YPMS/CLAUDE.md

ypms/ — Youth Program Management System

Project directory for YPMS, the modernized case-management platform for DC DOES Office of Youth Programs (OYP). Serves MBSYEP (Marion S. Barry Summer Youth Employment Program), HSIP, MBYLI (SIT / School Year / Global Education), CRESP, and future OYP programs.

In-house build, matching the DCYWP / OWC / Employer 360 pattern — DOES OIT writes and owns the code. The prior YPMS RFP (Solicitation Docxxxxx, April 2025) is retained as a source of functional and security requirements, not as a Contractor procurement.

Project identity

Field	Value
System	Youth Program Management System (YPMS)
Business owner	DOES Office of Youth Programs (OYP)
Technical owner	DOES OIT / CIO
Delivery model	In-house build by DOES OIT
Stack	Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment, decision recorded 2026-09-30)
Hosting	Azure Government Cloud (aligned with OWC and Employer 360)
Source requirements	Prior YPMS RFP (Solicitation Docxxxxx, April 2025) — Appendix A–F functional, Appendix E non-functional, C.5.7 security catalogue
Status	Pre-development as of 2026-09-30
FY27 designation	DOES Strategic Initiative for FY27 (confirmed by OLA)
Go-live target	Beginning of DC FY2027 per source RFP; effective slip acknowledged pending team formation and architecture
ATO baseline	NIST SP 800-53 Rev. 5 Moderate

What this directory holds

Planning, requirements, ATO, and operations artifacts for YPMS, and — once development starts — the application source code. Layout matches OWC: a single Python package with FastAPI routers, SQLAlchemy models, Alembic migrations, and a client bundle. See owc-system/ for the reference.

Anchor docs:

• CLAUDE.md — this file
• OVERVIEW.md — plain-English summary of what YPMS is, users, programs, timeline
• TODO.md — team formation → architecture → build → ATO → go-live checklist
• SYSTEM_SECURITY_PLAN.md — draft SSP v0.2
• NIST_800_53_CONTROL_MAPPING.md — full control statements with in-house ownership tags and evidence artifacts
• POAM.md — 62-item POA&M seeded 2026-09-30
• OLA_RESPONSE_2026-09-30.md — OLA / City Administrator Q&A
• Companion ATO artifacts to be authored: FIPS_199_MEMO.md, PRIVACY_IMPACT_ASSESSMENT.md, INCIDENT_RESPONSE_PLAN.md, CONTINGENCY_PLAN.md, RULES_OF_BEHAVIOR.md

Distinctions from other projects here

• Not DCYWP. DCYWP (root of the parent directory) is in-house for youth work permits under §32-202 / §32-206. YPMS is in-house for youth workforce programs — different scope, different statute, different business owner (OYP vs. Office of Wage Hours). Same DOES OIT tech ownership.
• Not OWC. OWC has its own AO-locked FISMA Moderate ATO with an October 2026 submission. YPMS has its own boundary, but will likely inherit stack decisions, Azure Gov deployment patterns, and Sentinel integration from OWC to move faster.
• Not UIBS. UIBS is the adult Unemployment Insurance modernization — separate program.
• Not Employer 360. Employer 360 is the shared employer master. YPMS's employer/host records are a candidate downstream consumer of Employer 360 once E360 lands; YPMS should not reinvent employer matching.

Working conventions

• Source-requirement traceability. The RFP C.5.7 catalogue (54 security requirements), C.5.6 infrastructure, C.5.8 database, and Appendix E non-functional list are the source of functional and security requirements. Every SSP / control-mapping statement traces back to a C.5.x.y requirement or a NIST control. Auditors read these; keep the trace intact.
• In-house evidence model. Evidence for controls is repo file paths (ypms/app/...), Alembic migration files, CI/CD configuration, and log samples — the OWC pattern. Not Contractor deliverables.
• Ownership tags in control mapping. DOES OIT for controls implemented in code/config; Hybrid for DOES OIT + DC OCTO enterprise services; Inherited for Azure Gov FedRAMP High or DC OCTO enterprise; Organizational for DOES policy/process/training.
• Data-sharing agreements are load-bearing. OSSE (FERPA) and CFSA (DC Code Title 4) exchanges cannot be built without executed paper first. Same for SSA and payroll-vendor selection. Track those explicitly in TODO.md and POAM.md.
• The source RFP wording sometimes lags NIST. Examples: RFP says SSL (deprecated → build to TLS 1.2+); FIPS 140-2 (sunset → build to FIPS 140-3); C.5.7.6 "unique identifier + shared secret" (not MFA → build MFA above this floor). Where the RFP wording is worse than the modern standard, build to the standard and note the tailoring in the SSP.

Open policy questions (as of 2026-09-30)

Recorded here so they don't drift out of view; each is also in the SSP Appendix D and tracked in POAM.md.

1. What is "Level 3 security" in source RFP C.5.7.24 — an internal maturity level, NIST 800-63 AAL/IAL 3, or something else? Feeds YPMS-POAM-051.
2. Youth identity model — social-media login for pre-application only, with full identity proofing (Login.gov or SSA) required before banking/payroll actions? Parental co-auth for under-18? Feeds YPMS-POAM-050, YPMS-POAM-033.
3. Is PCI DSS actually in scope? Payroll is ACH via third-party vendor; if no card processing, this de-scopes. Feeds YPMS-POAM-052.
4. Should the dormant COVID-era health-record CSV path be in the steady-state boundary, or deferred to an emergency-scoped extension with its own PIA? Feeds YPMS-POAM-053.
5. Retention for audit logs, case records, backups — align with DOES records schedule and OYP program-specific retention. Feeds YPMS-POAM-054.

Resolved decisions (as of 2026-09-30)

• Stack: Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment). YPMS-POAM-040 closed.
• ISSO, AO, and System Owner: Chris Tonjes (DOES CIO). Role concentration recorded in SSP §5 with risk-acceptance note. YPMS-POAM-002 and YPMS-POAM-090 closed.
• IaaS: Azure Government Cloud (aligned with OWC and Employer 360).
• SIEM sink: DC OCTO Sentinel.