Chris TonjesandClaude Opus 4.7
8712e93258
Pre-development state; no code yet. Delivery model: in-house build by DOES OIT on Azure Government, matching the DCYWP / OWC / Employer 360 pattern. Stack decision (2026-09-30): Python 3.12 / FastAPI / SQLAlchemy / Postgres, aligning with OWC. System Owner / ISSO / AO: Chris Tonjes (DOES CIO). Role concentration recorded in SSP §5 with risk-acceptance rationale. Source functional and security requirements derived from the prior YPMS RFP (Solicitation Docxxxxx, April 2025) — 54 C.5.7 security requirements and Appendix E non-functional requirements — treated as source specifications, not as Contractor obligations. Documents included: - CLAUDE.md, OVERVIEW.md — project router and program-level summary - SYSTEM_SECURITY_PLAN.md v0.3 — NIST 800-53 Moderate baseline SSP - NIST_800_53_CONTROL_MAPPING.md v0.2 — full control-family mapping with in-house ownership tags and evidence-artifact expectations - POAM.md v0.1 — 62-item POA&M seeded from tailorings, open decisions, missing companion docs, and pre-ATO deliverables; two items closed - PRIVACY_IMPACT_ASSESSMENT.md v0.1 — full PIA covering minors, SSN, banking, FERPA-covered OSSE records, CFSA foster/ward flags, and the dormant emergency health-record path - ARCHITECTURE.md v0.1 — forward-looking design blueprint, OWC-aligned - PHASE0_PLAN.md v0.1 — framework vendor-in, auth, RBAC, audit, Registrant vertical slice, 501 stubs for remaining entities - TODO.md — 12-section working checklist tied to POA&M IDs - OLA_RESPONSE_2026-09-30.md — Q&A for OLA / City Administrator Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
107 lines
6.1 KiB
Markdown
107 lines
6.1 KiB
Markdown
# YPMS — Overview
|
||
|
||
**One line.** An in-house DOES OIT build that replaces seven legacy tools currently used by the Office of Youth Programs to run MBSYEP and related youth workforce programs. Matches the DCYWP / OWC / Employer 360 delivery pattern.
|
||
|
||
## Why we're building it
|
||
|
||
The current OYP system landscape is fragmented across seven tools that don't share data:
|
||
|
||
| Legacy tool | Purpose | Fate under YPMS |
|
||
|---|---|---|
|
||
| Host/Participant Application | Program applications | Replaced by unified intake |
|
||
| Scanning Application | Certify application information | Replaced by in-line certification |
|
||
| Transfer Application | Place and transfer youth | Replaced by matching engine |
|
||
| TMS (Time Management System) | Youth time tracking | Replaced by online time management |
|
||
| MicroStrategy | Reporting and visualization | Replaced by native reporting + BI |
|
||
| PF3 (People First backdoor) | Admin login tool for host-app edits | Replaced by RBAC admin functions |
|
||
| Manual payroll (scripts + email approvals) | Payroll processing | Replaced by third-party payroll vendor integration |
|
||
|
||
Consolidating these into a single DOES-owned system is the substance of the modernization.
|
||
|
||
## Programs served
|
||
|
||
| Program | Population | Notes |
|
||
|---|---|---|
|
||
| **MBSYEP** — Marion S. Barry Summer Youth Employment Program | Youth ages 14–24 | Locally funded; highest peak-load driver; hard summer deadlines |
|
||
| **HSIP** — High School Internship Program | Grades 9–12 | School-year enrichment and internships |
|
||
| **MBYLI** — Marion Barry Youth Leadership Institute | Year-round | Includes Summer Intensive Training (SIT), School Year Program (SYP), Global Education |
|
||
| **CRESP** — Career Ready Early Scholars Program | Middle-school students | 11 career-exploration tracks (STEM, culinary, law/global affairs, etc.) |
|
||
| Future OYP programs | — | System must accept new program definitions end-to-end (application → completion) |
|
||
|
||
## User populations
|
||
|
||
| User | Estimate | Access |
|
||
|---|---|---|
|
||
| DOES staff, contractors, vendors | ~90 | Internal portal, SSO / DOES global directory |
|
||
| Host employers | ~1,500 | Self-service web portal |
|
||
| Youth (registering + participating) | ~27,000 | Web / mobile; identity model under review — see CLAUDE.md open question 3 |
|
||
| Parents / guardians | ~7,400 | Web portal |
|
||
| Other agencies | ~100 | Web portal or interconnection |
|
||
| **Total** | **~36,000** | Scale target: 50%/year growth |
|
||
|
||
## Integrations
|
||
|
||
| Partner | Purpose | Notes |
|
||
|---|---|---|
|
||
| SSA (Business Services Online) | SSN verification, wage data | SSA electronic-exchange requirements apply |
|
||
| OSSE | School enrollment records | FERPA — data-sharing agreement required |
|
||
| CFSA | Foster / ward-of-state status | DC Code Title 4 — MOU required |
|
||
| DC MAR | Address verification | DC OCTO service |
|
||
| Third-party payroll vendor | Time → payroll → tax forms | Vendor selection outstanding; DOES OIT owns the integration on our side |
|
||
| Third-party LMS | Orientation completion tracking | Vendor TBD |
|
||
| DC OCTO Sentinel | Security telemetry (SIEM stream) | Same pattern as OWC |
|
||
| Social media IdPs | Youth account login | Risk-managed; not sufficient for payroll actions on its own |
|
||
|
||
## Delivery model
|
||
|
||
DOES OIT builds and operates the system. **Stack: Python 3.12 / FastAPI / SQLAlchemy / Postgres**, aligned with OWC. Hosting is Azure Government Cloud, matching OWC and Employer 360. Continuous monitoring runs into DC OCTO Sentinel.
|
||
|
||
## Timeline (as of 2026-09-30)
|
||
|
||
| Milestone | Target | Status |
|
||
|---|---|---|
|
||
| Source requirements captured (from prior YPMS RFP) | 2025-04 | Done |
|
||
| ISSO and AO designated in writing | 2026-09-30 | ✓ Chris Tonjes (DOES CIO) as System Owner, ISSO, and AO |
|
||
| Stack decision recorded | 2026-09-30 | ✓ Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment) |
|
||
| FIPS 199 memo signed by AO | 2026-10-31 | Not started (`YPMS-POAM-001`) |
|
||
| Architecture document | 2026-11-30 | Not started (see `YPMS-POAM-040` follow-on) |
|
||
| Azure Gov tenant + non-prod environments | 2027-01-15 | Not started (`YPMS-POAM-041`) |
|
||
| CI/CD pipeline with SAST/SCA/SBOM | 2027-01-31 | Not started (`YPMS-POAM-042`) |
|
||
| Data-sharing agreements (OSSE, CFSA, SSA, payroll vendor) | Q1 2027 | Not started (`YPMS-POAM-020` – `YPMS-POAM-023`) |
|
||
| ATO artifacts (SSP, PIA, IRP, CP, RoB, control mapping) | Q4 2026 – Q1 2027 | Draft SSP v0.2, control mapping v0.1, POA&M v0.1 |
|
||
| Iterative build (Agile — matches OWC / DCYWP delivery cadence) | 2027 | Not started |
|
||
| Independent Control Assessment (SCA) | Pre-Go-Live | Not scheduled |
|
||
| Penetration test | Pre-Go-Live | Not scheduled |
|
||
| ATO decision | Pre-Go-Live | Not scheduled |
|
||
| **Go-Live** | Beginning of FY2027 per source RFP; effective slip acknowledged | Not started |
|
||
|
||
## Compliance posture
|
||
|
||
- **NIST SP 800-53 Rev. 5 Moderate baseline.**
|
||
- **NIST SP 800-171 Rev. 2** for CUI handling.
|
||
- **FIPS 140-3** target (140-2 acceptable during the deprecation window).
|
||
- **FERPA** overlay for OSSE-sourced educational records.
|
||
- **DC Code Title 4** for CFSA-sourced foster/ward records.
|
||
- **SSA Electronic Information Exchange** requirements for SSN cross-match.
|
||
- **Section 508 / WCAG 2.1 AA**.
|
||
- **DC Language Access Act of 2004**.
|
||
- **PCI DSS** — only if card processing is in scope (probably not).
|
||
- **DC OCTO IT Security Policy**.
|
||
|
||
## FIPS 199 (provisional)
|
||
|
||
**Moderate / Moderate / Moderate**, with High-sensitivity data subsets (FERPA OSSE records, CFSA foster/ward flags, dormant COVID-era health records) treated by role-based least privilege rather than by pulling the aggregate rating up. The AO's FIPS 199 memo (`YPMS-POAM-001`) formalizes this.
|
||
|
||
## What good looks like at Go-Live
|
||
|
||
- Single youth portal from application through payroll for all OYP programs.
|
||
- One host/employer portal.
|
||
- One staff workspace replacing PF3 and the various admin tools.
|
||
- Payroll runs off online time-tracking, not scripts and emails.
|
||
- Reports run natively; MicroStrategy retired.
|
||
- ATO signed by the DOES Director before production data flows in.
|
||
- OSSE and CFSA exchanges in place with executed agreements.
|
||
- Sentinel receiving telemetry via DC OCTO.
|
||
- Daily backups running with tested restore.
|
||
- POA&M managed and reviewed monthly.
|