacy Officer. **Evidence:** privacy-officer determination memo. |
| **PT-7 Specific Categories of Personally Identifiable Information** | 📝 | O | | SSN, banking, FERPA-covered records, CFSA foster/ward status — enumerated in SSP §13 and enforced by role-based access. **Evidence:** data-classification register + ACL export. |

### RA — Risk Assessment

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **RA-1 Policy and Procedures** | 📋 | D | | DOES RA policy. |
| **RA-2 Security Categorization** | 📋 | D | | `ypms/FIPS_199_MEMO.md`. |
| **RA-3 Risk Assessment** | 🤝 | O, D | | Initial RA before ATO; annually thereafter; on major change. **Evidence:** RA report. |
| **RA-3(1) Supply Chain Risk Assessment** | 📝 | O | | Third-party and fourth-party disclosure in architecture document. **Evidence:** SBOM + third/fourth-party register. |
| **RA-5 Vulnerability Monitoring and Scanning** | 🟡 | O | `C.5.7.52` | Cyber-threat detection and remediation; authenticated and unauthenticated scans monthly; container image scans in CI on push (`YPMS-POAM-062`). **Evidence:** scan schedule + reports. **Phase 0 (2026-10-01):** pip-audit on runtime dependencies gates CI; an unfixable `ecdsa` advisory was removed by changing JWT library. Evidence: `.gitea/workflows/ci.yml:59`. Gap: Pending first green CI run; infrastructure scanning is deployment work. |
| **RA-5(2) Update Vulnerabilities to be Scanned** | 📝 | O | | Feed updates. **Evidence:** feed configuration. |
| **RA-5(5) Privileged Access** | 📝 | O | | Authenticated scans with privileged access. **Evidence:** scan configuration. |
| **RA-7 Risk Response** | 📋 | D | | POA&M-driven. **Evidence:** POA&M. |
| **RA-9 Criticality Analysis** | 🤝 | O, D | | High-value components identified. **Evidence:** criticality register. |

### SA — System and Services Acquisition

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **SA-1 Policy and Procedures** | 📋 | D | | DOES / DC OCP acquisition policy. |
| **SA-2 Allocation of Resources** | 📋 | D | | FY27 budget line. **Evidence:** budget approval. |
| **SA-3 System Development Life Cycle** | 📝 | O | `C.5.2` | Agile SDLC matching OWC and DCYWP patterns; discipline adopted from source RFP `C.5.2`. **Evidence:** SDLC document. |
| **SA-4 Acquisition Process** | 📋 | D | | Applies to third-party components (payroll, LMS, SaaS subcomponents). **Evidence:** procurement records + contracts. |
| **SA-4(1) Functional Properties of Controls** | 📝 | O | `C.5.7` (54 items) | Source RFP §C.5.7 catalogue is the functional-properties statement. **Evidence:** this document (Appendix C traceability). |
| **SA-4(2) Design and Implementation Information for Controls** | 📝 | O | | DOES OIT design docs describe how each control is implemented. **Evidence:** design docs in `ypms/`. |
| **SA-8 Security and Privacy Engineering Principles** | 📝 | O | | SSDLC adherence. **Evidence:** SSDLC document. |
| **SA-9 External System Services** | 📝 | O | `C.5.6.3` | Payroll, LMS, address verification, social-media IdPs, DC MAR — each with security assurance. **Evidence:** vendor register + SIG-Lite / SOC 2 collection. |
| **SA-10 Developer Configuration Management** | 📝 | O | `C.5.8.4`–`C.5.8.11` | Data-model deliverables (conceptual/logical/physical ERDs, data dictionary, integrity rules, CRUD matrix, denormalization rationale). **Evidence:** deliverables in `ypms/`. |
| **SA-11 Developer Testing and Evaluation** | 🟡 | O | source RFP §C.5.10 | Unit / functional / non-functional / UAT with evidence. **Evidence:** test reports; CI test results. **Phase 0 (2026-10-01):** 167 automated tests, 80% coverage floor, ruff, strict mypy, bandit SAST, migration-drift test. Evidence: `.gitea/workflows/ci.yml:53`, `.gitea/workflows/ci.yml:56`. Gap: Pending first green CI run. |
| **SA-15 Development Process, Standards, and Tools** | 📝 | O | | DOES OIT SSDLC standards. **Evidence:** SSDLC document. |
| **SA-22 Unsupported System Components** | 📝 | O | `C.5.6.13` | Third-party dependencies tracked in SBOM with upgrade path. **Evidence:** SBOM + upgrade-path statement. |

### SC — System and Communications Protection

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **SC-1 Policy and Procedures** | 📝 | O | `C.5.7.53` | Aligned to DC OCTO IT security policy. **Evidence:** policy alignment memo. |
| **SC-4 Information in Shared System Resources** | 🔵 | I | | Inherited from IaaS. |
| **SC-5 Denial-of-Service Protection** | 📝 | O | | WAF + rate limiting on public endpoints. **Evidence:** config export. |
| **SC-7 Boundary Protection** | 📝 | O | `C.5.7.23` | Trusted/transition/untrusted zone segmentation. **Evidence:** architecture diagram + firewall rules. |
| **SC-7(3) Access Points** | 📝 | O | | Limited public ingress. **Evidence:** ingress inventory. |
| **SC-7(4) External Telecommunications Services** | 📝 | O | | Documented external services with ISAs. |
| **SC-7(5) Deny by Default / Allow by Exception** | 📝 | O | | Default-deny firewall posture. **Evidence:** ruleset export. |
| **SC-7(7) Split Tunneling for Remote Devices** | 📝 | O | | No split tunneling from managed devices. |
| **SC-8 Transmission Confidentiality and Integrity** | ⚠️ | O | `C.5.6.15`, `C.5.7.25`, `C.5.7.20` | Source RFP says SSL; **SSP tailors to TLS 1.2 minimum, TLS 1.3 preferred, FIPS-approved cipher suites**. All PII encrypted in transit. **Evidence:** SSL Labs–style report; TLS config (`YPMS-POAM-031`). **Phase 0 (2026-10-01):** Not wired in Phase 0 (no local TLS proxy). Gap: TLS terminates at Front Door / App Gateway at deployment (YPMS-POAM-031). |
| **SC-8(1) Cryptographic Protection** | 📝 | O | `C.5.7.9` | FIPS 140-2/-3 cryptography for transmission. **Evidence:** module cert. |
| **SC-10 Network Disconnect** | 📝 | O | `C.5.7.3` | Idle-session network disconnect. **Evidence:** timeout config. |
| **SC-12 Cryptographic Key Establishment and Management** | 🟡 | O | `C.5.7.9` | Key management via Azure Key Vault (Gov / HSM). **Evidence:** key-management design; rotation policy (`YPMS-POAM-032`). **Phase 0 (2026-10-01):** Column key derived with HKDF-SHA256; ≥32-byte key material and ≥32-byte JWT secret enforced at startup. Evidence: `src/ypms/security/column_crypto.py:49`, `src/ypms/settings.py:15`. Gap: Keys come from env vars; Key Vault (Gov/HSM) in Phase 1. |
| **SC-13 Cryptographic Protection** | 🟡 | O | `C.5.7.9`, `C.5.7.25` | FIPS 140-3 cryptography (140-2 acceptable during deprecation window) at rest and in transit. **Evidence:** module cert + usage map. **Phase 0 (2026-10-01):** FIPS-approved algorithms only: AES-256-GCM, HKDF-SHA256, HMAC-SHA256 (JWT), PBKDF2-SHA256. Evidence: `src/ypms/security/column_crypto.py:55`. Gap: Validated-module status is deployment-dependent (YPMS-POAM-032). |
| **SC-15 Collaborative Computing Devices** | 📝 | O | | Camera/mic access disabled by default in workspace tooling. |
| **SC-17 Public Key Infrastructure Certificates** | 📝 | O | `C.5.6.5` | Certificate Authority configuration for integrations. **Evidence:** CA config. |
| **SC-18 Mobile Code** | 📝 | O | | Only signed mobile code allowed. |
| **SC-20 Secure Name/Address Resolution Service (Authoritative)** | 🔵 | I | | Inherited from IaaS. |
| **SC-21 Secure Name/Address Resolution Service (Recursive)** | 🔵 | I | | Inherited. |
| **SC-22 Architecture and Provisioning for Name/Address Resolution** | 🔵 | I | | Inherited. |
| **SC-23 Session Authenticity** | 📝 | O | `C.5.7.20` | Anti-CSRF, secure cookies, per-transaction integrity for financial actions. **Evidence:** session-management design. |
| **SC-28 Protection of Information at Rest** | 🟡 | O | `C.5.7.25`, `C.5.7.50` | Encryption at rest for all PII (Postgres TDE + envelope encryption for blobs); SSN masked/anonymized in display (`YPMS-POAM-080`). **Evidence:** DB encryption config; SSN-handling design. **Phase 0 (2026-10-01):** SSN encrypted at the app layer (AES-256-GCM, column-bound AAD); write-only on the model; masked in every response. Evidence: `src/ypms/security/column_crypto.py:55`, `src/ypms/youth/models.py:83`. Gap: Banking columns not yet built; Postgres TDE and blob encryption are deployment. |
| **SC-28(1) Cryptographic Protection** | 📝 | O | `C.5.7.9` | FIPS-approved cryptography for at-rest data via Azure Key Vault. **Evidence:** module cert. |
| **SC-39 Process Isolation** | 🔵 | I | | Inherited from IaaS + COTS platform. |

### SI — System and Information Integrity

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **SI-1 Policy and Procedures** | 📝 | O | `C.5.7.53` | Aligned to DC OCTO IT security policy. |
| **SI-2 Flaw Remediation** | 📝 | O | `C.5.7.52`, `C.5.6.13` | Cyber-threat remediation; failover-during-patching. DOES OIT patch cadence: Critical within 15 days, High within 30. **Evidence:** patch SLA statement; patch-window log. |
| **SI-2(2) Automated Flaw Remediation Status** | 📝 | O | | Patch dashboard. |
| **SI-3 Malicious Code Protection** | 📝 | O | | Upload scanning for document uploads; endpoint AV on managed devices. **Evidence:** AV product + scan-on-upload config. |
| **SI-4 System Monitoring** | 📝 | O | `C.5.7.26`, `C.5.6.9` #19–23, `C.5.6.22` | IDS/IPS with alerts; Sentinel with configurable aggregation and business-rule alerts; performance monitoring. **Evidence:** monitoring inventory (`YPMS-POAM-043`). |
| **SI-4(2) Automated Tools for Real-Time Analysis** | 📝 | O | `C.5.6.9` #19 | Sentinel. **Evidence:** workspace record. |
| **SI-4(4) Inbound and Outbound Communications Traffic** | 📝 | O | | Network monitoring. **Evidence:** monitoring dashboard. |
| **SI-4(5) System-Generated Alerts** | 📝 | O | `C.5.6.9` #21–23 | Alerts on thresholds and lockouts. |
| **SI-5 Security Alerts, Advisories, and Directives** | 📝 | O | | DOES OIT subscribes to relevant advisory feeds (CISA, Microsoft Security Response Center, NIST NVD). |
| **SI-7 Software, Firmware, and Information Integrity** | 📝 | O | | Signed artifacts + integrity checks on deploy. |
| **SI-7(1) Integrity Checks** | 📝 | O | | On startup and periodically. |
| **SI-8 Spam Protection** | 🤝 | O, D | | Inbound-email spam protection at DOES enterprise level. |
| **SI-10 Information Input Validation** | ✅ | O | `C.5.7.44`, `C.5.6.2`, `C.5.6.3.b`, `C.5.6.3.d` | Character set / length / numerical range / format / content validation with trusted-source restriction; address, age, residency data checks; SSA SSN verification; DC MAR address validation. **Evidence:** input-validation rules; sample validation-failure log. **Phase 0 (2026-10-01):** Pydantic validation on every request body; SSN format and never-issued ranges, DOB, ZIP, email, lengths. Evidence: `src/ypms/youth/schemas.py:21`. |
| **SI-11 Error Handling** | ✅ | O | `C.5.7.43`, `C.5.6.9` #2, #3 | Corrective information without adversary-exploitable disclosure; consistent error handling; all errors logged. **Evidence:** error-response inventory. **Phase 0 (2026-10-01):** Unhandled errors return a generic body with request id; logs record type and frames, not messages; SQL parameters hidden. Evidence: `src/ypms/main.py:56`, `src/ypms/db.py:24`, `tests/test_app_guards.py`. |
| **SI-12 Information Management and Retention** | 🤝 | O, D | | Aligned with DOES records schedule. **Evidence:** retention policy. **Phase 0 (2026-10-01):** Every table carries a retention policy; app refuses to boot otherwise; nightly report-only job. Evidence: `src/ypms/framework/retention.py:135`, `src/ypms/main.py:34`. Gap: Disposal execution is Phase 5; periods await YPMS-POAM-054. |
| **SI-16 Memory Protection** | 🔵 | I | | Inherited from IaaS / OS. |

### SR — Supply Chain Risk Management

| Control | Status | Owner | RFP Ref | Implementation & Evidence |
|---|---|---|---|---|
| **SR-1 Policy and Procedures** | 📋 | D | | DOES / DC OCTO supply-chain policy. |
| **SR-2 Supply Chain Risk Management Plan** | 🤝 | O, D | | SCRM plan referencing third-party components (payroll, LMS, DC MAR, IdPs) and open-source dependencies. **Evidence:** SCRM plan. |
| **SR-2(1) Establish SCRM Team** | 📋 | D | | DOES SCRM POC assigned. |
| **SR-3 Supply Chain Controls and Processes** | 📝 | O | `C.5.6.13` | Approved-software list; upgrade path. **Evidence:** approved list. |
| **SR-5 Acquisition Strategies, Tools, and Methods** | 📋 | D | | Applies to third-party components DOES procures. |
| **SR-6 Supplier Assessments and Reviews** | 🤝 | O, D | | Vendor and fourth-party disclosure and review. **Evidence:** vendor register. |
| **SR-8 Notification Agreements** | 🤝 | O, D | `C.5.8.18`–`C.5.8.20` | Breach-notification clauses flowed down to payroll / LMS / SaaS contracts. **Evidence:** contract clauses. |
| **SR-10 Inspection of Systems or Components** | 📝 | O | | DOES right-to-inspect provision in vendor contracts. |
| **SR-11 Component Authenticity** | 📝 | O | | Signed artifacts + provenance; CI enforces signature check on deploy. **Evidence:** SBOM + signing infrastructure. |

---

## 5. Tailorings and open items summary

### ⚠️ SSP tailorings above the source-RFP floor

| Ref | Source-RFP wording | SSP tailoring | Rationale | POA&M |
|---|---|---|---|---|
| SC-8 / AC-17(2) | `C.5.6.15` says "SSL" | TLS 1.2 minimum, TLS 1.3 preferred, FIPS-approved suites | SSL is deprecated; SSL Labs shows real vulnerabilities in any SSL version | `YPMS-POAM-031` |
| IA-2(1)/(2) | `C.5.7.6` says "unique identifier + shared secret answer" | MFA required for all privileged and staff accounts | NIST 800-63B AAL2 minimum for staff-role accounts in a Moderate system | `YPMS-POAM-030` |
| IA-7 / SC-12 / SC-13 | `C.5.7.9` says FIPS 140-2 | FIPS 140-3 where available; 140-2 acceptable during deprecation window | 140-2 is sunset for new validations | `YPMS-POAM-032` |
| IA-12 | Source RFP silent | IAL2-equivalent identity proofing for youth before payroll actions | Minors' PII + banking + SSN requires proofing above social-media assertion | `YPMS-POAM-033` |

### ❓ Open decisions (mirrored to SSP Appendix D)

| Ref | Question | Owner | POA&M |
|---|---|---|---|
| Stack | Python/FastAPI (OWC alignment) or Node/Express (DCYWP alignment) | DOES CIO | `YPMS-POAM-040` |
| Level 3 security | What is "Level 3 security" in source RFP `C.5.7.24`? | AO | `YPMS-POAM-051` |
| IA-8 | Identity model for minors — social-media login scope vs. full proofing before payroll | AO / DOES CIO / OYP | `YPMS-POAM-050` |
| PCI DSS scope | Is any card processing actually in scope? | OYP + procurement | `YPMS-POAM-052` |
| Health-record CSV | In-boundary steady state, or emergency-scoped extension? | AO + Privacy Officer | `YPMS-POAM-053` |
| Retention | Records schedule for audit logs, case records, backups | DOES records officer | `YPMS-POAM-054` |

### 📋 DOES-authored companion artifacts (path from this doc)

- [`SYSTEM_SECURITY_PLAN.md`](SYSTEM_SECURITY_PLAN.md) — this document's parent
- `ypms/FIPS_199_MEMO.md` — to be authored
- `ypms/PRIVACY_IMPACT_ASSESSMENT.md` — to be authored
- `ypms/INCIDENT_RESPONSE_PLAN.md` — to be authored
- `ypms/CONTINGENCY_PLAN.md` — to be authored
- `ypms/RULES_OF_BEHAVIOR.md` — to be authored
- `ypms/POAM.md` — to be authored; seeded by ⚠️ tailorings and ❓ open items above

---

**End of draft v0.2 (in-house build reframe).**