Plan of Action and Milestones (POA&M)
Youth Program Management System (YPMS)
Document Version: 0.1 (initial seed)
Date: 2026-09-30
NIST Reference: SP 800-53 Rev. 5 control CA-5
Status: Pre-Development / Pre-Authorization
Companion docs: SYSTEM_SECURITY_PLAN.md, NIST_800_53_CONTROL_MAPPING.md
Drafting note. This POA&M is seeded from three sources: (1) the four SSP tailorings above the RFP-derived requirement floor, (2) the six open policy decisions awaiting AO / OYP / Privacy Officer disposition, and (3) the standard pre-ATO deliverables not yet authored or executed (companion docs, data-sharing agreements, foundational build activities, independent assessments). Because YPMS is pre-development — this is an in-house build following the DCYWP / OWC / Employer 360 pattern, and no code exists yet — there are no vulnerability findings to import. Once initial code lands, findings from SAST/DAST/pentest will be added by ID. Items marked [TBD] for owner or target date are pending assignment by DOES leadership.
Table of Contents
- Status Legend
- Severity Definitions
- Open Items
- Closed Items
- Maintenance and Reporting Cadence
1. Status Legend
| Symbol |
Meaning |
| 🔴 |
Open — work not yet started |
| 🟡 |
In progress — work underway |
| 🟢 |
Closed — completed and verified |
| 🔵 |
Risk accepted — formally accepted by AO with documented rationale |
| ⚪ |
Deferred — known and tracked, scheduled for a later cycle |
| ❓ |
Awaiting decision — blocked on AO / OYP / Privacy Officer determination |
2. Severity Definitions
Severity ratings align with FedRAMP Continuous Monitoring guidance and the DCYWP POA&M scale for consistency across DOES ATO packages.
| Severity |
Definition |
Default Remediation Window |
| Critical |
Vulnerability allows direct unauthorized access to PII or system control, or blocks ATO decision entirely |
30 days |
| High |
Significant risk to confidentiality, integrity, or availability with credible exploit path; or an ATO artifact that must exist before AO can sign |
90 days |
| Moderate |
Material weakness without immediate exploit; defense-in-depth gap; or a companion doc/process needed for continuous monitoring |
180 days |
| Low |
Hygiene; best practice; no immediate exploit |
365 days or next major release |
3. Open Items
3.1 Critical
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-001 |
Critical |
FIPS 199 categorization memo signed by AO |
NIST RA-2 / SSP §2 |
Chris Tonjes (System Owner / AO) |
M1: draft memo — 14 days. M2: Privacy Officer review — 30 days. M3: AO signature — 45 days. |
2026-11-15 |
🔴 Open |
| YPMS-POAM-002 |
Critical |
AO designated in writing for YPMS |
NIST CA-6 |
DOES CIO |
✅ Closed 2026-09-30: Chris Tonjes designated as AO alongside System Owner and ISSO roles; role concentration accepted and recorded in SSP §5. |
2026-09-30 |
🟢 Closed |
3.2 High (open)
Missing ATO artifacts (all must exist before AO signature)
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-010 |
High |
System Security Plan finalized and approved |
NIST PL-2 |
DOES CIO + ISSO |
v0.3 exists (ypms/SYSTEM_SECURITY_PLAN.md) in in-house build framing. M1: ISSO review — 60 days. M2: AO signature — 90 days. |
2026-12-31 |
🟡 In Progress |
| YPMS-POAM-011 |
High |
Privacy Impact Assessment authored, reviewed, approved |
NIST PT-2 |
Privacy Officer + DOES CIO |
v0.1 draft complete 2026-09-30 (ypms/PRIVACY_IMPACT_ASSESSMENT.md). M1: Privacy Officer + OGC review — 30 days. M2: AO signature — 60 days. |
2026-11-30 |
🟡 In Progress |
| YPMS-POAM-012 |
High |
Incident Response Plan finalized; tabletop run |
NIST IR-3 / IR-8 |
DOES CIO + DC OCTO CISO liaison |
M1: draft — 30 days. M2: tabletop with OCTO SOC — 60 days. M3: signatures — 90 days. |
2027-01-15 |
🔴 Open |
| YPMS-POAM-013 |
High |
Contingency Plan finalized; functional restore drill |
NIST CP-2 / CP-4 |
DOES CIO + OIT Ops |
M1: draft — 30 days. M2: signatures — 60 days. M3: functional restore drill — 120 days. Recovery envelope: 99.5% SLA / peak-season hard deadlines. |
2027-02-15 |
🔴 Open |
| YPMS-POAM-014 |
High |
Rules of Behavior authored (staff / host / youth+parent variants) |
NIST PL-4 |
DOES HR + Privacy Officer |
M1: staff variant — 30 days. M2: host variant — 60 days. M3: youth/parent variant with parental-consent flow — 90 days. M4: incorporated into onboarding + account-creation workflow — 120 days. |
2027-02-01 |
🔴 Open |
| YPMS-POAM-015 |
High |
NIST 800-53 control mapping finalized |
NIST PL-2 / CA-2 |
DOES CIO + ISSO |
v0.2 exists (ypms/NIST_800_53_CONTROL_MAPPING.md) in in-house build framing (DOES OIT tags, repo/pipeline evidence). M1: ISSO review — 60 days. M2: refresh to v0.3 once architecture and initial code land. |
2027-02-28 |
🟡 In Progress |
Data-sharing agreements (blocking on integration builds)
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-020 |
High |
DOES–OSSE data-sharing agreement (FERPA) — renewal / scope amendment |
NIST CA-3 / SA-9; FERPA |
DOES OGC + Privacy Officer + OSSE liaison |
M1: pull existing agreement + confirm expiration — 14 days. M2: draft renewal or YPMS-scope amendment — 45 days. M3: OSSE review — 75 days. M4: signature — 105 days. Blocks OSSE school-enrollment ingest build. |
2027-01-15 |
🔴 Open |
| YPMS-POAM-021 |
High |
DOES–CFSA MOU (foster/ward indicator) — renewal / scope amendment |
NIST CA-3 / SA-9; DC Code Title 4 |
DOES OGC + CFSA liaison |
M1: pull existing MOU + confirm expiration — 14 days. M2: draft renewal or YPMS-scope amendment — 45 days. M3: CFSA review — 75 days. M4: signature — 105 days. Blocks CFSA ingest build. |
2027-01-15 |
🔴 Open |
| YPMS-POAM-022 |
High |
SSA Electronic Information Exchange agreement (SSN cross-match) — renewal / scope amendment |
NIST CA-3; SSA EIES requirements |
DOES OGC + SSA regional liaison |
M1: pull existing agreement + confirm YPMS scope coverage — 30 days. M2: amendment drafted if scope is new — 60 days. M3: SSA signature — 150 days (SSA cycle is slow). Blocks SSN verification build. |
2027-03-01 |
🔴 Open |
| YPMS-POAM-023 |
High |
Payroll-vendor selection and security review |
NIST SA-9 / CA-3 |
DOES CIO + OYP + Procurement |
M1: vendor requirements — 30 days. M2: SIG-Lite / SOC 2 collection from candidates — 60 days. M3: selection — 90 days. M4: ISA / DPA signature — 120 days. Blocks payroll integration build. |
2027-01-31 |
🔴 Open |
SSP tailorings above the RFP-derived requirement floor
These four items are the tailorings recorded in the SSP Appendix D and control-mapping §5. Building to the RFP wording alone would fail the Moderate baseline.
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-030 |
High |
MFA required for all privileged and staff accounts |
NIST IA-2(1)/(2) — SSP tailoring above C.5.7.6 |
DOES CIO |
M1: MFA modality decision (Entra ID conditional access preferred, aligned with OWC/Employer 360) — 30 days. M2: implementation in non-prod — 90 days. M3: production enforcement — 120 days. |
2027-02-15 |
🔴 Open |
| YPMS-POAM-031 |
High |
TLS 1.2+ (target 1.3), FIPS-approved cipher suites; SSL retired |
NIST SC-8 / AC-17(2) — SSP tailoring above C.5.6.15 |
DOES CIO |
M1: TLS baseline in architecture doc — 30 days. M2: enforced in all environments — 60 days. M3: SSL Labs A+ or equivalent on public endpoints — 90 days. |
2027-01-31 |
🔴 Open |
| YPMS-POAM-032 |
High |
FIPS 140-3 cryptography (140-2 acceptable during deprecation window) |
NIST IA-7 / SC-12 / SC-13 — SSP tailoring above C.5.7.9 |
DOES CIO |
M1: crypto library inventory + FIPS mode confirmed for each — 30 days. M2: Key Vault (Azure Gov HSM) provisioned — 60 days. M3: all keys managed via Key Vault — 120 days. |
2027-02-28 |
🔴 Open |
| YPMS-POAM-033 |
High |
IAL2-equivalent identity proofing before youth banking/payroll actions |
NIST IA-12 — SSP tailoring (RFP silent); links to open decision YPMS-POAM-050 |
DOES CIO + Privacy Officer + OYP |
M1: identity-model decision (see YPMS-POAM-050) — 45 days. M2: proofing vendor selection (Login.gov / SSA / DMV records) — 90 days. M3: proofing flow implemented — 180 days. Blocks payroll enrollment for minors. |
2027-04-01 |
❓ Blocked on YPMS-POAM-050 |
Foundational build activities
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-040 |
High |
Architecture & tech-stack decision recorded |
NIST PL-8 / SA-3 |
DOES CIO |
✅ Stack decision closed 2026-09-30: Python 3.12 / FastAPI / SQLAlchemy / Postgres on Azure Government (OWC alignment). ✅ Architecture document v0.1 drafted 2026-09-30 (ypms/ARCHITECTURE.md). ✅ Phase 0 plan drafted 2026-09-30 (ypms/PHASE0_PLAN.md). M1: DC OCTO security architecture review — 45 days. |
2026-11-15 |
🟡 In Progress |
| YPMS-POAM-041 |
High |
Azure Government tenant + non-prod environments provisioned |
NIST CM-2 / CM-6 |
DOES CIO + DC OCTO |
M1: subscription request — 30 days. M2: dev + test environments — 60 days. M3: CIS Azure Foundations baseline applied — 90 days. |
2027-01-15 |
🔴 Open |
| YPMS-POAM-042 |
High |
CI/CD pipeline with SAST, SCA, secret scanning, SBOM |
NIST SA-11 / SR-3 / SR-11 / CM-8 |
DOES CIO |
M1: pipeline scaffold — 30 days. M2: SAST + SCA gates — 60 days. M3: SBOM generation per release (CycloneDX) — 90 days. |
2027-01-31 |
🔴 Open |
| YPMS-POAM-043 |
High |
Sentinel integration (DOES OIT ships application + Azure resource logs to DC OCTO Sentinel) |
NIST AU-6 / SI-4 |
DOES CIO + DC OCTO CISO |
M1: log-schema agreement with OCTO SOC — 30 days. M2: Sentinel workspace and ingestion — 60 days. M3: correlation rules and alert playbooks — 120 days. |
2027-02-28 |
🔴 Open |
| YPMS-POAM-044 |
High |
Backup + restore procedure documented and tested |
NIST CP-9 / CP-9(1) |
DOES CIO + OIT Ops |
M1: procedure documented — 30 days. M2: initial restore drill — 60 days. M3: annual drill cadence established — 90 days. |
2027-02-15 |
🔴 Open |
3.3 Moderate (open)
Open policy decisions (mirrored to SSP Appendix D)
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-050 |
Moderate |
Identity model for minors (social-media login vs. IAL2 proofing gates) |
SSP §17.D |
DOES CIO + Privacy Officer + OYP + AO |
M1: options memo (browse-only social, IAL2 for payroll, parental co-auth for under-18) — 30 days. M2: AO decision — 60 days. Feeds YPMS-POAM-033. |
2026-11-30 |
❓ Awaiting decision |
| YPMS-POAM-051 |
Moderate |
Clarify "Level 3 security" wording from source RFP C.5.7.24 |
SSP §17.A |
DOES CIO + ISSO |
M1: options memo — 30 days. M2: AO clarification memo — 45 days. Treat as NIST 800-63 IAL3/AAL3 pending decision (higher of plausible readings). |
2026-11-15 |
❓ Awaiting decision |
| YPMS-POAM-052 |
Moderate |
PCI DSS applicability determination |
SSP §17.E |
DOES CIO + OYP + OGC |
M1: transaction-flow review confirming ACH-only via payroll vendor (no card processing in YPMS) — 30 days. M2: PCI scope memo (expected: out of scope) — 45 days. |
2026-11-15 |
❓ Awaiting decision |
| YPMS-POAM-053 |
Moderate |
Dormant emergency health-record CSV path — in-boundary vs. emergency extension |
SSP §17.H |
Privacy Officer + DOES CIO + AO |
M1: options memo — 30 days. M2: AO decision — 60 days. Recommended: separate emergency-scoped extension with its own PIA addendum. |
2026-11-30 |
❓ Awaiting decision |
| YPMS-POAM-054 |
Moderate |
Retention policy for audit logs, case records, backups |
SSP §17.G |
DOES Records Officer + Privacy Officer + DOES CIO |
M1: records-schedule review — 30 days. M2: retention policy signed — 60 days. Feeds AU-11 and SI-12 implementation. |
2026-12-15 |
❓ Awaiting decision |
Assessment and pre-launch validation
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-060 |
Moderate |
Independent Control Assessment (SCA) commissioned |
NIST CA-2 / CA-2(1) |
DOES CIO |
M1: assessor selection — 60 days. M2: engagement — 120 days. M3: report — pre-Go-Live. |
2027-06-30 |
🔴 Open |
| YPMS-POAM-061 |
Moderate |
Penetration test (external + authenticated) |
NIST CA-8 |
DOES CIO |
M1: scope of work — 60 days. M2: engagement — 120 days. M3: report + remediation POA&M items — pre-Go-Live. |
2027-06-30 |
🔴 Open |
| YPMS-POAM-062 |
Moderate |
Vulnerability scanning cadence in production |
NIST RA-5 |
DOES CIO |
M1: scanner selection — 45 days. M2: monthly authenticated + unauthenticated scans — 90 days. |
2027-03-15 |
🔴 Open |
Access control and hygiene
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-070 |
Moderate |
System-use notification banner on all authenticated entry points |
NIST AC-8 |
DOES CIO + Legal |
M1: banner text approved — 30 days. M2: implementation — 60 days. |
2027-01-31 |
🔴 Open |
| YPMS-POAM-071 |
Moderate |
Auto-disable inactive accounts (staff 90d, youth 180d — pending records policy) |
NIST AC-2(3) |
DOES CIO |
M1: policy — 45 days (depends on YPMS-POAM-054). M2: implementation — 90 days. |
2027-03-15 |
🔴 Open |
| YPMS-POAM-072 |
Moderate |
Quarterly privileged-access recertification process |
NIST AC-2 / AC-6(7) |
DOES ISSO |
M1: process document — 30 days. M2: first recertification cycle — 90 days. |
2027-02-15 |
🔴 Open |
| YPMS-POAM-073 |
Moderate |
Annual all-user access recertification process |
NIST AC-2 |
DOES ISSO |
M1: process document — 60 days. M2: tooling — 120 days. |
2027-03-31 |
🔴 Open |
| YPMS-POAM-074 |
Moderate |
Continuous Monitoring Strategy document |
NIST CA-7 / SP 800-137 |
DOES ISSO |
M1: draft — 60 days. M2: signatures — 90 days. Codifies cadence table from SSP §15. |
2027-02-28 |
🔴 Open |
Data-handling and privacy
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-080 |
Moderate |
SSN masking/anonymization design and enforcement |
NIST SC-28 / SI-10; C.5.7.50 |
DOES CIO |
M1: display-layer masking design — 30 days. M2: at-rest encryption confirmed — 60 days. M3: audit — pre-Go-Live. |
2027-04-30 |
🔴 Open |
| YPMS-POAM-081 |
Moderate |
Language Access Act compliance (notices, portal content) |
DC Language Access Act 2004 |
DOES CIO + OYP |
M1: language matrix — 30 days. M2: translated content pipeline — 120 days. |
2027-03-31 |
🔴 Open |
| YPMS-POAM-082 |
Moderate |
Section 508 / WCAG 2.1 AA compliance audit |
Section 508 |
DOES CIO |
M1: automated audit in CI — 60 days. M2: manual audit — 120 days. M3: remediation — pre-Go-Live. |
2027-05-31 |
🔴 Open |
| YPMS-POAM-083 |
Moderate |
Parental consent workflow for under-18 registrants |
NIST PT-4 |
Privacy Officer + DOES CIO + OGC |
M1: consent-flow design — 45 days. M2: implementation — 120 days. |
2027-04-15 |
🔴 Open |
| YPMS-POAM-084 |
Moderate |
Data flow inventory + diagrams (all integrations) |
NIST CA-3 / CA-9 |
DOES CIO |
M1: inventory — 45 days. M2: diagrams — 90 days. Continuously updated. |
2027-02-28 |
🔴 Open |
DOES organizational / process
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-090 |
Moderate |
ISSO assigned in writing for YPMS |
NIST PM-2 |
DOES CIO |
✅ Closed 2026-09-30: Chris Tonjes designated as ISSO alongside System Owner and AO roles; role concentration accepted and recorded in SSP §5. |
2026-09-30 |
🟢 Closed |
| YPMS-POAM-091 |
Moderate |
Role-based training curriculum (OYP staff, eligibility examiners, payroll admins) |
NIST AT-3 |
DOES ISSO + OYP |
M1: curriculum outline — 60 days. M2: content — 120 days. M3: first delivery — pre-Go-Live. |
2027-05-31 |
🔴 Open |
| YPMS-POAM-092 |
Moderate |
Personnel background-check confirmation for all YPMS-access personnel |
NIST PS-3 |
DOES HR + DC OCTO |
M1: current DOES/OIT team background-check status verified — 30 days. M2: gaps closed — 90 days. |
2027-01-31 |
🔴 Open |
| YPMS-POAM-093 |
Moderate |
Change Management Plan |
NIST CM-3 / CM-9 |
DOES CIO + OIT Ops |
M1: draft — 45 days. M2: DOES + OCTO NOC review — 90 days. |
2027-02-15 |
🔴 Open |
| YPMS-POAM-094 |
Moderate |
SORN applicability determination |
NIST PT-6 |
Privacy Officer + OGC |
M1: applicability memo — 60 days. |
2026-12-31 |
❓ Awaiting decision |
3.4 Low (open)
| ID |
Severity |
Title |
Source |
Owner |
Milestones |
Target Date |
Status |
| YPMS-POAM-100 |
Low |
Approved-software list maintained and reviewed |
NIST CM-10 |
DOES CIO |
Quarterly review starting after first release. |
Ongoing |
🔴 Open |
| YPMS-POAM-101 |
Low |
Anti-bot / rate-limit measures on public MBSYEP peak windows |
NIST SC-5 |
DOES CIO |
M1: threat model — 60 days. M2: WAF rules — 90 days. Tuned for summer peak. |
2027-04-30 |
🔴 Open |
| YPMS-POAM-102 |
Low |
FOIA response workflow with PII redaction guidance |
DC FOIA |
DOES OGC + Records Officer |
M1: workflow document — 90 days. |
2027-03-31 |
🔴 Open |
| YPMS-POAM-103 |
Low |
Emerging-tech (GenAI/ML) governance if enabled |
NIST SA-9 / SR-3 |
DOES CIO + Privacy Officer |
Only triggers if GenAI features added. Deferred pending scope decision. |
Deferred |
⚪ Deferred |
| YPMS-POAM-104 |
Low |
Vendor lock-in and data-portability provisions in payroll/LMS contracts |
NIST SA-4 |
DOES OGC + Procurement |
Included as clauses during vendor selection. |
2027-01-31 |
🔴 Open |
| YPMS-POAM-105 |
Low |
Legacy data-migration plan (7 tools: PF3, TMS, MicroStrategy, Host/Participant App, Scanning, Transfer, manual payroll) |
NIST SI-12 |
DOES CIO + OYP + OIT |
M1: source inventories — 90 days. M2: mapping and transform design — 180 days. M3: cutover strategy — pre-Go-Live. |
2027-05-31 |
🔴 Open |
| YPMS-POAM-106 |
Low |
Legacy system decommission schedule and destruction evidence |
NIST MP-6 / SR-3 |
DOES CIO + OIT |
Follows successful cutover. |
Post-Go-Live |
⚪ Deferred |
4. Closed Items
Closures retained for traceability.
| ID |
Title |
Closure Date |
Verification / Evidence |
| YPMS-POAM-002 |
AO designated in writing for YPMS |
2026-09-30 |
Chris Tonjes (DOES CIO) designated as AO. Role-concentration risk accepted per SSP §5. Update SSP §3.2 reflects the designation. |
| YPMS-POAM-090 |
ISSO assigned in writing for YPMS |
2026-09-30 |
Chris Tonjes designated as ISSO. Role-concentration risk accepted per SSP §5. Update SSP §4 reflects the designation. |
| — |
Stack decision (partial closure of YPMS-POAM-040) |
2026-09-30 |
Python 3.12 / FastAPI / SQLAlchemy / Postgres selected (OWC alignment). |
| — |
Architecture document v0.1 (partial closure of YPMS-POAM-040) |
2026-09-30 |
ypms/ARCHITECTURE.md drafted; forward-looking design following the OWC pattern. |
| — |
Phase 0 plan v0.1 (partial closure of YPMS-POAM-040) |
2026-09-30 |
ypms/PHASE0_PLAN.md drafted: framework vendor-in, auth, RBAC, audit, Registrant vertical slice, 501 stubs on remaining ARCH §6.1 entities. |
| — |
Phase 0 milestone 0.1 shipped (partial closure of YPMS-POAM-040) |
2026-09-30 |
Repo scaffold, Docker Compose, FastAPI factory with /healthz + /readyz, structlog + request-id middleware, Alembic baseline, CI workflow, README + CONTRIBUTING. Tests green (3 passing, ruff + mypy clean). Committed as 393631a. |
| — |
Phase 0 milestone 0.2 shipped (partial closure of YPMS-POAM-040) |
2026-09-30 |
OWC framework vendored (base/crud/bulk/pagination/router/version_history + audit + security/rbac + users + auth stub) with owc→ypms renames. YPMS pii_audit decorator added. Pagination bug in upstream OWC fixed here (peek-ahead cursor). 26 tests passing, 93.10% coverage. Migration 0002 creates the framework tables. |
5. Maintenance and Reporting Cadence
| Activity |
Frequency |
Owner |
| POA&M review — status update on every open item |
Monthly |
DOES ISSO |
| POA&M report to AO |
Quarterly |
DOES CIO |
| New-finding intake (from scans, assessments, incidents) |
Continuous |
DOES ISSO |
| Milestone-slip escalation to CIO |
On any 30-day slip past target date |
DOES ISSO |
| Closure verification (independent from remediator) |
Per closure |
DOES ISSO |
| POA&M archive at ATO decision |
At initial ATO and each reauthorization |
DOES CIO |
Reporting format for status update
Each open item gets a one-line status update per monthly cycle, retained in an append-only status log (ypms/POAM_STATUS_LOG.md — to be created on first cycle):
Status text records: what moved, blockers, next milestone due.
End of draft v0.1.
