YPMS/PRIVACY_IMPACT_ASSESSMENT.md

# Privacy Impact Assessment (PIA)
## Youth Program Management System (YPMS)

**Document Version:** 0.1 (Draft)
**Date:** 2026-09-30
**Status:** Pre-Development / Pre-Authorization
**Companion to:** [`SYSTEM_SECURITY_PLAN.md`](SYSTEM_SECURITY_PLAN.md), [`NIST_800_53_CONTROL_MAPPING.md`](NIST_800_53_CONTROL_MAPPING.md), [`POAM.md`](POAM.md)

> **Drafting note.** This PIA is required because YPMS processes Personally Identifiable Information (PII), including PII of **minors**, and because it ingests **FERPA-covered educational records** and **CFSA foster/ward-of-state records** — both of which carry statutory confidentiality above generic PII. It supports DC Personal Information Protection Act (DC Code §28-3851 et seq.) compliance and accompanies the System Security Plan. Items marked **`[TBD]`** require completion by DOES leadership before ATO submission. Where a source-RFP requirement is load-bearing (e.g., `C.5.7.50` for SSN masking), the identifier is cited inline.

---

## Table of Contents

1. [System Identification](#1-system-identification)
2. [Authority and Purpose](#2-authority-and-purpose)
3. [Information Collection](#3-information-collection)
4. [Use of Information](#4-use-of-information)
5. [Sharing and Disclosure](#5-sharing-and-disclosure)
6. [Notice and Consent](#6-notice-and-consent)
7. [Individual Rights](#7-individual-rights)
8. [Data Quality and Integrity](#8-data-quality-and-integrity)
9. [Retention and Disposal](#9-retention-and-disposal)
10. [Security Safeguards](#10-security-safeguards)
11. [Auditing and Accountability](#11-auditing-and-accountability)
12. [Privacy Risks and Mitigation](#12-privacy-risks-and-mitigation)
13. [PIA Review and Approval](#13-pia-review-and-approval)

---

## 1. System Identification

| Field | Value |
|---|---|
| **System Name** | Youth Program Management System (YPMS) |
| **Operating Agency** | DC Department of Employment Services (DOES), Office of Youth Programs (OYP) |
| **System Owner** | Chris Tonjes, DOES CIO |
| **Delivery Model** | In-house build by DOES OIT on Azure Government (Python 3.12 / FastAPI / SQLAlchemy / Postgres) |
| **PII Populations** | (a) **Minors** aged 14–24 registering or participating in OYP programs, with distinct treatment for under-18 registrants; (b) parents / guardians of under-18 registrants; (c) host employer contacts and worksite supervisors; (d) DOES OIT and OYP staff and any contracted individual developers. |
| **Estimated Volume** | ~36,000 total distinct persons at steady state (per RFP `C.5.6.21`): 27,000 youth, 7,400 parents/guardians, 1,500 host employers, 90 DOES users, 100 other-agency users. **Peak surge:** MBSYEP application window (typically January–March) may see the youth-registration volume enter within a compressed period. |
| **Privacy Impact Threshold** | **Yes — full PIA required.** System collects (a) PII of minors — a special population — (b) SSN, (c) banking / financial-account information, (d) FERPA-covered educational records, (e) CFSA foster/ward-of-state indicators (confidential under DC Code Title 4), and (f) a dormant path for health records under emergency declaration. |
| **FIPS 199 Provisional Categorization** | Moderate / Moderate / Moderate with High-sensitivity subsets (see SSP §2). |

---

## 2. Authority and Purpose

### 2.1 Legal Authority for Collection

- **DC Code Title 32, Chapter 2, Subchapter II** — governs youth employment in the District.
- **DC Code Title 32, Chapter 2, Subchapter V** — establishes the Mayor's Youth Leadership Institute (MBYLI).
- **DC Municipal Regulations Title 7** — Employment Benefits.
- **Social Security Act, Title III / Title IX** — federally funded workforce programs subject to the confidentiality requirements of §1106 (RFP §C.2 Item 7).
- **Federal Unemployment Tax Act (FUTA)** — where wage records feed cross-agency reporting.
- **Family Educational Rights and Privacy Act (FERPA), 20 USC §1232g** — governs the ingest of OSSE-sourced school enrollment records.
- **DC Code Title 4** — governs the confidentiality of CFSA foster/ward-of-state indicators.
- **Privacy Act of 1974, 5 USC §552a** — applies where DOES acts under federal delegation for USDOL-reported program data.
- **DC Personal Information Protection Act (DC Code §28-3851 et seq.)** — governs breach notification for PII collected.
- **DC Language Access Act of 2004** — governs delivery of notices and portal content in required languages.

### 2.2 Purpose of the System

To centralize OYP program administration end-to-end, replacing seven legacy tools:

- Take applications from youth and hosts across MBSYEP, HSIP, MBYLI (SIT/SYP/Global), CRESP, and future OYP programs.
- Determine eligibility using data checks (age, residency, SSN validation, foster/ward status, school enrollment) and business rules.
- Certify applications, capture orientation completion, match youth to worksites, and manage enrollment.
- Track hours worked and issue payment via a third-party payroll vendor with annual tax-form generation.
- Provide reports and analytics replacing MicroStrategy.
- Support DOES staff workflows replacing PF3 admin-backdoor logins and manual payroll approvals.

### 2.3 Mission Connection

YPMS directly supports DOES's statutory obligation to administer District youth employment and workforce-development programs and to protect the minors served by those programs.

---

## 3. Information Collection

### 3.1 PII Elements — Youth Registrant

| Element | Source | Purpose | Mandatory? | Sensitivity |
|---|---|---|---|---|
| First, middle, last name | Registrant | Identity, permit / payroll issuance | Yes | Standard PII |
| Date of birth | Registrant | Age eligibility per program | Yes | Standard PII |
| SSN | Registrant | SSA cross-match; payroll tax reporting | Yes for enrolled participants; not required for pre-application browsing | **Sensitive PII** |
| Residential and mailing address | Registrant; validated via DC MAR | DC residency verification, correspondence | Yes | Standard PII |
| Phone, email | Registrant | Notifications, secure home-page URL delivery per source RFP `C.5.21.5` | Yes | Standard PII |
| Race, ethnicity, gender (demographics) | Registrant (self-report) | USDOL federal reporting; equity analysis | Optional per federal reporting rules | Standard PII |
| School name, grade level (self-report) | Registrant | Program-fit determination | Yes for school-year programs | Standard PII |
| Educational-record excerpts (enrollment status, grade) | **OSSE** via CSV ingest | Eligibility verification | Yes when OSSE match applies | **FERPA-covered — heightened** |
| Foster / ward-of-state status | **CFSA** via CSV ingest | Categorical-eligibility rules; support-service triage | Yes when CFSA match applies | **DC Code Title 4 — heightened** |
| Immigration / work-authorization documents | Registrant upload | Employment eligibility | Yes | **Sensitive PII** |
| Resume content | Registrant upload or Resume Builder | Job matching | Optional | Standard PII |
| Job preferences, career interests | Registrant | Job matching | Optional | Standard PII |
| Banking (routing + account) | Registrant | Direct-deposit payroll | Yes for paid participants | **Sensitive PII** |
| Tax withholding elections | Registrant | Payroll | Yes for paid participants | Standard PII |
| Application answers, financial-literacy responses | Registrant | Program placement | Yes per program | Standard PII |
| Hours worked | Timekeeping | Payroll computation | Yes | Standard PII |
| Support-service enrollment (e.g., transportation) | Registrant / staff | Program services | Optional | Standard PII |
| Program participation history | System-generated | Retention, reporting, categorical eligibility | Yes | Standard PII |
| **Health records (contingent)** | **CSV under declared emergency only** (source RFP `C.5.6.3.a.2`) | Emergency operations only | No (dormant path) | **Heightened; HIPAA-adjacent** |

### 3.2 PII Elements — Parent / Guardian (of under-18 registrants)

| Element | Source | Purpose | Mandatory? | Sensitivity |
|---|---|---|---|---|
| First, last name | Parent | Consent record | Yes | Standard PII |
| Relationship to registrant | Parent | Consent authority | Yes | Standard PII |
| Address, phone, email | Parent | Notification, consent workflow | Yes | Standard PII |
| Consent signature and timestamp | Parent | Lawful basis for minor's data processing | Yes | Standard PII |
| Parent user credentials (if a separate portal account is created) | Parent | Authenticated access to their under-18 registrant's record | Optional | Standard PII |

### 3.3 PII Elements — Host Employer Contact

| Element | Source | Purpose | Mandatory? | Sensitivity |
|---|---|---|---|---|
| Contact name, title | Host | Employer relationship | Yes | Standard PII |
| Business address, phone, email | Host | Correspondence | Yes | Standard PII |
| Worksite supervisor names | Host | Worksite assignment | Yes | Standard PII |
| Signed employer attestations | Host | Compliance with youth-employment rules | Yes | Standard PII |

### 3.4 PII Elements — DOES / Contracted Staff

| Element | Source | Purpose | Mandatory? | Sensitivity |
|---|---|---|---|---|
| Name, DOES email | HR feed | Account identity | Yes | Standard PII |
| Role, work unit | HR feed | RBAC assignment | Yes | Standard PII |
| Skill set, geographic area, language skills, availability calendar | HR / staff self-service (source RFP `C.5.21.30`) | Workforce scheduling | Optional | Standard PII |
| Authentication credentials + MFA factors | Entra ID | Authentication | Yes | **Sensitive** |

### 3.5 Explicitly Not Collected

- Biometric data (fingerprint, face, voice) — not collected.
- Location tracking (device GPS) — not collected.
- Content of private communications — not collected.
- Health data — **not collected** in steady-state operations. The dormant emergency CSV path is deferred to an emergency-scoped extension with its own PIA addendum before activation (see `YPMS-POAM-053`).

### 3.6 Collection Method

- Web/mobile portal (primary channel).
- Server-to-server ingest (CSV via secure file transfer) from OSSE and CFSA.
- API queries to SSA, DC MAR.
- Bidirectional integration with third-party payroll vendor.
- Bidirectional integration with third-party LMS (orientation completion status only; no LMS-owned PII returned).
- Staff-mediated correction and augmentation via the internal portal.

---

## 4. Use of Information

### 4.1 Primary Uses

| Use | PII involved | Legal basis |
|---|---|---|
| Determine program eligibility | Age, residency, SSN, foster/ward status, school enrollment, demographics | DC Code Title 32; program-specific rules in RFP Appendix D |
| Verify identity | SSN (via SSA), address (via DC MAR), immigration docs | Employment eligibility; SSA data-exchange agreement |
| Match youth to worksites | Job preferences, resume, availability, geography | DC Code Title 32 |
| Track hours worked and issue payment | Timekeeping, banking, tax data | Employment law; payroll obligations |
| Generate annual tax forms | SSN, wages, withholdings | IRS reporting; via payroll vendor |
| Notify participants | Email, SMS, phone | Programmatic communications per source RFP `C.5.21.4`, `C.5.21.5` |
| Support-service enrollment | Registrant preferences, CFSA foster/ward status where applicable | Program-service delivery |
| Report to USDOL | De-identified or aggregated program participation | Federal grant reporting |
| Statistical / equity analysis | De-identified demographics | Federal grant reporting; internal program improvement |
| Fraud detection | Cross-reference of application data with SSA, wage, and NDNH data | 42 USC §653; SSA data exchange |

### 4.2 Prohibited Uses (Purpose Limitation)

- **No use for immigration enforcement.** Immigration-document uploads are collected solely to establish work authorization per federal employment law; they are not shared with immigration enforcement absent a lawful process (subpoena, court order) reviewed by DOES OGC.
- **No use for law enforcement of the child or their family** beyond what is expressly required by DC or federal law.
- **No use for advertising, marketing, or commercial resale.** Data is not sold to third parties.
- **No use of foster/ward status for anything outside categorical eligibility and support-service triage.** Foster/ward flags are not surfaced to host employers or worksite supervisors.
- **No use of school-enrollment records outside eligibility determination.** OSSE-sourced FERPA-covered records are not surfaced to hosts, other agencies, or the public.
- **No use of health records** in steady-state operations; the dormant emergency path is scope-restricted.

---

## 5. Sharing and Disclosure

### 5.1 Routine Sharing (with executed agreements)

| Recipient | Data Shared | Direction | Legal / Agreement Basis |
|---|---|---|---|
| **SSA** (Business Services Online) | SSN + selected identity elements | Outbound (query) | SSA Electronic Information Exchange Security Requirements; `YPMS-POAM-022` |
| **OSSE** | Registrant identifiers for enrollment cross-match | Inbound (CSV) | DOES–OSSE data-sharing agreement (FERPA); `YPMS-POAM-020` |
| **CFSA** | Registrant identifiers for foster/ward cross-match | Inbound (CSV) | DOES–CFSA MOU (DC Code Title 4); `YPMS-POAM-021` |
| **DC MAR** | Address strings | Outbound (query) | DC OCTO service agreement |
| **Third-party payroll vendor** | Hours, banking, tax IDs, tax forms | Bidirectional | Vendor contract with DPA/ISA; `YPMS-POAM-023` |
| **Third-party orientation LMS** | Registrant identifier + orientation status flag only | Bidirectional | Vendor contract with DPA |
| **DC OCTO Sentinel / SOC** | Security telemetry (log stream) | Outbound | DC OCTO CISO agreement; `YPMS-POAM-043` |
| **DC NOC** | Availability and change coordination signals | Bidirectional | Internal DOES/OCTO operational |
| **USDOL ETA** | Aggregated / de-identified program reporting | Outbound | Federal grant reporting; ET Handbook 336 |
| **IRS** (indirect, via payroll vendor) | W-2 / 1099 issuance data | Outbound (vendor-mediated) | Payroll vendor handles per IRS specs |
| **National Directory of New Hires (NDNH)** (if scoped in) | Wage/new-hire cross-match | Bidirectional | 42 USC §653 |

### 5.2 Non-Routine Sharing

- **Subpoenas, court orders, and lawful investigative demands** are handled by DOES OGC. YPMS provides an audit trail so a specific record's disclosure history is reconstructable.
- **FOIA requests** are handled by DOES OGC with PII redaction; individual PII is never disclosed under FOIA.
- **Breach notification** to individuals and to the DC Attorney General is governed by DC Code §28-3852 and executed under the Incident Response Plan.

### 5.3 Public-Facing Data

Public content is limited to:
- Program information (names, descriptions, dates).
- Host-employer job postings (position title, worksite, description, apply link).
- Application forms and static help/training content.
- Aggregated, de-identified counts for press / public reporting.

**No individual PII is exposed publicly.** No profile pages, no unauthenticated lookup of persons.

---

## 6. Notice and Consent

### 6.1 Privacy Notice

- Presented at first youth or host contact with the system (registration flow), before any PII is collected beyond an email address.
- Available in DC Language Access Act–required languages (`YPMS-POAM-081`).
- Discloses: identity of DOES as data controller, categories of PII collected, purposes of collection, categories of recipients (SSA, OSSE, CFSA, payroll vendor), individual rights, retention periods (once set), how to contact the DOES Privacy Officer.
- Version-stamped; changes tracked in system so a record can be tied to the notice version in force at the time of collection.

### 6.2 Consent — Adult Registrants (18+)

- Consent obtained at registration by explicit checkbox acknowledgment of the privacy notice.
- Optional-field consents (demographics, resume upload) are separate from mandatory-field consents.
- Consent to share data with the payroll vendor for direct-deposit purposes is a separate opt-in during payroll enrollment.

### 6.3 Consent — Under-18 Registrants (Parental Co-Consent)

**Under-18 registrants require parental / guardian consent** for the collection and processing of their PII beyond initial pre-application browsing (`YPMS-POAM-083`). Design constraints:

- The minor may browse program content and complete a pre-application draft without parental involvement.
- Before eligibility is determined, before SSN is collected, and before any payroll-related activity, a parental consent flow is triggered:
  - The minor identifies the parent/guardian and provides their contact information.
  - The system sends a verification email/SMS to the parent/guardian with a secure link.
  - The parent/guardian creates an account (or authenticates against an existing one) and provides explicit, granular consent.
  - The consent record is retained with the minor's application and includes the parent's identity, timestamp, IP, and the version of the notice in force.
- The parent/guardian can view and export their under-18 registrant's data at any time via their portal account.
- Consent can be revoked by the parent/guardian; revocation triggers the individual-rights workflow (§7).

### 6.4 Consent — Sensitive Data Elements

- **SSN collection:** disclosed at the point of collection with the specific purpose (SSA cross-match, payroll reporting). Alternate documentation paths accepted where legally permissible.
- **Immigration/work-authorization documents:** disclosed as required by federal employment law; document image encrypted at rest and access-audited.
- **Banking data:** disclosed as required for direct-deposit payroll; not shared with hosts or worksite supervisors.
- **Foster/ward status:** ingested from CFSA; the minor and parent are informed that categorical-eligibility rules use this data for support-service triage; the flag is never displayed to hosts or supervisors.
- **OSSE educational records:** ingested under the DOES–OSSE data-sharing agreement; the minor and parent are informed at registration that DOES verifies school enrollment with OSSE.

---

## 7. Individual Rights

Youth (or parent/guardian for under-18) and host contacts have the following rights, accessible through the portal.

| Right | Implementation |
|---|---|
| **Access** — view what YPMS holds | Portal profile view + full record export (source RFP `C.5.7.19`, `C.5.7.21`). |
| **Correction** | Portal profile update (source RFP `C.5.7.19`); staff-assisted correction with audit trail. |
| **Deletion / erasure** | Case-by-case; program-participation records generally retained per records schedule (see §9), but user-generated content (resume, uploaded documents) may be deleted subject to retention rules. Deletion requests routed through DOES Privacy Officer. |
| **Portability** | Export of the individual's record in machine-readable format on request. |
| **Consent withdrawal** | Parent/guardian may revoke consent for under-18 registrants; adult registrants may revoke consent for optional processing. Withdrawal does not affect participation records already generated (which are retained for statutory reasons) but stops further processing where possible. |
| **Complaint** | DOES Privacy Officer contact info in the privacy notice; complaints logged and tracked. |

**Language access:** all rights are exercisable in DC Language Access Act–required languages.

---

## 8. Data Quality and Integrity

- **Input validation** at collection: character set, length, numerical range, format (source RFP `C.5.7.44`).
- **Address validation** via DC MAR with user override option (source RFP `C.5.21.47`).
- **SSN validation** via SSA cross-match (source RFP `C.5.6.3.b`).
- **Age eligibility validation** at eligibility determination.
- **User self-service correction** via portal (source RFP `C.5.7.19`).
- **Staff correction** with audit trail (source RFP `C.5.7.15`).
- **Backdated transactions** allowed for authorized users with reprocessing (source RFP `C.5.7.17`); every backdated change is audit-logged with actor identity.
- **Duplicate detection** across programs so a single registrant is not represented as multiple persons; categorical-eligibility reuse (source RFP `C.5.3.3`).
- **Reconciliation** with source-of-record systems on inbound cross-matches (SSA, OSSE, CFSA); mismatches routed to staff review, not silently overwritten.

---

## 9. Retention and Disposal

`[TBD: aligned with DOES records schedule and OYP program-specific retention; tracked as YPMS-POAM-054.]` Recommended interim posture pending records-officer sign-off:

| Data class | Interim retention | Rationale |
|---|---|---|
| Program participation records (application, eligibility decision, enrollment, hours worked, payment record) | 7 years after last activity | Aligned with federal wage-and-hour and tax-record retention; supports USDOL audits |
| Uploaded documents (immigration proof, resume, orientation certificates) | 7 years after last activity or 1 year post-program completion, whichever is greater | Retention for compliance disputes |
| Banking data | Retain only through active-payroll relationship; purge at end of participation | Minimize sensitive-PII exposure |
| Consent records (parental and adult) | Match the retention of the record they relate to | Traceability of lawful-basis for any historical processing |
| Audit logs | 1 year online + 3 years archived | Aligned with source RFP `C.5.7.42` and SP 800-53 AU-11 |
| Foster / ward-of-state indicators (CFSA-ingested) | Retain only current-year and one-prior-year; older values purged on annual cadence | Minimize exposure of DC Code Title 4 confidential data |
| OSSE-ingested enrollment records | Retain only current-year and one-prior-year | Minimize FERPA-covered data exposure |
| **Health records (contingent path)** | Not retained in steady state (path is dormant); when activated, retention set in emergency-specific PIA addendum with hard destruction date | Minimize HIPAA-adjacent data exposure |
| Contact channels (email, phone, address) | Retain per participation-record retention; suppressed after opt-out | Deliverability and notification |

Destruction: encrypted delete plus DB tombstoning; media sanitization inherited from Azure Government.

---

## 10. Security Safeguards

Full detail is in the SSP (`ypms/SYSTEM_SECURITY_PLAN.md`) and the NIST 800-53 control mapping (`ypms/NIST_800_53_CONTROL_MAPPING.md`). Highlights specifically relevant to privacy:

- **Encryption in transit:** TLS 1.2+ (target 1.3), FIPS-approved cipher suites (SC-8; `YPMS-POAM-031`).
- **Encryption at rest:** Postgres TDE plus envelope encryption for blob storage; keys in Azure Key Vault (Gov / HSM) (SC-28, SC-12/13; `YPMS-POAM-032`).
- **SSN masking / anonymization** in all display contexts (source RFP `C.5.7.50`; `YPMS-POAM-080`).
- **MFA** for staff and admin (Entra ID conditional access) — above the source-RFP floor (`YPMS-POAM-030`).
- **IAL2-equivalent identity proofing** required before youth registrants can enroll for payroll actions (`YPMS-POAM-033`).
- **Role-based access control** with least privilege; CFSA foster/ward data and OSSE FERPA records reachable only by role-flagged users (AC-6).
- **Audit logging** of all PII interactions (source RFP `C.5.7.39`, `C.5.7.48`).
- **Immediate breach notification** through DOES OIT → DC OCTO CISO chain, followed by a 24-hour internal disclosure report and a 2-business-day remediation report (source RFP `C.5.8.18`–`C.5.8.20` adopted as internal DOES policy).
- **Malicious-code scanning** on all uploaded documents (SI-3).
- **Input validation** and canonicalization (SI-10).
- **Network segmentation** with trusted / transition / untrusted zones (source RFP `C.5.7.23`).
- **Sentinel** SIEM integration for continuous monitoring (`YPMS-POAM-043`).
- **Quarterly personnel-with-data-access roster review** (source RFP `C.5.8.17`).

---

## 11. Auditing and Accountability

- **Every PII interaction is audit-logged** (source RFP `C.5.7.39`).
- **What/when/where/source/outcome/identity** is captured for every record modification (source RFP `C.5.7.48`).
- **Before-and-after snapshots** are retained for material changes to enable reconstruction (source RFP `C.5.6.9` #8, `C.5.7.49`).
- **Screen-access logs** allow searching who viewed sensitive-data screens (source RFP `C.5.6.9` #5, #7).
- **Backdated transactions** are logged with actor identity and rationale (source RFP `C.5.7.17`).
- **Bulk operations** (bulk group updates, splits, merges — source RFP `C.5.21.40`, `C.5.21.41`) are logged with the actor, the scope, and the change diff.
- **Audit-log tampering protection**: append-only storage design; Sentinel ingestion moves logs to a separate trust boundary.
- **Chris Tonjes (System Owner / ISSO / AO)** reviews privileged-access audit output monthly and posts findings to the POA&M cycle.
- **Independent Control Assessment** annually and before initial ATO (CA-2; `YPMS-POAM-060`).
- **Penetration testing** annually and after major releases (CA-8; `YPMS-POAM-061`).

---

## 12. Privacy Risks and Mitigation

Load-bearing section. Each risk carries a specific mitigation and a POA&M reference where applicable.

### 12.1 Population-specific risks

| Risk | Impact | Mitigation | POA&M |
|---|---|---|---|
| **Minors' data exposed to unauthorized parties** — most registrants are minors, whose PII carries lifelong identity-theft risk if exposed | High | Parental co-consent for under-18 (§6.3); minimization at collection; encryption at rest and in transit; RBAC; audit logging | `YPMS-POAM-083`, `YPMS-POAM-080` |
| **Foster/ward status disclosed to hosts, worksite supervisors, or peers** — DC Code Title 4 confidentiality violation with severe personal impact | High | CFSA flag never displayed to hosts or supervisors; role-scoped access restricted to eligibility/support-service staff; annual purge of older values; audit review of who has viewed CFSA flags | Enforced in RBAC (§5.4 of control mapping); logged per AU-2 |
| **FERPA violation via OSSE-ingested records** — federal law violation with USDOL/USDE consequences | High | OSSE data flows only through eligibility engine, not exposed to hosts or general staff; annual purge of older values; DOES–OSSE agreement scopes permitted uses; audit review | `YPMS-POAM-020` |
| **Immigration-document exposure** — chilling effect on lawful participation, potential harm to the individual | High | Access strictly limited to staff conducting work-authorization review; document image encrypted; access audited; never shared with immigration enforcement absent lawful process reviewed by OGC | Enforced in RBAC and via §4.2 purpose limitation |

### 12.2 Sensitive-data-element risks

| Risk | Impact | Mitigation | POA&M |
|---|---|---|---|
| **SSN theft or exposure** — enables identity theft affecting the minor for life | High | SSN masked/anonymized in all display contexts; encrypted at rest and in transit; access strictly limited; audit-logged (source RFP `C.5.7.50`); alternate documentation paths where legally permitted | `YPMS-POAM-080` |
| **Banking data theft** — direct financial harm | High | Encrypted at rest and in transit; passed to payroll vendor via secured integration; retained only through active-payroll relationship; access strictly limited; audit-logged | §9 retention + §10 safeguards |
| **Tax-form data exposure (W-2/1099)** | Moderate | Generated by payroll vendor, not YPMS; YPMS retains only summary references | §5.1 payroll integration |
| **Health-record ingest activated under emergency without proper safeguards** | High if activated poorly | Path is dormant by default; activation requires emergency-scoped PIA addendum, retention schedule, and destruction plan; not in steady-state boundary | `YPMS-POAM-053` |

### 12.3 Access and authentication risks

| Risk | Impact | Mitigation | POA&M |
|---|---|---|---|
| **Weak authentication for staff enables unauthorized access to youth data** | High | MFA required for all staff (above source-RFP floor); Entra ID conditional access; lockout after 5 failed attempts | `YPMS-POAM-030` |
| **Social-media identity assertion insufficient for high-impact actions on minors' records** | High | Social-media login limited to browsing / pre-application; IAL2-equivalent proofing required before banking/payroll actions; parental co-authentication considered for under-18 | `YPMS-POAM-033`, `YPMS-POAM-050` |
| **Stale accounts retain access after termination** | Moderate | Auto-disable on inactivity (source RFP `C.5.7.4`); quarterly personnel roster review; termination workflow with same-day access revocation | `YPMS-POAM-071`, `YPMS-POAM-072` |
| **Insider-threat scenarios** — staff or contracted developer with access views records for unauthorized purposes | Moderate | Sensitive-data screen access logged and monitored (source RFP `C.5.6.9` #5); monthly review of privileged-user activity; least-privilege RBAC; DOES personnel-security controls | AU-14, AC-6 |

### 12.4 Integration and vendor risks

| Risk | Impact | Mitigation | POA&M |
|---|---|---|---|
| **Payroll vendor breach exposes YPMS-shared PII (banking, SSN, wages)** | High | Vendor SOC 2 / SIG-Lite review before selection; DPA with breach-notification clause; incident-response coordination in contract | `YPMS-POAM-023` |
| **LMS vendor breach exposes orientation-completion linkage** | Low (limited PII shared) | Only registrant identifier + status flag shared; vendor DPA | `YPMS-POAM-023` follow-on for LMS |
| **Social-media IdP receives more info than needed** | Moderate | Minimal-scope OAuth requests (email + basic profile only); no data returned to IdP; not sufficient for payroll actions | `YPMS-POAM-050` |
| **CSV file transfers (OSSE, CFSA) intercepted** | High | Encrypted secure file transfer; source-authenticated; retention minimization on ingested data | §11 SSP interconnections |
| **DC MAR query leaks address by log correlation** | Low | Query is address-only, no other PII; DC OCTO service; TLS-encrypted | §11 SSP |

### 12.5 Governance and process risks

| Risk | Impact | Mitigation | POA&M |
|---|---|---|---|
| **Role concentration** — Chris Tonjes as System Owner + ISSO + AO reduces independent risk-acceptance | Moderate | Independent Control Assessment (annually) and pentest provide external technical validation; DC OCTO CISO and USDOL/OIG oversight provide external accountability; SSP §5 records the acceptance | SSP §5 risk-acceptance note |
| **PIA not updated as system evolves** | Moderate | PIA refreshed on every material change; at minimum annually; incorporated into POA&M review | §13 approval cadence |
| **FOIA response inadvertently discloses PII** | Moderate | DOES OGC review before every FOIA release; PII-redaction guidance in FOIA workflow | `YPMS-POAM-102` |
| **Records-schedule not aligned; retention drifts** | Low | Formalize retention with DOES records officer before Go-Live; automated retention purges | `YPMS-POAM-054` |

---

## 13. PIA Review and Approval

| Role | Name | Signature | Date |
|---|---|---|---|
| System Owner (DOES CIO) | Chris Tonjes | | |
| Information System Security Officer | Chris Tonjes | | |
| DOES Privacy Officer | `[TBD]` | | |
| DOES OGC representative | `[TBD]` | | |
| Business Owner (OYP) | `[TBD]` | | |
| Authorizing Official | Chris Tonjes (per SSP §5 role-concentration note) | | |

**Review cadence:** PIA is refreshed on every material change to PII collected, purposes of processing, sharing, retention, or safeguards. At minimum, PIA is reviewed annually against SSP and control mapping revisions.

---

**End of draft v0.1.**