YPMS/PRIVACY_IMPACT_ASSESSMENT.md

Privacy Impact Assessment (PIA)

Youth Program Management System (YPMS)

Document Version: 0.1 (Draft) Date: 2026-09-30 Status: Pre-Development / Pre-Authorization Companion to: SYSTEM_SECURITY_PLAN.md, NIST_800_53_CONTROL_MAPPING.md, POAM.md

Drafting note. This PIA is required because YPMS processes Personally Identifiable Information (PII), including PII of minors, and because it ingests FERPA-covered educational records and CFSA foster/ward-of-state records — both of which carry statutory confidentiality above generic PII. It supports DC Personal Information Protection Act (DC Code §28-3851 et seq.) compliance and accompanies the System Security Plan. Items marked [TBD] require completion by DOES leadership before ATO submission. Where a source-RFP requirement is load-bearing (e.g., C.5.7.50 for SSN masking), the identifier is cited inline.

---

Table of Contents

1. System Identification
2. Authority and Purpose
3. Information Collection
4. Use of Information
5. Sharing and Disclosure
6. Notice and Consent
7. Individual Rights
8. Data Quality and Integrity
9. Retention and Disposal
10. Security Safeguards
11. Auditing and Accountability
12. Privacy Risks and Mitigation
13. PIA Review and Approval

---

1. System Identification

Field	Value
System Name	Youth Program Management System (YPMS)
Operating Agency	DC Department of Employment Services (DOES), Office of Youth Programs (OYP)
System Owner	Chris Tonjes, DOES CIO
Delivery Model	In-house build by DOES OIT on Azure Government (Python 3.12 / FastAPI / SQLAlchemy / Postgres)
PII Populations	(a) Minors aged 14–24 registering or participating in OYP programs, with distinct treatment for under-18 registrants; (b) parents / guardians of under-18 registrants; (c) host employer contacts and worksite supervisors; (d) DOES OIT and OYP staff and any contracted individual developers.
Estimated Volume	~36,000 total distinct persons at steady state (per RFP C.5.6.21): 27,000 youth, 7,400 parents/guardians, 1,500 host employers, 90 DOES users, 100 other-agency users. Peak surge: MBSYEP application window (typically January–March) may see the youth-registration volume enter within a compressed period.
Privacy Impact Threshold	Yes — full PIA required. System collects (a) PII of minors — a special population — (b) SSN, (c) banking / financial-account information, (d) FERPA-covered educational records, (e) CFSA foster/ward-of-state indicators (confidential under DC Code Title 4), and (f) a dormant path for health records under emergency declaration.
FIPS 199 Provisional Categorization	Moderate / Moderate / Moderate with High-sensitivity subsets (see SSP §2).

---

2. Authority and Purpose

2.1 Legal Authority for Collection

• DC Code Title 32, Chapter 2, Subchapter II — governs youth employment in the District.
• DC Code Title 32, Chapter 2, Subchapter V — establishes the Mayor's Youth Leadership Institute (MBYLI).
• DC Municipal Regulations Title 7 — Employment Benefits.
• Social Security Act, Title III / Title IX — federally funded workforce programs subject to the confidentiality requirements of §1106 (RFP §C.2 Item 7).
• Federal Unemployment Tax Act (FUTA) — where wage records feed cross-agency reporting.
• Family Educational Rights and Privacy Act (FERPA), 20 USC §1232g — governs the ingest of OSSE-sourced school enrollment records.
• DC Code Title 4 — governs the confidentiality of CFSA foster/ward-of-state indicators.
• Privacy Act of 1974, 5 USC §552a — applies where DOES acts under federal delegation for USDOL-reported program data.
• DC Personal Information Protection Act (DC Code §28-3851 et seq.) — governs breach notification for PII collected.
• DC Language Access Act of 2004 — governs delivery of notices and portal content in required languages.

2.2 Purpose of the System

To centralize OYP program administration end-to-end, replacing seven legacy tools:

• Take applications from youth and hosts across MBSYEP, HSIP, MBYLI (SIT/SYP/Global), CRESP, and future OYP programs.
• Determine eligibility using data checks (age, residency, SSN validation, foster/ward status, school enrollment) and business rules.
• Certify applications, capture orientation completion, match youth to worksites, and manage enrollment.
• Track hours worked and issue payment via a third-party payroll vendor with annual tax-form generation.
• Provide reports and analytics replacing MicroStrategy.
• Support DOES staff workflows replacing PF3 admin-backdoor logins and manual payroll approvals.

2.3 Mission Connection

YPMS directly supports DOES's statutory obligation to administer District youth employment and workforce-development programs and to protect the minors served by those programs.

---

3. Information Collection

3.1 PII Elements — Youth Registrant

Element	Source	Purpose	Mandatory?	Sensitivity
First, middle, last name	Registrant	Identity, permit / payroll issuance	Yes	Standard PII
Date of birth	Registrant	Age eligibility per program	Yes	Standard PII
SSN	Registrant	SSA cross-match; payroll tax reporting	Yes for enrolled participants; not required for pre-application browsing	Sensitive PII
Residential and mailing address	Registrant; validated via DC MAR	DC residency verification, correspondence	Yes	Standard PII
Phone, email	Registrant	Notifications, secure home-page URL delivery per source RFP C.5.21.5	Yes	Standard PII
Race, ethnicity, gender (demographics)	Registrant (self-report)	USDOL federal reporting; equity analysis	Optional per federal reporting rules	Standard PII
School name, grade level (self-report)	Registrant	Program-fit determination	Yes for school-year programs	Standard PII
Educational-record excerpts (enrollment status, grade)	OSSE via CSV ingest	Eligibility verification	Yes when OSSE match applies	FERPA-covered — heightened
Foster / ward-of-state status	CFSA via CSV ingest	Categorical-eligibility rules; support-service triage	Yes when CFSA match applies	DC Code Title 4 — heightened
Immigration / work-authorization documents	Registrant upload	Employment eligibility	Yes	Sensitive PII
Resume content	Registrant upload or Resume Builder	Job matching	Optional	Standard PII
Job preferences, career interests	Registrant	Job matching	Optional	Standard PII
Banking (routing + account)	Registrant	Direct-deposit payroll	Yes for paid participants	Sensitive PII
Tax withholding elections	Registrant	Payroll	Yes for paid participants	Standard PII
Application answers, financial-literacy responses	Registrant	Program placement	Yes per program	Standard PII
Hours worked	Timekeeping	Payroll computation	Yes	Standard PII
Support-service enrollment (e.g., transportation)	Registrant / staff	Program services	Optional	Standard PII
Program participation history	System-generated	Retention, reporting, categorical eligibility	Yes	Standard PII
Health records (contingent)	CSV under declared emergency only (source RFP C.5.6.3.a.2)	Emergency operations only	No (dormant path)	Heightened; HIPAA-adjacent

3.2 PII Elements — Parent / Guardian (of under-18 registrants)

Element	Source	Purpose	Mandatory?	Sensitivity
First, last name	Parent	Consent record	Yes	Standard PII
Relationship to registrant	Parent	Consent authority	Yes	Standard PII
Address, phone, email	Parent	Notification, consent workflow	Yes	Standard PII
Consent signature and timestamp	Parent	Lawful basis for minor's data processing	Yes	Standard PII
Parent user credentials (if a separate portal account is created)	Parent	Authenticated access to their under-18 registrant's record	Optional	Standard PII

3.3 PII Elements — Host Employer Contact

Element	Source	Purpose	Mandatory?	Sensitivity
Contact name, title	Host	Employer relationship	Yes	Standard PII
Business address, phone, email	Host	Correspondence	Yes	Standard PII
Worksite supervisor names	Host	Worksite assignment	Yes	Standard PII
Signed employer attestations	Host	Compliance with youth-employment rules	Yes	Standard PII

3.4 PII Elements — DOES / Contracted Staff

Element	Source	Purpose	Mandatory?	Sensitivity
Name, DOES email	HR feed	Account identity	Yes	Standard PII
Role, work unit	HR feed	RBAC assignment	Yes	Standard PII
Skill set, geographic area, language skills, availability calendar	HR / staff self-service (source RFP C.5.21.30)	Workforce scheduling	Optional	Standard PII
Authentication credentials + MFA factors	Entra ID	Authentication	Yes	Sensitive

3.5 Explicitly Not Collected

• Biometric data (fingerprint, face, voice) — not collected.
• Location tracking (device GPS) — not collected.
• Content of private communications — not collected.
• Health data — not collected in steady-state operations. The dormant emergency CSV path is deferred to an emergency-scoped extension with its own PIA addendum before activation (see YPMS-POAM-053).

3.6 Collection Method

• Web/mobile portal (primary channel).
• Server-to-server ingest (CSV via secure file transfer) from OSSE and CFSA.
• API queries to SSA, DC MAR.
• Bidirectional integration with third-party payroll vendor.
• Bidirectional integration with third-party LMS (orientation completion status only; no LMS-owned PII returned).
• Staff-mediated correction and augmentation via the internal portal.

---

4. Use of Information

4.1 Primary Uses

Use	PII involved	Legal basis
Determine program eligibility	Age, residency, SSN, foster/ward status, school enrollment, demographics	DC Code Title 32; program-specific rules in RFP Appendix D
Verify identity	SSN (via SSA), address (via DC MAR), immigration docs	Employment eligibility; SSA data-exchange agreement
Match youth to worksites	Job preferences, resume, availability, geography	DC Code Title 32
Track hours worked and issue payment	Timekeeping, banking, tax data	Employment law; payroll obligations
Generate annual tax forms	SSN, wages, withholdings	IRS reporting; via payroll vendor
Notify participants	Email, SMS, phone	Programmatic communications per source RFP C.5.21.4, C.5.21.5
Support-service enrollment	Registrant preferences, CFSA foster/ward status where applicable	Program-service delivery
Report to USDOL	De-identified or aggregated program participation	Federal grant reporting
Statistical / equity analysis	De-identified demographics	Federal grant reporting; internal program improvement
Fraud detection	Cross-reference of application data with SSA, wage, and NDNH data	42 USC §653; SSA data exchange

4.2 Prohibited Uses (Purpose Limitation)

• No use for immigration enforcement. Immigration-document uploads are collected solely to establish work authorization per federal employment law; they are not shared with immigration enforcement absent a lawful process (subpoena, court order) reviewed by DOES OGC.
• No use for law enforcement of the child or their family beyond what is expressly required by DC or federal law.
• No use for advertising, marketing, or commercial resale. Data is not sold to third parties.
• No use of foster/ward status for anything outside categorical eligibility and support-service triage. Foster/ward flags are not surfaced to host employers or worksite supervisors.
• No use of school-enrollment records outside eligibility determination. OSSE-sourced FERPA-covered records are not surfaced to hosts, other agencies, or the public.
• No use of health records in steady-state operations; the dormant emergency path is scope-restricted.

---

5. Sharing and Disclosure

5.1 Routine Sharing (with executed agreements)

Recipient	Data Shared	Direction	Legal / Agreement Basis
SSA (Business Services Online)	SSN + selected identity elements	Outbound (query)	SSA Electronic Information Exchange Security Requirements; YPMS-POAM-022
OSSE	Registrant identifiers for enrollment cross-match	Inbound (CSV)	DOES–OSSE data-sharing agreement (FERPA); YPMS-POAM-020
CFSA	Registrant identifiers for foster/ward cross-match	Inbound (CSV)	DOES–CFSA MOU (DC Code Title 4); YPMS-POAM-021
DC MAR	Address strings	Outbound (query)	DC OCTO service agreement
Third-party payroll vendor	Hours, banking, tax IDs, tax forms	Bidirectional	Vendor contract with DPA/ISA; YPMS-POAM-023
Third-party orientation LMS	Registrant identifier + orientation status flag only	Bidirectional	Vendor contract with DPA
DC OCTO Sentinel / SOC	Security telemetry (log stream)	Outbound	DC OCTO CISO agreement; YPMS-POAM-043
DC NOC	Availability and change coordination signals	Bidirectional	Internal DOES/OCTO operational
USDOL ETA	Aggregated / de-identified program reporting	Outbound	Federal grant reporting; ET Handbook 336
IRS (indirect, via payroll vendor)	W-2 / 1099 issuance data	Outbound (vendor-mediated)	Payroll vendor handles per IRS specs
National Directory of New Hires (NDNH) (if scoped in)	Wage/new-hire cross-match	Bidirectional	42 USC §653

5.2 Non-Routine Sharing

• Subpoenas, court orders, and lawful investigative demands are handled by DOES OGC. YPMS provides an audit trail so a specific record's disclosure history is reconstructable.
• FOIA requests are handled by DOES OGC with PII redaction; individual PII is never disclosed under FOIA.
• Breach notification to individuals and to the DC Attorney General is governed by DC Code §28-3852 and executed under the Incident Response Plan.

5.3 Public-Facing Data

Public content is limited to:

• Program information (names, descriptions, dates).
• Host-employer job postings (position title, worksite, description, apply link).
• Application forms and static help/training content.
• Aggregated, de-identified counts for press / public reporting.

No individual PII is exposed publicly. No profile pages, no unauthenticated lookup of persons.

---

6. Notice and Consent

6.1 Privacy Notice

• Presented at first youth or host contact with the system (registration flow), before any PII is collected beyond an email address.
• Available in DC Language Access Act–required languages (YPMS-POAM-081).
• Discloses: identity of DOES as data controller, categories of PII collected, purposes of collection, categories of recipients (SSA, OSSE, CFSA, payroll vendor), individual rights, retention periods (once set), how to contact the DOES Privacy Officer.
• Version-stamped; changes tracked in system so a record can be tied to the notice version in force at the time of collection.

6.2 Consent — Adult Registrants (18+)

• Consent obtained at registration by explicit checkbox acknowledgment of the privacy notice.
• Optional-field consents (demographics, resume upload) are separate from mandatory-field consents.
• Consent to share data with the payroll vendor for direct-deposit purposes is a separate opt-in during payroll enrollment.

6.3 Consent — Under-18 Registrants (Parental Co-Consent)

Under-18 registrants require parental / guardian consent for the collection and processing of their PII beyond initial pre-application browsing (YPMS-POAM-083). Design constraints:

• The minor may browse program content and complete a pre-application draft without parental involvement.
• Before eligibility is determined, before SSN is collected, and before any payroll-related activity, a parental consent flow is triggered:
  • The minor identifies the parent/guardian and provides their contact information.
  • The system sends a verification email/SMS to the parent/guardian with a secure link.
  • The parent/guardian creates an account (or authenticates against an existing one) and provides explicit, granular consent.
  • The consent record is retained with the minor's application and includes the parent's identity, timestamp, IP, and the version of the notice in force.
• The parent/guardian can view and export their under-18 registrant's data at any time via their portal account.
• Consent can be revoked by the parent/guardian; revocation triggers the individual-rights workflow (§7).

6.4 Consent — Sensitive Data Elements

• SSN collection: disclosed at the point of collection with the specific purpose (SSA cross-match, payroll reporting). Alternate documentation paths accepted where legally permissible.
• Immigration/work-authorization documents: disclosed as required by federal employment law; document image encrypted at rest and access-audited.
• Banking data: disclosed as required for direct-deposit payroll; not shared with hosts or worksite supervisors.
• Foster/ward status: ingested from CFSA; the minor and parent are informed that categorical-eligibility rules use this data for support-service triage; the flag is never displayed to hosts or supervisors.
• OSSE educational records: ingested under the DOES–OSSE data-sharing agreement; the minor and parent are informed at registration that DOES verifies school enrollment with OSSE.

---

7. Individual Rights

Youth (or parent/guardian for under-18) and host contacts have the following rights, accessible through the portal.

Right	Implementation
Access — view what YPMS holds	Portal profile view + full record export (source RFP C.5.7.19, C.5.7.21).
Correction	Portal profile update (source RFP C.5.7.19); staff-assisted correction with audit trail.
Deletion / erasure	Case-by-case; program-participation records generally retained per records schedule (see §9), but user-generated content (resume, uploaded documents) may be deleted subject to retention rules. Deletion requests routed through DOES Privacy Officer.
Portability	Export of the individual's record in machine-readable format on request.
Consent withdrawal	Parent/guardian may revoke consent for under-18 registrants; adult registrants may revoke consent for optional processing. Withdrawal does not affect participation records already generated (which are retained for statutory reasons) but stops further processing where possible.
Complaint	DOES Privacy Officer contact info in the privacy notice; complaints logged and tracked.

Language access: all rights are exercisable in DC Language Access Act–required languages.

---

8. Data Quality and Integrity

• Input validation at collection: character set, length, numerical range, format (source RFP C.5.7.44).
• Address validation via DC MAR with user override option (source RFP C.5.21.47).
• SSN validation via SSA cross-match (source RFP C.5.6.3.b).
• Age eligibility validation at eligibility determination.
• User self-service correction via portal (source RFP C.5.7.19).
• Staff correction with audit trail (source RFP C.5.7.15).
• Backdated transactions allowed for authorized users with reprocessing (source RFP C.5.7.17); every backdated change is audit-logged with actor identity.
• Duplicate detection across programs so a single registrant is not represented as multiple persons; categorical-eligibility reuse (source RFP C.5.3.3).
• Reconciliation with source-of-record systems on inbound cross-matches (SSA, OSSE, CFSA); mismatches routed to staff review, not silently overwritten.

---

9. Retention and Disposal

[TBD: aligned with DOES records schedule and OYP program-specific retention; tracked as YPMS-POAM-054.] Recommended interim posture pending records-officer sign-off:

Data class	Interim retention	Rationale
Program participation records (application, eligibility decision, enrollment, hours worked, payment record)	7 years after last activity	Aligned with federal wage-and-hour and tax-record retention; supports USDOL audits
Uploaded documents (immigration proof, resume, orientation certificates)	7 years after last activity or 1 year post-program completion, whichever is greater	Retention for compliance disputes
Banking data	Retain only through active-payroll relationship; purge at end of participation	Minimize sensitive-PII exposure
Consent records (parental and adult)	Match the retention of the record they relate to	Traceability of lawful-basis for any historical processing
Audit logs	1 year online + 3 years archived	Aligned with source RFP C.5.7.42 and SP 800-53 AU-11
Foster / ward-of-state indicators (CFSA-ingested)	Retain only current-year and one-prior-year; older values purged on annual cadence	Minimize exposure of DC Code Title 4 confidential data
OSSE-ingested enrollment records	Retain only current-year and one-prior-year	Minimize FERPA-covered data exposure
Health records (contingent path)	Not retained in steady state (path is dormant); when activated, retention set in emergency-specific PIA addendum with hard destruction date	Minimize HIPAA-adjacent data exposure
Contact channels (email, phone, address)	Retain per participation-record retention; suppressed after opt-out	Deliverability and notification

Destruction: encrypted delete plus DB tombstoning; media sanitization inherited from Azure Government.

---

10. Security Safeguards

Full detail is in the SSP (ypms/SYSTEM_SECURITY_PLAN.md) and the NIST 800-53 control mapping (ypms/NIST_800_53_CONTROL_MAPPING.md). Highlights specifically relevant to privacy:

• Encryption in transit: TLS 1.2+ (target 1.3), FIPS-approved cipher suites (SC-8; YPMS-POAM-031).
• Encryption at rest: Postgres TDE plus envelope encryption for blob storage; keys in Azure Key Vault (Gov / HSM) (SC-28, SC-12/13; YPMS-POAM-032).
• SSN masking / anonymization in all display contexts (source RFP C.5.7.50; YPMS-POAM-080).
• MFA for staff and admin (Entra ID conditional access) — above the source-RFP floor (YPMS-POAM-030).
• IAL2-equivalent identity proofing required before youth registrants can enroll for payroll actions (YPMS-POAM-033).
• Role-based access control with least privilege; CFSA foster/ward data and OSSE FERPA records reachable only by role-flagged users (AC-6).
• Audit logging of all PII interactions (source RFP C.5.7.39, C.5.7.48).
• Immediate breach notification through DOES OIT → DC OCTO CISO chain, followed by a 24-hour internal disclosure report and a 2-business-day remediation report (source RFP C.5.8.18–C.5.8.20 adopted as internal DOES policy).
• Malicious-code scanning on all uploaded documents (SI-3).
• Input validation and canonicalization (SI-10).
• Network segmentation with trusted / transition / untrusted zones (source RFP C.5.7.23).
• Sentinel SIEM integration for continuous monitoring (YPMS-POAM-043).
• Quarterly personnel-with-data-access roster review (source RFP C.5.8.17).

---

11. Auditing and Accountability

• Every PII interaction is audit-logged (source RFP C.5.7.39).
• What/when/where/source/outcome/identity is captured for every record modification (source RFP C.5.7.48).
• Before-and-after snapshots are retained for material changes to enable reconstruction (source RFP C.5.6.9 #8, C.5.7.49).
• Screen-access logs allow searching who viewed sensitive-data screens (source RFP C.5.6.9 #5, #7).
• Backdated transactions are logged with actor identity and rationale (source RFP C.5.7.17).
• Bulk operations (bulk group updates, splits, merges — source RFP C.5.21.40, C.5.21.41) are logged with the actor, the scope, and the change diff.
• Audit-log tampering protection: append-only storage design; Sentinel ingestion moves logs to a separate trust boundary.
• Chris Tonjes (System Owner / ISSO / AO) reviews privileged-access audit output monthly and posts findings to the POA&M cycle.
• Independent Control Assessment annually and before initial ATO (CA-2; YPMS-POAM-060).
• Penetration testing annually and after major releases (CA-8; YPMS-POAM-061).

---

12. Privacy Risks and Mitigation

Load-bearing section. Each risk carries a specific mitigation and a POA&M reference where applicable.

12.1 Population-specific risks

Risk	Impact	Mitigation	POA&M
Minors' data exposed to unauthorized parties — most registrants are minors, whose PII carries lifelong identity-theft risk if exposed	High	Parental co-consent for under-18 (§6.3); minimization at collection; encryption at rest and in transit; RBAC; audit logging	YPMS-POAM-083, YPMS-POAM-080
Foster/ward status disclosed to hosts, worksite supervisors, or peers — DC Code Title 4 confidentiality violation with severe personal impact	High	CFSA flag never displayed to hosts or supervisors; role-scoped access restricted to eligibility/support-service staff; annual purge of older values; audit review of who has viewed CFSA flags	Enforced in RBAC (§5.4 of control mapping); logged per AU-2
FERPA violation via OSSE-ingested records — federal law violation with USDOL/USDE consequences	High	OSSE data flows only through eligibility engine, not exposed to hosts or general staff; annual purge of older values; DOES–OSSE agreement scopes permitted uses; audit review	YPMS-POAM-020
Immigration-document exposure — chilling effect on lawful participation, potential harm to the individual	High	Access strictly limited to staff conducting work-authorization review; document image encrypted; access audited; never shared with immigration enforcement absent lawful process reviewed by OGC	Enforced in RBAC and via §4.2 purpose limitation

12.2 Sensitive-data-element risks

Risk	Impact	Mitigation	POA&M
SSN theft or exposure — enables identity theft affecting the minor for life	High	SSN masked/anonymized in all display contexts; encrypted at rest and in transit; access strictly limited; audit-logged (source RFP C.5.7.50); alternate documentation paths where legally permitted	YPMS-POAM-080
Banking data theft — direct financial harm	High	Encrypted at rest and in transit; passed to payroll vendor via secured integration; retained only through active-payroll relationship; access strictly limited; audit-logged	§9 retention + §10 safeguards
Tax-form data exposure (W-2/1099)	Moderate	Generated by payroll vendor, not YPMS; YPMS retains only summary references	§5.1 payroll integration
Health-record ingest activated under emergency without proper safeguards	High if activated poorly	Path is dormant by default; activation requires emergency-scoped PIA addendum, retention schedule, and destruction plan; not in steady-state boundary	YPMS-POAM-053

12.3 Access and authentication risks

Risk	Impact	Mitigation	POA&M
Weak authentication for staff enables unauthorized access to youth data	High	MFA required for all staff (above source-RFP floor); Entra ID conditional access; lockout after 5 failed attempts	YPMS-POAM-030
Social-media identity assertion insufficient for high-impact actions on minors' records	High	Social-media login limited to browsing / pre-application; IAL2-equivalent proofing required before banking/payroll actions; parental co-authentication considered for under-18	YPMS-POAM-033, YPMS-POAM-050
Stale accounts retain access after termination	Moderate	Auto-disable on inactivity (source RFP C.5.7.4); quarterly personnel roster review; termination workflow with same-day access revocation	YPMS-POAM-071, YPMS-POAM-072
Insider-threat scenarios — staff or contracted developer with access views records for unauthorized purposes	Moderate	Sensitive-data screen access logged and monitored (source RFP C.5.6.9 #5); monthly review of privileged-user activity; least-privilege RBAC; DOES personnel-security controls	AU-14, AC-6

12.4 Integration and vendor risks

Risk	Impact	Mitigation	POA&M
Payroll vendor breach exposes YPMS-shared PII (banking, SSN, wages)	High	Vendor SOC 2 / SIG-Lite review before selection; DPA with breach-notification clause; incident-response coordination in contract	YPMS-POAM-023
LMS vendor breach exposes orientation-completion linkage	Low (limited PII shared)	Only registrant identifier + status flag shared; vendor DPA	YPMS-POAM-023 follow-on for LMS
Social-media IdP receives more info than needed	Moderate	Minimal-scope OAuth requests (email + basic profile only); no data returned to IdP; not sufficient for payroll actions	YPMS-POAM-050
CSV file transfers (OSSE, CFSA) intercepted	High	Encrypted secure file transfer; source-authenticated; retention minimization on ingested data	§11 SSP interconnections
DC MAR query leaks address by log correlation	Low	Query is address-only, no other PII; DC OCTO service; TLS-encrypted	§11 SSP

12.5 Governance and process risks

Risk	Impact	Mitigation	POA&M
Role concentration — Chris Tonjes as System Owner + ISSO + AO reduces independent risk-acceptance	Moderate	Independent Control Assessment (annually) and pentest provide external technical validation; DC OCTO CISO and USDOL/OIG oversight provide external accountability; SSP §5 records the acceptance	SSP §5 risk-acceptance note
PIA not updated as system evolves	Moderate	PIA refreshed on every material change; at minimum annually; incorporated into POA&M review	§13 approval cadence
FOIA response inadvertently discloses PII	Moderate	DOES OGC review before every FOIA release; PII-redaction guidance in FOIA workflow	YPMS-POAM-102
Records-schedule not aligned; retention drifts	Low	Formalize retention with DOES records officer before Go-Live; automated retention purges	YPMS-POAM-054

---

13. PIA Review and Approval

Role	Name	Signature	Date
System Owner (DOES CIO)	Chris Tonjes
Information System Security Officer	Chris Tonjes
DOES Privacy Officer	[TBD]
DOES OGC representative	[TBD]
Business Owner (OYP)	[TBD]
Authorizing Official	Chris Tonjes (per SSP §5 role-concentration note)

Review cadence: PIA is refreshed on every material change to PII collected, purposes of processing, sharing, retention, or safeguards. At minimum, PIA is reviewed annually against SSP and control mapping revisions.

---

End of draft v0.1.