YPMS/TODO.md

YPMS — TODO Checklist

Owner: DOES CIO Last touched: 2026-09-30 Scope: everything from team formation through Go-Live and steady-state operations. Companion tracker: POAM.md holds the numbered, dated, milestone-tracked version of the ATO items below.

Legend: [ ] open · [~] in progress · [x] done · [!] blocked · [?] needs decision

---

0. Team formation and governance

• ISSO assigned in writing for YPMS (Chris Tonjes; YPMS-POAM-090 closed 2026-09-30)
• AO designated in writing (Chris Tonjes; YPMS-POAM-002 closed 2026-09-30; role-concentration acceptance in SSP §5)
• Business Owner named (OYP)
• DOES OIT delivery lead named
• Backend engineer(s) assigned
• Frontend engineer(s) assigned
• Data/integration engineer assigned (owns OSSE, CFSA, SSA, DC MAR, payroll)
• Test/QA lead assigned
• DC OCTO cloud coordination POC identified

1. Stack and architecture decisions

• Stack decision — Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment; recorded 2026-09-30)
• Azure Government confirmed as hosting (aligned with OWC and Employer 360)
• [?] Level 3 security clarification — source RFP C.5.7.24 (YPMS-POAM-051)
• [?] Youth identity model — social-media login scope, IAL2-equivalent proofing before payroll actions, parental co-auth for under-18 (YPMS-POAM-050)
• [?] PCI DSS applicability — expected out of scope since payroll is ACH via vendor (YPMS-POAM-052)
• [?] Health-record CSV path disposition — in-boundary vs. emergency extension (YPMS-POAM-053)
• [?] Retention policy — audit logs, case records, backups (YPMS-POAM-054)
• SORN applicability determination (YPMS-POAM-094)
• Correct the youth-age typo from the source RFP (glossary says "99–24"; should be 14–24) in derived requirements
• High-level architecture document v0.1 drafted (ypms/ARCHITECTURE.md, 2026-09-30)
• Conceptual data model in ARCHITECTURE.md §6 (25 core entities enumerated); logical + physical ERDs remain
• Logical and physical ERDs, full data dictionary, CRUD matrix (extends ARCHITECTURE.md §6)
• Security architecture review with DC OCTO (referenced in ARCHITECTURE.md §8)

2. Environments and pipeline

• Azure Government subscription requested and provisioned (YPMS-POAM-041)
• Dev environment
• Test environment
• Production environment (later)
• CIS Azure Foundations baseline applied to all environments
• Azure Key Vault (FIPS 140-3 HSM) provisioned (YPMS-POAM-032)
• Managed Identity model for service-to-service auth
• Postgres flexible server provisioned (private endpoint)
• Git repo initialized under ypms/ (this directory) with branch protection
• CI/CD pipeline scaffold (YPMS-POAM-042)
  • Build + unit-test gate
  • SAST gate
  • SCA (dependency vulnerability) gate
  • Secret scanning gate
  • SBOM generation per release (CycloneDX)
  • Container image scanning
• Sentinel integration for log streaming (YPMS-POAM-043)
• Backup + restore procedure documented and tested (YPMS-POAM-044)

3. Data-sharing agreements & interconnections

Existing DOES agreements cover the current OYP workflows; YPMS-scope amendments or renewals are the path, not new drafts.

• DOES–OSSE data-sharing agreement (FERPA) — renewal / YPMS-scope amendment (YPMS-POAM-020) — blocks OSSE ingest build
• DOES–CFSA MOU (DC Code Title 4) — renewal / YPMS-scope amendment (YPMS-POAM-021) — blocks CFSA ingest build
• SSA Electronic Information Exchange agreement — renewal / YPMS-scope confirmation (YPMS-POAM-022) — blocks SSN cross-match build
• DC MAR service agreement — confirm coverage under existing OCTO umbrella
• Payroll vendor selection + security review + ISA/DPA (YPMS-POAM-023) — blocks payroll integration build
• LMS vendor selection + security review — blocks orientation-tracking build
• DC OCTO Sentinel MOU / ingestion agreement
• NOC coordination arrangement — 30-day maintenance-window notice cadence
• Emergency health-record CSV path — either MOU with source or scoping decision to defer (YPMS-POAM-053)
• ISAs / NIST 800-47 Rev. 1 documents for each of the above (YPMS-POAM-084)

4. ATO artifacts

• Draft SSP v0.3 (ypms/SYSTEM_SECURITY_PLAN.md) — in-house build reframe complete (YPMS-POAM-010)
• Draft NIST 800-53 control mapping v0.2 (ypms/NIST_800_53_CONTROL_MAPPING.md) — in-house build reframe complete (YPMS-POAM-015)
• Draft POA&M v0.1 (ypms/POAM.md) — reflects in-house build model
• FIPS 199 categorization memo signed by AO (YPMS-POAM-001)
• Privacy Impact Assessment v0.1 drafted (YPMS-POAM-011; ypms/PRIVACY_IMPACT_ASSESSMENT.md; 2026-09-30) — awaiting Privacy Officer + OGC review, then AO signature
• Incident Response Plan — tabletop with DC OCTO SOC (YPMS-POAM-012)
• Contingency Plan — functional restore drill (YPMS-POAM-013)
• Rules of Behavior — staff / host / youth+parent variants with parental-consent flow (YPMS-POAM-014)
• Continuous Monitoring Strategy document (YPMS-POAM-074)
• Independent Control Assessment (SCA) commissioned and executed (YPMS-POAM-060)
• Penetration test commissioned and executed (YPMS-POAM-061)
• ATO decision package compiled and submitted to AO
• ATO signed before production data flows in

5. Build

Iterative Agile delivery (Scrum/Kanban/SAFe — match OWC's phased approach). Illustrative phase breakdown; refine at architecture kickoff.

• Phase 1 — Foundation. Auth, user model, RBAC, base UI shell, admin skeleton, audit-logging framework.
• Phase 2 — Application intake. Youth registration, application form, save/resume, document upload with malware scanning.
• Phase 3 — Eligibility engine. Rules-driven auto-eligibility from Appendix D of source RFP; categorical eligibility across programs.
• Phase 4 — External integrations. DC MAR address verification, SSA SSN verify (blocked on YPMS-POAM-022), OSSE ingest (blocked on YPMS-POAM-020), CFSA ingest (blocked on YPMS-POAM-021).
• Phase 5 — Certification and orientation. Certification event workflow, LMS integration.
• Phase 6 — Host/employer. Host registration, worksite management, job posting.
• Phase 7 — Matching and enrollment. Job matching engine, program enrollment.
• Phase 8 — Time and payroll. Online timekeeping, payroll vendor integration (blocked on YPMS-POAM-023), transportation vouchers, tax forms.
• Phase 9 — Reporting. Native reports replacing MicroStrategy; audit-log search.
• Phase 10 — Admin functions. Broadcast notifications, workflow rule maintenance, user profile management.

6. Security implementation (crosscuts all phases)

• MFA for staff and admin (Entra ID conditional access) (YPMS-POAM-030)
• TLS 1.2+ enforced everywhere; SSL Labs A+ on public endpoints (YPMS-POAM-031)
• FIPS 140-3 cryptography (YPMS-POAM-032)
• IAL2-equivalent identity proofing before payroll actions (YPMS-POAM-033)
• SSN masking + at-rest encryption (YPMS-POAM-080)
• System-use notification banner (YPMS-POAM-070)
• Auto-disable inactive accounts (YPMS-POAM-071)
• Quarterly privileged-access recert process (YPMS-POAM-072)
• Annual all-user access recert process (YPMS-POAM-073)
• Language Access Act compliance (YPMS-POAM-081)
• Section 508 / WCAG 2.1 AA compliance audit (YPMS-POAM-082)
• Parental consent workflow for under-18 (YPMS-POAM-083)
• Anti-bot / rate-limit for MBSYEP peak windows (YPMS-POAM-101)

7. Testing

• Unit-test coverage target set and enforced in CI
• Functional tests per feature
• Non-functional tests: performance (99.5% SLA envelope, <1s response), load (50%/year growth headroom)
• Accessibility tests (Section 508)
• Language-access tests
• UAT plan and test scripts approved
• Vulnerability scanning cadence in production (YPMS-POAM-062)

8. Legacy retirement & data migration

• Data-migration plan from each of the seven legacy tools (YPMS-POAM-105)
• Data-quality baselines documented per source
• PII handling during migration
• Cutover strategy — big-bang vs. phased-by-program
• Read-only archive of legacy data for audit / statute-of-limitations retention
• Legacy system decommission schedule and destruction evidence (YPMS-POAM-106)

9. Training & change management

• Training plan for OYP staff, host/employer, youth self-service (YPMS-POAM-091)
• System overview intro video (MP4, closed captioned)
• Role-based training materials
• Help / KB content with an updateable help system

10. Go-Live & steady-state

• Go/No-Go decision meeting with AO
• Cutover runbook rehearsed
• Go-Live
• Post-Go-Live retrospective

11. Continuous monitoring (steady-state cadence)

• Monthly vulnerability scans
• Monthly POA&M review by DOES ISSO
• Quarterly privileged access recertification
• Annual full access recertification
• Annual Contingency Plan test (tabletop + functional element)
• Annual Independent Control Assessment
• Annual penetration test
• Annual SSP refresh
• Monthly availability performance report against 99.5% SLA

---

Immediate next actions (this week)

1. SSP v0.3 in in-house build framing ✓
2. Control mapping v0.2 in in-house build framing ✓
3. POA&M v0.1 seeded ✓
4. ISSO / AO / System Owner: Chris Tonjes (with role-concentration risk acceptance) ✓
5. Stack: Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment) ✓
6. Draft the PIA — minors + FERPA + CFSA is the substantive part ✓ (v0.1 drafted 2026-09-30)
7. Get existing OSSE, CFSA, and SSA agreements pulled from OGC files to scope renewals (YPMS-POAM-020, YPMS-POAM-021, YPMS-POAM-022)
8. Draft the FIPS 199 categorization memo for AO signature (YPMS-POAM-001)
9. Start the architecture document ✓ (ypms/ARCHITECTURE.md v0.1 drafted 2026-09-30)
10. Route PIA v0.1 to Privacy Officer + OGC review
11. Author PHASE0_PLAN.md ✓ (ypms/PHASE0_PLAN.md v0.1 drafted 2026-09-30)
12. DC OCTO security architecture review meeting scheduled

Parking lot (not yet triaged)

• Emerging-tech (GenAI/ML) posture — ethical measures required; data must stay in DOES domain (YPMS-POAM-103)
• FOIA response workflow with PII redaction (YPMS-POAM-102)
• Records schedule alignment with DOES records officer
• Approved-software list governance (YPMS-POAM-100)
• Employer 360 dependency: once E360 lands, YPMS host/employer records should consume it rather than re-implementing employer matching