Chris TonjesandClaude Opus 4.7
8712e93258
Pre-development state; no code yet. Delivery model: in-house build by DOES OIT on Azure Government, matching the DCYWP / OWC / Employer 360 pattern. Stack decision (2026-09-30): Python 3.12 / FastAPI / SQLAlchemy / Postgres, aligning with OWC. System Owner / ISSO / AO: Chris Tonjes (DOES CIO). Role concentration recorded in SSP §5 with risk-acceptance rationale. Source functional and security requirements derived from the prior YPMS RFP (Solicitation Docxxxxx, April 2025) — 54 C.5.7 security requirements and Appendix E non-functional requirements — treated as source specifications, not as Contractor obligations. Documents included: - CLAUDE.md, OVERVIEW.md — project router and program-level summary - SYSTEM_SECURITY_PLAN.md v0.3 — NIST 800-53 Moderate baseline SSP - NIST_800_53_CONTROL_MAPPING.md v0.2 — full control-family mapping with in-house ownership tags and evidence-artifact expectations - POAM.md v0.1 — 62-item POA&M seeded from tailorings, open decisions, missing companion docs, and pre-ATO deliverables; two items closed - PRIVACY_IMPACT_ASSESSMENT.md v0.1 — full PIA covering minors, SSN, banking, FERPA-covered OSSE records, CFSA foster/ward flags, and the dormant emergency health-record path - ARCHITECTURE.md v0.1 — forward-looking design blueprint, OWC-aligned - PHASE0_PLAN.md v0.1 — framework vendor-in, auth, RBAC, audit, Registrant vertical slice, 501 stubs for remaining entities - TODO.md — 12-section working checklist tied to POA&M IDs - OLA_RESPONSE_2026-09-30.md — Q&A for OLA / City Administrator Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
6.1 KiB
6.1 KiB
YPMS — Overview
One line. An in-house DOES OIT build that replaces seven legacy tools currently used by the Office of Youth Programs to run MBSYEP and related youth workforce programs. Matches the DCYWP / OWC / Employer 360 delivery pattern.
Why we're building it
The current OYP system landscape is fragmented across seven tools that don't share data:
| Legacy tool | Purpose | Fate under YPMS |
|---|---|---|
| Host/Participant Application | Program applications | Replaced by unified intake |
| Scanning Application | Certify application information | Replaced by in-line certification |
| Transfer Application | Place and transfer youth | Replaced by matching engine |
| TMS (Time Management System) | Youth time tracking | Replaced by online time management |
| MicroStrategy | Reporting and visualization | Replaced by native reporting + BI |
| PF3 (People First backdoor) | Admin login tool for host-app edits | Replaced by RBAC admin functions |
| Manual payroll (scripts + email approvals) | Payroll processing | Replaced by third-party payroll vendor integration |
Consolidating these into a single DOES-owned system is the substance of the modernization.
Programs served
| Program | Population | Notes |
|---|---|---|
| MBSYEP — Marion S. Barry Summer Youth Employment Program | Youth ages 14–24 | Locally funded; highest peak-load driver; hard summer deadlines |
| HSIP — High School Internship Program | Grades 9–12 | School-year enrichment and internships |
| MBYLI — Marion Barry Youth Leadership Institute | Year-round | Includes Summer Intensive Training (SIT), School Year Program (SYP), Global Education |
| CRESP — Career Ready Early Scholars Program | Middle-school students | 11 career-exploration tracks (STEM, culinary, law/global affairs, etc.) |
| Future OYP programs | — | System must accept new program definitions end-to-end (application → completion) |
User populations
| User | Estimate | Access |
|---|---|---|
| DOES staff, contractors, vendors | ~90 | Internal portal, SSO / DOES global directory |
| Host employers | ~1,500 | Self-service web portal |
| Youth (registering + participating) | ~27,000 | Web / mobile; identity model under review — see CLAUDE.md open question 3 |
| Parents / guardians | ~7,400 | Web portal |
| Other agencies | ~100 | Web portal or interconnection |
| Total | ~36,000 | Scale target: 50%/year growth |
Integrations
| Partner | Purpose | Notes |
|---|---|---|
| SSA (Business Services Online) | SSN verification, wage data | SSA electronic-exchange requirements apply |
| OSSE | School enrollment records | FERPA — data-sharing agreement required |
| CFSA | Foster / ward-of-state status | DC Code Title 4 — MOU required |
| DC MAR | Address verification | DC OCTO service |
| Third-party payroll vendor | Time → payroll → tax forms | Vendor selection outstanding; DOES OIT owns the integration on our side |
| Third-party LMS | Orientation completion tracking | Vendor TBD |
| DC OCTO Sentinel | Security telemetry (SIEM stream) | Same pattern as OWC |
| Social media IdPs | Youth account login | Risk-managed; not sufficient for payroll actions on its own |
Delivery model
DOES OIT builds and operates the system. Stack: Python 3.12 / FastAPI / SQLAlchemy / Postgres, aligned with OWC. Hosting is Azure Government Cloud, matching OWC and Employer 360. Continuous monitoring runs into DC OCTO Sentinel.
Timeline (as of 2026-09-30)
| Milestone | Target | Status |
|---|---|---|
| Source requirements captured (from prior YPMS RFP) | 2025-04 | Done |
| ISSO and AO designated in writing | 2026-09-30 | ✓ Chris Tonjes (DOES CIO) as System Owner, ISSO, and AO |
| Stack decision recorded | 2026-09-30 | ✓ Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment) |
| FIPS 199 memo signed by AO | 2026-10-31 | Not started (YPMS-POAM-001) |
| Architecture document | 2026-11-30 | Not started (see YPMS-POAM-040 follow-on) |
| Azure Gov tenant + non-prod environments | 2027-01-15 | Not started (YPMS-POAM-041) |
| CI/CD pipeline with SAST/SCA/SBOM | 2027-01-31 | Not started (YPMS-POAM-042) |
| Data-sharing agreements (OSSE, CFSA, SSA, payroll vendor) | Q1 2027 | Not started (YPMS-POAM-020 – YPMS-POAM-023) |
| ATO artifacts (SSP, PIA, IRP, CP, RoB, control mapping) | Q4 2026 – Q1 2027 | Draft SSP v0.2, control mapping v0.1, POA&M v0.1 |
| Iterative build (Agile — matches OWC / DCYWP delivery cadence) | 2027 | Not started |
| Independent Control Assessment (SCA) | Pre-Go-Live | Not scheduled |
| Penetration test | Pre-Go-Live | Not scheduled |
| ATO decision | Pre-Go-Live | Not scheduled |
| Go-Live | Beginning of FY2027 per source RFP; effective slip acknowledged | Not started |
Compliance posture
- NIST SP 800-53 Rev. 5 Moderate baseline.
- NIST SP 800-171 Rev. 2 for CUI handling.
- FIPS 140-3 target (140-2 acceptable during the deprecation window).
- FERPA overlay for OSSE-sourced educational records.
- DC Code Title 4 for CFSA-sourced foster/ward records.
- SSA Electronic Information Exchange requirements for SSN cross-match.
- Section 508 / WCAG 2.1 AA.
- DC Language Access Act of 2004.
- PCI DSS — only if card processing is in scope (probably not).
- DC OCTO IT Security Policy.
FIPS 199 (provisional)
Moderate / Moderate / Moderate, with High-sensitivity data subsets (FERPA OSSE records, CFSA foster/ward flags, dormant COVID-era health records) treated by role-based least privilege rather than by pulling the aggregate rating up. The AO's FIPS 199 memo (YPMS-POAM-001) formalizes this.
What good looks like at Go-Live
- Single youth portal from application through payroll for all OYP programs.
- One host/employer portal.
- One staff workspace replacing PF3 and the various admin tools.
- Payroll runs off online time-tracking, not scripts and emails.
- Reports run natively; MicroStrategy retired.
- ATO signed by the DOES Director before production data flows in.
- OSSE and CFSA exchanges in place with executed agreements.
- Sentinel receiving telemetry via DC OCTO.
- Daily backups running with tested restore.
- POA&M managed and reviewed monthly.