chris.tonjes/YPMS
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
YPMS/TODO.md
T
Chris TonjesandClaude Opus 4.7 8712e93258 Initial YPMS planning and ATO artifacts 
Pre-development state; no code yet.

Delivery model: in-house build by DOES OIT on Azure Government,
matching the DCYWP / OWC / Employer 360 pattern.

Stack decision (2026-09-30): Python 3.12 / FastAPI / SQLAlchemy /
Postgres, aligning with OWC.

System Owner / ISSO / AO: Chris Tonjes (DOES CIO). Role concentration
recorded in SSP §5 with risk-acceptance rationale.

Source functional and security requirements derived from the prior
YPMS RFP (Solicitation Docxxxxx, April 2025) — 54 C.5.7 security
requirements and Appendix E non-functional requirements — treated as
source specifications, not as Contractor obligations.

Documents included:

- CLAUDE.md, OVERVIEW.md — project router and program-level summary
- SYSTEM_SECURITY_PLAN.md v0.3 — NIST 800-53 Moderate baseline SSP
- NIST_800_53_CONTROL_MAPPING.md v0.2 — full control-family mapping
  with in-house ownership tags and evidence-artifact expectations
- POAM.md v0.1 — 62-item POA&M seeded from tailorings, open decisions,
  missing companion docs, and pre-ATO deliverables; two items closed
- PRIVACY_IMPACT_ASSESSMENT.md v0.1 — full PIA covering minors, SSN,
  banking, FERPA-covered OSSE records, CFSA foster/ward flags, and
  the dormant emergency health-record path
- ARCHITECTURE.md v0.1 — forward-looking design blueprint, OWC-aligned
- PHASE0_PLAN.md v0.1 — framework vendor-in, auth, RBAC, audit,
  Registrant vertical slice, 501 stubs for remaining entities
- TODO.md — 12-section working checklist tied to POA&M IDs
- OLA_RESPONSE_2026-09-30.md — Q&A for OLA / City Administrator

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-09-30 12:14:24 -04:00

191 lines
11 KiB
Markdown
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# YPMS — TODO Checklist
**Owner:** DOES CIO
**Last touched:** 2026-09-30
**Scope:** everything from team formation through Go-Live and steady-state operations. Companion tracker: [`POAM.md`](POAM.md) holds the numbered, dated, milestone-tracked version of the ATO items below.
Legend: `[ ]` open · `[~]` in progress · `[x]` done · `[!]` blocked · `[?]` needs decision
---
## 0. Team formation and governance
- [x] ISSO assigned in writing for YPMS (Chris Tonjes; `YPMS-POAM-090` closed 2026-09-30)
- [x] AO designated in writing (Chris Tonjes; `YPMS-POAM-002` closed 2026-09-30; role-concentration acceptance in SSP §5)
- [ ] Business Owner named (OYP)
- [ ] DOES OIT delivery lead named
- [ ] Backend engineer(s) assigned
- [ ] Frontend engineer(s) assigned
- [ ] Data/integration engineer assigned (owns OSSE, CFSA, SSA, DC MAR, payroll)
- [ ] Test/QA lead assigned
- [ ] DC OCTO cloud coordination POC identified
## 1. Stack and architecture decisions
- [x] **Stack decision** — Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment; recorded 2026-09-30)
- [x] Azure Government confirmed as hosting (aligned with OWC and Employer 360)
- [?] **Level 3 security clarification** — source RFP `C.5.7.24` (`YPMS-POAM-051`)
- [?] **Youth identity model** — social-media login scope, IAL2-equivalent proofing before payroll actions, parental co-auth for under-18 (`YPMS-POAM-050`)
- [?] **PCI DSS applicability** — expected out of scope since payroll is ACH via vendor (`YPMS-POAM-052`)
- [?] **Health-record CSV path disposition** — in-boundary vs. emergency extension (`YPMS-POAM-053`)
- [?] **Retention policy** — audit logs, case records, backups (`YPMS-POAM-054`)
- [ ] SORN applicability determination (`YPMS-POAM-094`)
- [ ] Correct the youth-age typo from the source RFP (glossary says "99–24"; should be 14–24) in derived requirements
- [x] High-level architecture document v0.1 drafted (`ypms/ARCHITECTURE.md`, 2026-09-30)
- [x] Conceptual data model in `ARCHITECTURE.md` §6 (25 core entities enumerated); logical + physical ERDs remain
- [ ] Logical and physical ERDs, full data dictionary, CRUD matrix (extends `ARCHITECTURE.md` §6)
- [ ] Security architecture review with DC OCTO (referenced in `ARCHITECTURE.md` §8)
## 2. Environments and pipeline
- [ ] Azure Government subscription requested and provisioned (`YPMS-POAM-041`)
- [ ] Dev environment
- [ ] Test environment
- [ ] Production environment (later)
- [ ] CIS Azure Foundations baseline applied to all environments
- [ ] Azure Key Vault (FIPS 140-3 HSM) provisioned (`YPMS-POAM-032`)
- [ ] Managed Identity model for service-to-service auth
- [ ] Postgres flexible server provisioned (private endpoint)
- [ ] Git repo initialized under `ypms/` (this directory) with branch protection
- [ ] CI/CD pipeline scaffold (`YPMS-POAM-042`)
- [ ] Build + unit-test gate
- [ ] SAST gate
- [ ] SCA (dependency vulnerability) gate
- [ ] Secret scanning gate
- [ ] SBOM generation per release (CycloneDX)
- [ ] Container image scanning
- [ ] Sentinel integration for log streaming (`YPMS-POAM-043`)
- [ ] Backup + restore procedure documented and tested (`YPMS-POAM-044`)
## 3. Data-sharing agreements & interconnections
Existing DOES agreements cover the current OYP workflows; YPMS-scope amendments or renewals are the path, not new drafts.
- [ ] **DOES–OSSE data-sharing agreement (FERPA)** — renewal / YPMS-scope amendment (`YPMS-POAM-020`) — **blocks OSSE ingest build**
- [ ] **DOES–CFSA MOU (DC Code Title 4)** — renewal / YPMS-scope amendment (`YPMS-POAM-021`) — **blocks CFSA ingest build**
- [ ] **SSA Electronic Information Exchange agreement** — renewal / YPMS-scope confirmation (`YPMS-POAM-022`) — **blocks SSN cross-match build**
- [ ] **DC MAR service agreement** — confirm coverage under existing OCTO umbrella
- [ ] **Payroll vendor selection + security review + ISA/DPA** (`YPMS-POAM-023`) — **blocks payroll integration build**
- [ ] **LMS vendor selection + security review** — blocks orientation-tracking build
- [ ] **DC OCTO Sentinel MOU / ingestion agreement**
- [ ] **NOC coordination arrangement** — 30-day maintenance-window notice cadence
- [ ] **Emergency health-record CSV path** — either MOU with source or scoping decision to defer (`YPMS-POAM-053`)
- [ ] ISAs / NIST 800-47 Rev. 1 documents for each of the above (`YPMS-POAM-084`)
## 4. ATO artifacts
- [x] Draft SSP v0.3 (`ypms/SYSTEM_SECURITY_PLAN.md`) — in-house build reframe complete (`YPMS-POAM-010`)
- [x] Draft NIST 800-53 control mapping v0.2 (`ypms/NIST_800_53_CONTROL_MAPPING.md`) — in-house build reframe complete (`YPMS-POAM-015`)
- [x] Draft POA&M v0.1 (`ypms/POAM.md`) — reflects in-house build model
- [ ] **FIPS 199 categorization memo** signed by AO (`YPMS-POAM-001`)
- [x] **Privacy Impact Assessment v0.1 drafted** (`YPMS-POAM-011`; `ypms/PRIVACY_IMPACT_ASSESSMENT.md`; 2026-09-30) — awaiting Privacy Officer + OGC review, then AO signature
- [ ] **Incident Response Plan** — tabletop with DC OCTO SOC (`YPMS-POAM-012`)
- [ ] **Contingency Plan** — functional restore drill (`YPMS-POAM-013`)
- [ ] **Rules of Behavior** — staff / host / youth+parent variants with parental-consent flow (`YPMS-POAM-014`)
- [ ] **Continuous Monitoring Strategy** document (`YPMS-POAM-074`)
- [ ] **Independent Control Assessment (SCA)** commissioned and executed (`YPMS-POAM-060`)
- [ ] **Penetration test** commissioned and executed (`YPMS-POAM-061`)
- [ ] **ATO decision package** compiled and submitted to AO
- [ ] **ATO signed** before production data flows in
## 5. Build
Iterative Agile delivery (Scrum/Kanban/SAFe — match OWC's phased approach). Illustrative phase breakdown; refine at architecture kickoff.
- [ ] **Phase 1 — Foundation.** Auth, user model, RBAC, base UI shell, admin skeleton, audit-logging framework.
- [ ] **Phase 2 — Application intake.** Youth registration, application form, save/resume, document upload with malware scanning.
- [ ] **Phase 3 — Eligibility engine.** Rules-driven auto-eligibility from Appendix D of source RFP; categorical eligibility across programs.
- [ ] **Phase 4 — External integrations.** DC MAR address verification, SSA SSN verify (blocked on `YPMS-POAM-022`), OSSE ingest (blocked on `YPMS-POAM-020`), CFSA ingest (blocked on `YPMS-POAM-021`).
- [ ] **Phase 5 — Certification and orientation.** Certification event workflow, LMS integration.
- [ ] **Phase 6 — Host/employer.** Host registration, worksite management, job posting.
- [ ] **Phase 7 — Matching and enrollment.** Job matching engine, program enrollment.
- [ ] **Phase 8 — Time and payroll.** Online timekeeping, payroll vendor integration (blocked on `YPMS-POAM-023`), transportation vouchers, tax forms.
- [ ] **Phase 9 — Reporting.** Native reports replacing MicroStrategy; audit-log search.
- [ ] **Phase 10 — Admin functions.** Broadcast notifications, workflow rule maintenance, user profile management.
## 6. Security implementation (crosscuts all phases)
- [ ] MFA for staff and admin (Entra ID conditional access) (`YPMS-POAM-030`)
- [ ] TLS 1.2+ enforced everywhere; SSL Labs A+ on public endpoints (`YPMS-POAM-031`)
- [ ] FIPS 140-3 cryptography (`YPMS-POAM-032`)
- [ ] IAL2-equivalent identity proofing before payroll actions (`YPMS-POAM-033`)
- [ ] SSN masking + at-rest encryption (`YPMS-POAM-080`)
- [ ] System-use notification banner (`YPMS-POAM-070`)
- [ ] Auto-disable inactive accounts (`YPMS-POAM-071`)
- [ ] Quarterly privileged-access recert process (`YPMS-POAM-072`)
- [ ] Annual all-user access recert process (`YPMS-POAM-073`)
- [ ] Language Access Act compliance (`YPMS-POAM-081`)
- [ ] Section 508 / WCAG 2.1 AA compliance audit (`YPMS-POAM-082`)
- [ ] Parental consent workflow for under-18 (`YPMS-POAM-083`)
- [ ] Anti-bot / rate-limit for MBSYEP peak windows (`YPMS-POAM-101`)
## 7. Testing
- [ ] Unit-test coverage target set and enforced in CI
- [ ] Functional tests per feature
- [ ] Non-functional tests: performance (99.5% SLA envelope, <1s response), load (50%/year growth headroom)
- [ ] Accessibility tests (Section 508)
- [ ] Language-access tests
- [ ] UAT plan and test scripts approved
- [ ] Vulnerability scanning cadence in production (`YPMS-POAM-062`)
## 8. Legacy retirement & data migration
- [ ] Data-migration plan from each of the seven legacy tools (`YPMS-POAM-105`)
- [ ] Data-quality baselines documented per source
- [ ] PII handling during migration
- [ ] Cutover strategy — big-bang vs. phased-by-program
- [ ] Read-only archive of legacy data for audit / statute-of-limitations retention
- [ ] Legacy system decommission schedule and destruction evidence (`YPMS-POAM-106`)
## 9. Training & change management
- [ ] Training plan for OYP staff, host/employer, youth self-service (`YPMS-POAM-091`)
- [ ] System overview intro video (MP4, closed captioned)
- [ ] Role-based training materials
- [ ] Help / KB content with an updateable help system
## 10. Go-Live & steady-state
- [ ] Go/No-Go decision meeting with AO
- [ ] Cutover runbook rehearsed
- [ ] Go-Live
- [ ] Post-Go-Live retrospective
## 11. Continuous monitoring (steady-state cadence)
- [ ] Monthly vulnerability scans
- [ ] Monthly POA&M review by DOES ISSO
- [ ] Quarterly privileged access recertification
- [ ] Annual full access recertification
- [ ] Annual Contingency Plan test (tabletop + functional element)
- [ ] Annual Independent Control Assessment
- [ ] Annual penetration test
- [ ] Annual SSP refresh
- [ ] Monthly availability performance report against 99.5% SLA
---
## Immediate next actions (this week)
1. ~~SSP v0.3 in in-house build framing~~ ✓
2. ~~Control mapping v0.2 in in-house build framing~~ ✓
3. ~~POA&M v0.1 seeded~~ ✓
4. ~~ISSO / AO / System Owner: Chris Tonjes (with role-concentration risk acceptance)~~ ✓
5. ~~Stack: Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment)~~ ✓
6. ~~Draft the PIA — minors + FERPA + CFSA is the substantive part~~ ✓ (v0.1 drafted 2026-09-30)
7. Get **existing OSSE, CFSA, and SSA agreements pulled from OGC files** to scope renewals (`YPMS-POAM-020`, `YPMS-POAM-021`, `YPMS-POAM-022`)
8. Draft the **FIPS 199 categorization memo** for AO signature (`YPMS-POAM-001`)
9. ~~Start the architecture document~~ ✓ (`ypms/ARCHITECTURE.md` v0.1 drafted 2026-09-30)
10. Route PIA v0.1 to Privacy Officer + OGC review
11. ~~Author PHASE0_PLAN.md~~ ✓ (`ypms/PHASE0_PLAN.md` v0.1 drafted 2026-09-30)
12. DC OCTO security architecture review meeting scheduled
## Parking lot (not yet triaged)
- Emerging-tech (GenAI/ML) posture — ethical measures required; data must stay in DOES domain (`YPMS-POAM-103`)
- FOIA response workflow with PII redaction (`YPMS-POAM-102`)
- Records schedule alignment with DOES records officer
- Approved-software list governance (`YPMS-POAM-100`)
- Employer 360 dependency: once E360 lands, YPMS host/employer records should consume it rather than re-implementing employer matching
Reference in new issue View Git Blame Copy Permalink