YPMS/POAM.md

# Plan of Action and Milestones (POA&M)
## Youth Program Management System (YPMS)

**Document Version:** 0.1 (initial seed)
**Date:** 2026-09-30
**NIST Reference:** SP 800-53 Rev. 5 control CA-5
**Status:** Pre-Development / Pre-Authorization
**Companion docs:** [`SYSTEM_SECURITY_PLAN.md`](SYSTEM_SECURITY_PLAN.md), [`NIST_800_53_CONTROL_MAPPING.md`](NIST_800_53_CONTROL_MAPPING.md)

> **Drafting note.** This POA&M is seeded from three sources: (1) the four SSP tailorings above the RFP-derived requirement floor, (2) the six open policy decisions awaiting AO / OYP / Privacy Officer disposition, and (3) the standard pre-ATO deliverables not yet authored or executed (companion docs, data-sharing agreements, foundational build activities, independent assessments). Because YPMS is **pre-development** — this is an in-house build following the DCYWP / OWC / Employer 360 pattern, and no code exists yet — there are no vulnerability findings to import. Once initial code lands, findings from SAST/DAST/pentest will be added by ID. Items marked **`[TBD]`** for owner or target date are pending assignment by DOES leadership.

---

## Table of Contents

1. [Status Legend](#1-status-legend)
2. [Severity Definitions](#2-severity-definitions)
3. [Open Items](#3-open-items)
4. [Closed Items](#4-closed-items)
5. [Maintenance and Reporting Cadence](#5-maintenance-and-reporting-cadence)

---

## 1. Status Legend

| Symbol | Meaning |
|---|---|
| 🔴 | Open — work not yet started |
| 🟡 | In progress — work underway |
| 🟢 | Closed — completed and verified |
| 🔵 | Risk accepted — formally accepted by AO with documented rationale |
| ⚪ | Deferred — known and tracked, scheduled for a later cycle |
| ❓ | Awaiting decision — blocked on AO / OYP / Privacy Officer determination |

## 2. Severity Definitions

Severity ratings align with FedRAMP Continuous Monitoring guidance and the DCYWP POA&M scale for consistency across DOES ATO packages.

| Severity | Definition | Default Remediation Window |
|---|---|---|
| **Critical** | Vulnerability allows direct unauthorized access to PII or system control, or blocks ATO decision entirely | 30 days |
| **High** | Significant risk to confidentiality, integrity, or availability with credible exploit path; or an ATO artifact that must exist before AO can sign | 90 days |
| **Moderate** | Material weakness without immediate exploit; defense-in-depth gap; or a companion doc/process needed for continuous monitoring | 180 days |
| **Low** | Hygiene; best practice; no immediate exploit | 365 days or next major release |

---

## 3. Open Items

### 3.1 Critical

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-001** | Critical | FIPS 199 categorization memo signed by AO | NIST RA-2 / SSP §2 | Chris Tonjes (System Owner / AO) | M1: draft memo — 14 days. M2: Privacy Officer review — 30 days. M3: AO signature — 45 days. | 2026-11-15 | 🔴 Open |
| **YPMS-POAM-002** | Critical | AO designated in writing for YPMS | NIST CA-6 | DOES CIO | ✅ **Closed 2026-09-30**: Chris Tonjes designated as AO alongside System Owner and ISSO roles; role concentration accepted and recorded in SSP §5. | 2026-09-30 | 🟢 Closed |

### 3.2 High (open)

#### Missing ATO artifacts (all must exist before AO signature)

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-010** | High | System Security Plan finalized and approved | NIST PL-2 | DOES CIO + ISSO | v0.3 exists (`ypms/SYSTEM_SECURITY_PLAN.md`) in in-house build framing. M1: ISSO review — 60 days. M2: AO signature — 90 days. | 2026-12-31 | 🟡 In Progress |
| **YPMS-POAM-011** | High | Privacy Impact Assessment authored, reviewed, approved | NIST PT-2 | Privacy Officer + DOES CIO | v0.1 draft complete 2026-09-30 (`ypms/PRIVACY_IMPACT_ASSESSMENT.md`). M1: Privacy Officer + OGC review — 30 days. M2: AO signature — 60 days. | 2026-11-30 | 🟡 In Progress |
| **YPMS-POAM-012** | High | Incident Response Plan finalized; tabletop run | NIST IR-3 / IR-8 | DOES CIO + DC OCTO CISO liaison | M1: draft — 30 days. M2: tabletop with OCTO SOC — 60 days. M3: signatures — 90 days. | 2027-01-15 | 🔴 Open |
| **YPMS-POAM-013** | High | Contingency Plan finalized; functional restore drill | NIST CP-2 / CP-4 | DOES CIO + OIT Ops | M1: draft — 30 days. M2: signatures — 60 days. M3: functional restore drill — 120 days. Recovery envelope: 99.5% SLA / peak-season hard deadlines. | 2027-02-15 | 🔴 Open |
| **YPMS-POAM-014** | High | Rules of Behavior authored (staff / host / youth+parent variants) | NIST PL-4 | DOES HR + Privacy Officer | M1: staff variant — 30 days. M2: host variant — 60 days. M3: youth/parent variant with parental-consent flow — 90 days. M4: incorporated into onboarding + account-creation workflow — 120 days. | 2027-02-01 | 🔴 Open |
| **YPMS-POAM-015** | High | NIST 800-53 control mapping finalized | NIST PL-2 / CA-2 | DOES CIO + ISSO | v0.2 exists (`ypms/NIST_800_53_CONTROL_MAPPING.md`) in in-house build framing (DOES OIT tags, repo/pipeline evidence). M1: ISSO review — 60 days. M2: refresh to v0.3 once architecture and initial code land. | 2027-02-28 | 🟡 In Progress |

#### Data-sharing agreements (blocking on integration builds)

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-020** | High | DOES–OSSE data-sharing agreement (FERPA) — **renewal / scope amendment** | NIST CA-3 / SA-9; FERPA | DOES OGC + Privacy Officer + OSSE liaison | M1: pull existing agreement + confirm expiration — 14 days. M2: draft renewal or YPMS-scope amendment — 45 days. M3: OSSE review — 75 days. M4: signature — 105 days. **Blocks OSSE school-enrollment ingest build.** | 2027-01-15 | 🔴 Open |
| **YPMS-POAM-021** | High | DOES–CFSA MOU (foster/ward indicator) — **renewal / scope amendment** | NIST CA-3 / SA-9; DC Code Title 4 | DOES OGC + CFSA liaison | M1: pull existing MOU + confirm expiration — 14 days. M2: draft renewal or YPMS-scope amendment — 45 days. M3: CFSA review — 75 days. M4: signature — 105 days. **Blocks CFSA ingest build.** | 2027-01-15 | 🔴 Open |
| **YPMS-POAM-022** | High | SSA Electronic Information Exchange agreement (SSN cross-match) — **renewal / scope amendment** | NIST CA-3; SSA EIES requirements | DOES OGC + SSA regional liaison | M1: pull existing agreement + confirm YPMS scope coverage — 30 days. M2: amendment drafted if scope is new — 60 days. M3: SSA signature — 150 days (SSA cycle is slow). **Blocks SSN verification build.** | 2027-03-01 | 🔴 Open |
| **YPMS-POAM-023** | High | Payroll-vendor selection and security review | NIST SA-9 / CA-3 | DOES CIO + OYP + Procurement | M1: vendor requirements — 30 days. M2: SIG-Lite / SOC 2 collection from candidates — 60 days. M3: selection — 90 days. M4: ISA / DPA signature — 120 days. **Blocks payroll integration build.** | 2027-01-31 | 🔴 Open |

#### SSP tailorings above the RFP-derived requirement floor

These four items are the tailorings recorded in the SSP Appendix D and control-mapping §5. Building to the RFP wording alone would fail the Moderate baseline.

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-030** | High | MFA required for all privileged and staff accounts | NIST IA-2(1)/(2) — SSP tailoring above `C.5.7.6` | DOES CIO | M1: MFA modality decision (Entra ID conditional access preferred, aligned with OWC/Employer 360) — 30 days. M2: implementation in non-prod — 90 days. M3: production enforcement — 120 days. | 2027-02-15 | 🔴 Open |
| **YPMS-POAM-031** | High | TLS 1.2+ (target 1.3), FIPS-approved cipher suites; SSL retired | NIST SC-8 / AC-17(2) — SSP tailoring above `C.5.6.15` | DOES CIO | M1: TLS baseline in architecture doc — 30 days. M2: enforced in all environments — 60 days. M3: SSL Labs A+ or equivalent on public endpoints — 90 days. | 2027-01-31 | 🔴 Open |
| **YPMS-POAM-032** | High | FIPS 140-3 cryptography (140-2 acceptable during deprecation window) | NIST IA-7 / SC-12 / SC-13 — SSP tailoring above `C.5.7.9` | DOES CIO | M1: crypto library inventory + FIPS mode confirmed for each — 30 days. M2: Key Vault (Azure Gov HSM) provisioned — 60 days. M3: all keys managed via Key Vault — 120 days. | 2027-02-28 | 🔴 Open |
| **YPMS-POAM-033** | High | IAL2-equivalent identity proofing before youth banking/payroll actions | NIST IA-12 — SSP tailoring (RFP silent); links to open decision YPMS-POAM-050 | DOES CIO + Privacy Officer + OYP | M1: identity-model decision (see YPMS-POAM-050) — 45 days. M2: proofing vendor selection (Login.gov / SSA / DMV records) — 90 days. M3: proofing flow implemented — 180 days. **Blocks payroll enrollment for minors.** | 2027-04-01 | ❓ Blocked on YPMS-POAM-050 |

#### Foundational build activities

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-040** | High | Architecture & tech-stack decision recorded | NIST PL-8 / SA-3 | DOES CIO | ✅ Stack decision closed 2026-09-30: Python 3.12 / FastAPI / SQLAlchemy / Postgres on Azure Government (OWC alignment). ✅ Architecture document v0.1 drafted 2026-09-30 (`ypms/ARCHITECTURE.md`). ✅ Phase 0 plan drafted 2026-09-30 (`ypms/PHASE0_PLAN.md`). M1: DC OCTO security architecture review — 45 days. | 2026-11-15 | 🟡 In Progress |
| **YPMS-POAM-041** | High | Azure Government tenant + non-prod environments provisioned | NIST CM-2 / CM-6 | DOES CIO + DC OCTO | M1: subscription request — 30 days. M2: dev + test environments — 60 days. M3: CIS Azure Foundations baseline applied — 90 days. | 2027-01-15 | 🔴 Open |
| **YPMS-POAM-042** | High | CI/CD pipeline with SAST, SCA, secret scanning, SBOM | NIST SA-11 / SR-3 / SR-11 / CM-8 | DOES CIO | M1: pipeline scaffold — 30 days. M2: SAST + SCA gates — 60 days. M3: SBOM generation per release (CycloneDX) — 90 days. | 2027-01-31 | 🔴 Open |
| **YPMS-POAM-043** | High | Sentinel integration (DOES OIT ships application + Azure resource logs to DC OCTO Sentinel) | NIST AU-6 / SI-4 | DOES CIO + DC OCTO CISO | M1: log-schema agreement with OCTO SOC — 30 days. M2: Sentinel workspace and ingestion — 60 days. M3: correlation rules and alert playbooks — 120 days. | 2027-02-28 | 🔴 Open |
| **YPMS-POAM-044** | High | Backup + restore procedure documented and tested | NIST CP-9 / CP-9(1) | DOES CIO + OIT Ops | M1: procedure documented — 30 days. M2: initial restore drill — 60 days. M3: annual drill cadence established — 90 days. | 2027-02-15 | 🔴 Open |

### 3.3 Moderate (open)

#### Open policy decisions (mirrored to SSP Appendix D)

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-050** | Moderate | Identity model for minors (social-media login vs. IAL2 proofing gates) | SSP §17.D | DOES CIO + Privacy Officer + OYP + AO | M1: options memo (browse-only social, IAL2 for payroll, parental co-auth for under-18) — 30 days. M2: AO decision — 60 days. **Feeds YPMS-POAM-033.** | 2026-11-30 | ❓ Awaiting decision |
| **YPMS-POAM-051** | Moderate | Clarify "Level 3 security" wording from source RFP `C.5.7.24` | SSP §17.A | DOES CIO + ISSO | M1: options memo — 30 days. M2: AO clarification memo — 45 days. Treat as NIST 800-63 IAL3/AAL3 pending decision (higher of plausible readings). | 2026-11-15 | ❓ Awaiting decision |
| **YPMS-POAM-052** | Moderate | PCI DSS applicability determination | SSP §17.E | DOES CIO + OYP + OGC | M1: transaction-flow review confirming ACH-only via payroll vendor (no card processing in YPMS) — 30 days. M2: PCI scope memo (expected: out of scope) — 45 days. | 2026-11-15 | ❓ Awaiting decision |
| **YPMS-POAM-053** | Moderate | Dormant emergency health-record CSV path — in-boundary vs. emergency extension | SSP §17.H | Privacy Officer + DOES CIO + AO | M1: options memo — 30 days. M2: AO decision — 60 days. Recommended: separate emergency-scoped extension with its own PIA addendum. | 2026-11-30 | ❓ Awaiting decision |
| **YPMS-POAM-054** | Moderate | Retention policy for audit logs, case records, backups | SSP §17.G | DOES Records Officer + Privacy Officer + DOES CIO | M1: records-schedule review — 30 days. M2: retention policy signed — 60 days. Feeds AU-11 and SI-12 implementation. | 2026-12-15 | ❓ Awaiting decision |

#### Assessment and pre-launch validation

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-060** | Moderate | Independent Control Assessment (SCA) commissioned | NIST CA-2 / CA-2(1) | DOES CIO | M1: assessor selection — 60 days. M2: engagement — 120 days. M3: report — pre-Go-Live. | 2027-06-30 | 🔴 Open |
| **YPMS-POAM-061** | Moderate | Penetration test (external + authenticated) | NIST CA-8 | DOES CIO | M1: scope of work — 60 days. M2: engagement — 120 days. M3: report + remediation POA&M items — pre-Go-Live. | 2027-06-30 | 🔴 Open |
| **YPMS-POAM-062** | Moderate | Vulnerability scanning cadence in production | NIST RA-5 | DOES CIO | M1: scanner selection — 45 days. M2: monthly authenticated + unauthenticated scans — 90 days. | 2027-03-15 | 🔴 Open |

#### Access control and hygiene

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-070** | Moderate | System-use notification banner on all authenticated entry points | NIST AC-8 | DOES CIO + Legal | M1: banner text approved — 30 days. M2: implementation — 60 days. | 2027-01-31 | 🔴 Open |
| **YPMS-POAM-071** | Moderate | Auto-disable inactive accounts (staff 90d, youth 180d — pending records policy) | NIST AC-2(3) | DOES CIO | M1: policy — 45 days (depends on YPMS-POAM-054). M2: implementation — 90 days. | 2027-03-15 | 🔴 Open |
| **YPMS-POAM-072** | Moderate | Quarterly privileged-access recertification process | NIST AC-2 / AC-6(7) | DOES ISSO | M1: process document — 30 days. M2: first recertification cycle — 90 days. | 2027-02-15 | 🔴 Open |
| **YPMS-POAM-073** | Moderate | Annual all-user access recertification process | NIST AC-2 | DOES ISSO | M1: process document — 60 days. M2: tooling — 120 days. | 2027-03-31 | 🔴 Open |
| **YPMS-POAM-074** | Moderate | Continuous Monitoring Strategy document | NIST CA-7 / SP 800-137 | DOES ISSO | M1: draft — 60 days. M2: signatures — 90 days. Codifies cadence table from SSP §15. | 2027-02-28 | 🔴 Open |

#### Data-handling and privacy

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-080** | Moderate | SSN masking/anonymization design and enforcement | NIST SC-28 / SI-10; `C.5.7.50` | DOES CIO | M1: display-layer masking design — 30 days. M2: at-rest encryption confirmed — 60 days. M3: audit — pre-Go-Live. | 2027-04-30 | 🔴 Open |
| **YPMS-POAM-081** | Moderate | Language Access Act compliance (notices, portal content) | DC Language Access Act 2004 | DOES CIO + OYP | M1: language matrix — 30 days. M2: translated content pipeline — 120 days. | 2027-03-31 | 🔴 Open |
| **YPMS-POAM-082** | Moderate | Section 508 / WCAG 2.1 AA compliance audit | Section 508 | DOES CIO | M1: automated audit in CI — 60 days. M2: manual audit — 120 days. M3: remediation — pre-Go-Live. | 2027-05-31 | 🔴 Open |
| **YPMS-POAM-083** | Moderate | Parental consent workflow for under-18 registrants | NIST PT-4 | Privacy Officer + DOES CIO + OGC | M1: consent-flow design — 45 days. M2: implementation — 120 days. | 2027-04-15 | 🔴 Open |
| **YPMS-POAM-084** | Moderate | Data flow inventory + diagrams (all integrations) | NIST CA-3 / CA-9 | DOES CIO | M1: inventory — 45 days. M2: diagrams — 90 days. Continuously updated. | 2027-02-28 | 🔴 Open |

#### DOES organizational / process

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-090** | Moderate | ISSO assigned in writing for YPMS | NIST PM-2 | DOES CIO | ✅ **Closed 2026-09-30**: Chris Tonjes designated as ISSO alongside System Owner and AO roles; role concentration accepted and recorded in SSP §5. | 2026-09-30 | 🟢 Closed |
| **YPMS-POAM-091** | Moderate | Role-based training curriculum (OYP staff, eligibility examiners, payroll admins) | NIST AT-3 | DOES ISSO + OYP | M1: curriculum outline — 60 days. M2: content — 120 days. M3: first delivery — pre-Go-Live. | 2027-05-31 | 🔴 Open |
| **YPMS-POAM-092** | Moderate | Personnel background-check confirmation for all YPMS-access personnel | NIST PS-3 | DOES HR + DC OCTO | M1: current DOES/OIT team background-check status verified — 30 days. M2: gaps closed — 90 days. | 2027-01-31 | 🔴 Open |
| **YPMS-POAM-093** | Moderate | Change Management Plan | NIST CM-3 / CM-9 | DOES CIO + OIT Ops | M1: draft — 45 days. M2: DOES + OCTO NOC review — 90 days. | 2027-02-15 | 🔴 Open |
| **YPMS-POAM-094** | Moderate | SORN applicability determination | NIST PT-6 | Privacy Officer + OGC | M1: applicability memo — 60 days. | 2026-12-31 | ❓ Awaiting decision |

### 3.4 Low (open)

| ID | Severity | Title | Source | Owner | Milestones | Target Date | Status |
|---|---|---|---|---|---|---|---|
| **YPMS-POAM-100** | Low | Approved-software list maintained and reviewed | NIST CM-10 | DOES CIO | Quarterly review starting after first release. | Ongoing | 🔴 Open |
| **YPMS-POAM-101** | Low | Anti-bot / rate-limit measures on public MBSYEP peak windows | NIST SC-5 | DOES CIO | M1: threat model — 60 days. M2: WAF rules — 90 days. Tuned for summer peak. | 2027-04-30 | 🔴 Open |
| **YPMS-POAM-102** | Low | FOIA response workflow with PII redaction guidance | DC FOIA | DOES OGC + Records Officer | M1: workflow document — 90 days. | 2027-03-31 | 🔴 Open |
| **YPMS-POAM-103** | Low | Emerging-tech (GenAI/ML) governance if enabled | NIST SA-9 / SR-3 | DOES CIO + Privacy Officer | Only triggers if GenAI features added. Deferred pending scope decision. | Deferred | ⚪ Deferred |
| **YPMS-POAM-104** | Low | Vendor lock-in and data-portability provisions in payroll/LMS contracts | NIST SA-4 | DOES OGC + Procurement | Included as clauses during vendor selection. | 2027-01-31 | 🔴 Open |
| **YPMS-POAM-105** | Low | Legacy data-migration plan (7 tools: PF3, TMS, MicroStrategy, Host/Participant App, Scanning, Transfer, manual payroll) | NIST SI-12 | DOES CIO + OYP + OIT | M1: source inventories — 90 days. M2: mapping and transform design — 180 days. M3: cutover strategy — pre-Go-Live. | 2027-05-31 | 🔴 Open |
| **YPMS-POAM-106** | Low | Legacy system decommission schedule and destruction evidence | NIST MP-6 / SR-3 | DOES CIO + OIT | Follows successful cutover. | Post-Go-Live | ⚪ Deferred |

---

## 4. Closed Items

Closures retained for traceability.

| ID | Title | Closure Date | Verification / Evidence |
|---|---|---|---|
| **YPMS-POAM-002** | AO designated in writing for YPMS | 2026-09-30 | Chris Tonjes (DOES CIO) designated as AO. Role-concentration risk accepted per SSP §5. Update SSP §3.2 reflects the designation. |
| **YPMS-POAM-090** | ISSO assigned in writing for YPMS | 2026-09-30 | Chris Tonjes designated as ISSO. Role-concentration risk accepted per SSP §5. Update SSP §4 reflects the designation. |
| — | Stack decision (partial closure of YPMS-POAM-040) | 2026-09-30 | Python 3.12 / FastAPI / SQLAlchemy / Postgres selected (OWC alignment). |
| — | Architecture document v0.1 (partial closure of YPMS-POAM-040) | 2026-09-30 | `ypms/ARCHITECTURE.md` drafted; forward-looking design following the OWC pattern. |
| — | Phase 0 plan v0.1 (partial closure of YPMS-POAM-040) | 2026-09-30 | `ypms/PHASE0_PLAN.md` drafted: framework vendor-in, auth, RBAC, audit, Registrant vertical slice, 501 stubs on remaining ARCH §6.1 entities. |
| — | Phase 0 milestone 0.1 shipped (partial closure of YPMS-POAM-040) | 2026-09-30 | Repo scaffold, Docker Compose, FastAPI factory with `/healthz` + `/readyz`, structlog + request-id middleware, Alembic baseline, CI workflow, README + CONTRIBUTING. Tests green (3 passing, ruff + mypy clean). Committed as `393631a`. |

---

## 5. Maintenance and Reporting Cadence

| Activity | Frequency | Owner |
|---|---|---|
| POA&M review — status update on every open item | Monthly | DOES ISSO |
| POA&M report to AO | Quarterly | DOES CIO |
| New-finding intake (from scans, assessments, incidents) | Continuous | DOES ISSO |
| Milestone-slip escalation to CIO | On any 30-day slip past target date | DOES ISSO |
| Closure verification (independent from remediator) | Per closure | DOES ISSO |
| POA&M archive at ATO decision | At initial ATO and each reauthorization | DOES CIO |

### Reporting format for status update

Each open item gets a one-line status update per monthly cycle, retained in an append-only status log (`ypms/POAM_STATUS_LOG.md` — to be created on first cycle):

```
YYYY-MM-DD YPMS-POAM-NNN [🔴|🟡|🟢|🔵|⚪|❓] {status text ≤ 200 chars}
```

Status text records: what moved, blockers, next milestone due.

---

**End of draft v0.1.**