YPMS/POAM.md

Plan of Action and Milestones (POA&M)

Youth Program Management System (YPMS)

Document Version: 0.1 (initial seed) Date: 2026-09-30 NIST Reference: SP 800-53 Rev. 5 control CA-5 Status: Pre-Development / Pre-Authorization Companion docs: SYSTEM_SECURITY_PLAN.md, NIST_800_53_CONTROL_MAPPING.md

Drafting note. This POA&M is seeded from three sources: (1) the four SSP tailorings above the RFP-derived requirement floor, (2) the six open policy decisions awaiting AO / OYP / Privacy Officer disposition, and (3) the standard pre-ATO deliverables not yet authored or executed (companion docs, data-sharing agreements, foundational build activities, independent assessments). Because YPMS is pre-development — this is an in-house build following the DCYWP / OWC / Employer 360 pattern, and no code exists yet — there are no vulnerability findings to import. Once initial code lands, findings from SAST/DAST/pentest will be added by ID. Items marked [TBD] for owner or target date are pending assignment by DOES leadership.

---

Table of Contents

1. Status Legend
2. Severity Definitions
3. Open Items
4. Closed Items
5. Maintenance and Reporting Cadence

---

1. Status Legend

Symbol	Meaning
🔴	Open — work not yet started
🟡	In progress — work underway
🟢	Closed — completed and verified
🔵	Risk accepted — formally accepted by AO with documented rationale
⚪	Deferred — known and tracked, scheduled for a later cycle
❓	Awaiting decision — blocked on AO / OYP / Privacy Officer determination

2. Severity Definitions

Severity ratings align with FedRAMP Continuous Monitoring guidance and the DCYWP POA&M scale for consistency across DOES ATO packages.

Severity	Definition	Default Remediation Window
Critical	Vulnerability allows direct unauthorized access to PII or system control, or blocks ATO decision entirely	30 days
High	Significant risk to confidentiality, integrity, or availability with credible exploit path; or an ATO artifact that must exist before AO can sign	90 days
Moderate	Material weakness without immediate exploit; defense-in-depth gap; or a companion doc/process needed for continuous monitoring	180 days
Low	Hygiene; best practice; no immediate exploit	365 days or next major release

---

3. Open Items

3.1 Critical

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-001	Critical	FIPS 199 categorization memo signed by AO	NIST RA-2 / SSP §2	Chris Tonjes (System Owner / AO)	M1: draft memo — 14 days. M2: Privacy Officer review — 30 days. M3: AO signature — 45 days.	2026-11-15	🔴 Open
YPMS-POAM-002	Critical	AO designated in writing for YPMS	NIST CA-6	DOES CIO	✅ Closed 2026-09-30: Chris Tonjes designated as AO alongside System Owner and ISSO roles; role concentration accepted and recorded in SSP §5.	2026-09-30	🟢 Closed

3.2 High (open)

Missing ATO artifacts (all must exist before AO signature)

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-010	High	System Security Plan finalized and approved	NIST PL-2	DOES CIO + ISSO	v0.3 exists (ypms/SYSTEM_SECURITY_PLAN.md) in in-house build framing. M1: ISSO review — 60 days. M2: AO signature — 90 days.	2026-12-31	🟡 In Progress
YPMS-POAM-011	High	Privacy Impact Assessment authored, reviewed, approved	NIST PT-2	Privacy Officer + DOES CIO	v0.1 draft complete 2026-09-30 (ypms/PRIVACY_IMPACT_ASSESSMENT.md). M1: Privacy Officer + OGC review — 30 days. M2: AO signature — 60 days.	2026-11-30	🟡 In Progress
YPMS-POAM-012	High	Incident Response Plan finalized; tabletop run	NIST IR-3 / IR-8	DOES CIO + DC OCTO CISO liaison	M1: draft — 30 days. M2: tabletop with OCTO SOC — 60 days. M3: signatures — 90 days.	2027-01-15	🔴 Open
YPMS-POAM-013	High	Contingency Plan finalized; functional restore drill	NIST CP-2 / CP-4	DOES CIO + OIT Ops	M1: draft — 30 days. M2: signatures — 60 days. M3: functional restore drill — 120 days. Recovery envelope: 99.5% SLA / peak-season hard deadlines.	2027-02-15	🔴 Open
YPMS-POAM-014	High	Rules of Behavior authored (staff / host / youth+parent variants)	NIST PL-4	DOES HR + Privacy Officer	M1: staff variant — 30 days. M2: host variant — 60 days. M3: youth/parent variant with parental-consent flow — 90 days. M4: incorporated into onboarding + account-creation workflow — 120 days.	2027-02-01	🔴 Open
YPMS-POAM-015	High	NIST 800-53 control mapping finalized	NIST PL-2 / CA-2	DOES CIO + ISSO	v0.2 exists (ypms/NIST_800_53_CONTROL_MAPPING.md) in in-house build framing (DOES OIT tags, repo/pipeline evidence). M1: ISSO review — 60 days. M2: refresh to v0.3 once architecture and initial code land.	2027-02-28	🟡 In Progress

Data-sharing agreements (blocking on integration builds)

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-020	High	DOES–OSSE data-sharing agreement (FERPA) — renewal / scope amendment	NIST CA-3 / SA-9; FERPA	DOES OGC + Privacy Officer + OSSE liaison	M1: pull existing agreement + confirm expiration — 14 days. M2: draft renewal or YPMS-scope amendment — 45 days. M3: OSSE review — 75 days. M4: signature — 105 days. Blocks OSSE school-enrollment ingest build.	2027-01-15	🔴 Open
YPMS-POAM-021	High	DOES–CFSA MOU (foster/ward indicator) — renewal / scope amendment	NIST CA-3 / SA-9; DC Code Title 4	DOES OGC + CFSA liaison	M1: pull existing MOU + confirm expiration — 14 days. M2: draft renewal or YPMS-scope amendment — 45 days. M3: CFSA review — 75 days. M4: signature — 105 days. Blocks CFSA ingest build.	2027-01-15	🔴 Open
YPMS-POAM-022	High	SSA Electronic Information Exchange agreement (SSN cross-match) — renewal / scope amendment	NIST CA-3; SSA EIES requirements	DOES OGC + SSA regional liaison	M1: pull existing agreement + confirm YPMS scope coverage — 30 days. M2: amendment drafted if scope is new — 60 days. M3: SSA signature — 150 days (SSA cycle is slow). Blocks SSN verification build.	2027-03-01	🔴 Open
YPMS-POAM-023	High	Payroll-vendor selection and security review	NIST SA-9 / CA-3	DOES CIO + OYP + Procurement	M1: vendor requirements — 30 days. M2: SIG-Lite / SOC 2 collection from candidates — 60 days. M3: selection — 90 days. M4: ISA / DPA signature — 120 days. Blocks payroll integration build.	2027-01-31	🔴 Open

SSP tailorings above the RFP-derived requirement floor

These four items are the tailorings recorded in the SSP Appendix D and control-mapping §5. Building to the RFP wording alone would fail the Moderate baseline.

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-030	High	MFA required for all privileged and staff accounts	NIST IA-2(1)/(2) — SSP tailoring above C.5.7.6	DOES CIO	M1: MFA modality decision (Entra ID conditional access preferred, aligned with OWC/Employer 360) — 30 days. M2: implementation in non-prod — 90 days. M3: production enforcement — 120 days.	2027-02-15	🔴 Open
YPMS-POAM-031	High	TLS 1.2+ (target 1.3), FIPS-approved cipher suites; SSL retired	NIST SC-8 / AC-17(2) — SSP tailoring above C.5.6.15	DOES CIO	M1: TLS baseline in architecture doc — 30 days. M2: enforced in all environments — 60 days. M3: SSL Labs A+ or equivalent on public endpoints — 90 days.	2027-01-31	🔴 Open
YPMS-POAM-032	High	FIPS 140-3 cryptography (140-2 acceptable during deprecation window)	NIST IA-7 / SC-12 / SC-13 — SSP tailoring above C.5.7.9	DOES CIO	M1: crypto library inventory + FIPS mode confirmed for each — 30 days. M2: Key Vault (Azure Gov HSM) provisioned — 60 days. M3: all keys managed via Key Vault — 120 days.	2027-02-28	🔴 Open
YPMS-POAM-033	High	IAL2-equivalent identity proofing before youth banking/payroll actions	NIST IA-12 — SSP tailoring (RFP silent); links to open decision YPMS-POAM-050	DOES CIO + Privacy Officer + OYP	M1: identity-model decision (see YPMS-POAM-050) — 45 days. M2: proofing vendor selection (Login.gov / SSA / DMV records) — 90 days. M3: proofing flow implemented — 180 days. Blocks payroll enrollment for minors.	2027-04-01	❓ Blocked on YPMS-POAM-050

Foundational build activities

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-040	High	Architecture & tech-stack decision recorded	NIST PL-8 / SA-3	DOES CIO	✅ Stack decision closed 2026-09-30: Python 3.12 / FastAPI / SQLAlchemy / Postgres on Azure Government (OWC alignment). ✅ Architecture document v0.1 drafted 2026-09-30 (ypms/ARCHITECTURE.md). ✅ Phase 0 plan drafted 2026-09-30 (ypms/PHASE0_PLAN.md). M1: DC OCTO security architecture review — 45 days.	2026-11-15	🟡 In Progress
YPMS-POAM-041	High	Azure Government tenant + non-prod environments provisioned	NIST CM-2 / CM-6	DOES CIO + DC OCTO	M1: subscription request — 30 days. M2: dev + test environments — 60 days. M3: CIS Azure Foundations baseline applied — 90 days.	2027-01-15	🔴 Open
YPMS-POAM-042	High	CI/CD pipeline with SAST, SCA, secret scanning, SBOM	NIST SA-11 / SR-3 / SR-11 / CM-8	DOES CIO	M1: pipeline scaffold — 30 days. M2: SAST + SCA gates — 60 days. M3: SBOM generation per release (CycloneDX) — 90 days.	2027-01-31	🔴 Open
YPMS-POAM-043	High	Sentinel integration (DOES OIT ships application + Azure resource logs to DC OCTO Sentinel)	NIST AU-6 / SI-4	DOES CIO + DC OCTO CISO	M1: log-schema agreement with OCTO SOC — 30 days. M2: Sentinel workspace and ingestion — 60 days. M3: correlation rules and alert playbooks — 120 days.	2027-02-28	🔴 Open
YPMS-POAM-044	High	Backup + restore procedure documented and tested	NIST CP-9 / CP-9(1)	DOES CIO + OIT Ops	M1: procedure documented — 30 days. M2: initial restore drill — 60 days. M3: annual drill cadence established — 90 days.	2027-02-15	🔴 Open

3.3 Moderate (open)

Open policy decisions (mirrored to SSP Appendix D)

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-050	Moderate	Identity model for minors (social-media login vs. IAL2 proofing gates)	SSP §17.D	DOES CIO + Privacy Officer + OYP + AO	M1: options memo (browse-only social, IAL2 for payroll, parental co-auth for under-18) — 30 days. M2: AO decision — 60 days. Feeds YPMS-POAM-033.	2026-11-30	❓ Awaiting decision
YPMS-POAM-051	Moderate	Clarify "Level 3 security" wording from source RFP C.5.7.24	SSP §17.A	DOES CIO + ISSO	M1: options memo — 30 days. M2: AO clarification memo — 45 days. Treat as NIST 800-63 IAL3/AAL3 pending decision (higher of plausible readings).	2026-11-15	❓ Awaiting decision
YPMS-POAM-052	Moderate	PCI DSS applicability determination	SSP §17.E	DOES CIO + OYP + OGC	M1: transaction-flow review confirming ACH-only via payroll vendor (no card processing in YPMS) — 30 days. M2: PCI scope memo (expected: out of scope) — 45 days.	2026-11-15	❓ Awaiting decision
YPMS-POAM-053	Moderate	Dormant emergency health-record CSV path — in-boundary vs. emergency extension	SSP §17.H	Privacy Officer + DOES CIO + AO	M1: options memo — 30 days. M2: AO decision — 60 days. Recommended: separate emergency-scoped extension with its own PIA addendum.	2026-11-30	❓ Awaiting decision
YPMS-POAM-054	Moderate	Retention policy for audit logs, case records, backups	SSP §17.G	DOES Records Officer + Privacy Officer + DOES CIO	M1: records-schedule review — 30 days. M2: retention policy signed — 60 days. Feeds AU-11 and SI-12 implementation.	2026-12-15	❓ Awaiting decision

Assessment and pre-launch validation

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-060	Moderate	Independent Control Assessment (SCA) commissioned	NIST CA-2 / CA-2(1)	DOES CIO	M1: assessor selection — 60 days. M2: engagement — 120 days. M3: report — pre-Go-Live.	2027-06-30	🔴 Open
YPMS-POAM-061	Moderate	Penetration test (external + authenticated)	NIST CA-8	DOES CIO	M1: scope of work — 60 days. M2: engagement — 120 days. M3: report + remediation POA&M items — pre-Go-Live.	2027-06-30	🔴 Open
YPMS-POAM-062	Moderate	Vulnerability scanning cadence in production	NIST RA-5	DOES CIO	M1: scanner selection — 45 days. M2: monthly authenticated + unauthenticated scans — 90 days.	2027-03-15	🔴 Open

Access control and hygiene

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-070	Moderate	System-use notification banner on all authenticated entry points	NIST AC-8	DOES CIO + Legal	M1: banner text approved — 30 days. M2: implementation — 60 days.	2027-01-31	🔴 Open
YPMS-POAM-071	Moderate	Auto-disable inactive accounts (staff 90d, youth 180d — pending records policy)	NIST AC-2(3)	DOES CIO	M1: policy — 45 days (depends on YPMS-POAM-054). M2: implementation — 90 days.	2027-03-15	🔴 Open
YPMS-POAM-072	Moderate	Quarterly privileged-access recertification process	NIST AC-2 / AC-6(7)	DOES ISSO	M1: process document — 30 days. M2: first recertification cycle — 90 days.	2027-02-15	🔴 Open
YPMS-POAM-073	Moderate	Annual all-user access recertification process	NIST AC-2	DOES ISSO	M1: process document — 60 days. M2: tooling — 120 days.	2027-03-31	🔴 Open
YPMS-POAM-074	Moderate	Continuous Monitoring Strategy document	NIST CA-7 / SP 800-137	DOES ISSO	M1: draft — 60 days. M2: signatures — 90 days. Codifies cadence table from SSP §15.	2027-02-28	🔴 Open

Data-handling and privacy

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-080	Moderate	SSN masking/anonymization design and enforcement	NIST SC-28 / SI-10; C.5.7.50	DOES CIO	M1: display-layer masking design — 30 days. M2: at-rest encryption confirmed — 60 days. M3: audit — pre-Go-Live.	2027-04-30	🔴 Open
YPMS-POAM-081	Moderate	Language Access Act compliance (notices, portal content)	DC Language Access Act 2004	DOES CIO + OYP	M1: language matrix — 30 days. M2: translated content pipeline — 120 days.	2027-03-31	🔴 Open
YPMS-POAM-082	Moderate	Section 508 / WCAG 2.1 AA compliance audit	Section 508	DOES CIO	M1: automated audit in CI — 60 days. M2: manual audit — 120 days. M3: remediation — pre-Go-Live.	2027-05-31	🔴 Open
YPMS-POAM-083	Moderate	Parental consent workflow for under-18 registrants	NIST PT-4	Privacy Officer + DOES CIO + OGC	M1: consent-flow design — 45 days. M2: implementation — 120 days.	2027-04-15	🔴 Open
YPMS-POAM-084	Moderate	Data flow inventory + diagrams (all integrations)	NIST CA-3 / CA-9	DOES CIO	M1: inventory — 45 days. M2: diagrams — 90 days. Continuously updated.	2027-02-28	🔴 Open

DOES organizational / process

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-090	Moderate	ISSO assigned in writing for YPMS	NIST PM-2	DOES CIO	✅ Closed 2026-09-30: Chris Tonjes designated as ISSO alongside System Owner and AO roles; role concentration accepted and recorded in SSP §5.	2026-09-30	🟢 Closed
YPMS-POAM-091	Moderate	Role-based training curriculum (OYP staff, eligibility examiners, payroll admins)	NIST AT-3	DOES ISSO + OYP	M1: curriculum outline — 60 days. M2: content — 120 days. M3: first delivery — pre-Go-Live.	2027-05-31	🔴 Open
YPMS-POAM-092	Moderate	Personnel background-check confirmation for all YPMS-access personnel	NIST PS-3	DOES HR + DC OCTO	M1: current DOES/OIT team background-check status verified — 30 days. M2: gaps closed — 90 days.	2027-01-31	🔴 Open
YPMS-POAM-093	Moderate	Change Management Plan	NIST CM-3 / CM-9	DOES CIO + OIT Ops	M1: draft — 45 days. M2: DOES + OCTO NOC review — 90 days.	2027-02-15	🔴 Open
YPMS-POAM-094	Moderate	SORN applicability determination	NIST PT-6	Privacy Officer + OGC	M1: applicability memo — 60 days.	2026-12-31	❓ Awaiting decision

3.4 Low (open)

ID	Severity	Title	Source	Owner	Milestones	Target Date	Status
YPMS-POAM-100	Low	Approved-software list maintained and reviewed	NIST CM-10	DOES CIO	Quarterly review starting after first release.	Ongoing	🔴 Open
YPMS-POAM-101	Low	Anti-bot / rate-limit measures on public MBSYEP peak windows	NIST SC-5	DOES CIO	M1: threat model — 60 days. M2: WAF rules — 90 days. Tuned for summer peak.	2027-04-30	🔴 Open
YPMS-POAM-102	Low	FOIA response workflow with PII redaction guidance	DC FOIA	DOES OGC + Records Officer	M1: workflow document — 90 days.	2027-03-31	🔴 Open
YPMS-POAM-103	Low	Emerging-tech (GenAI/ML) governance if enabled	NIST SA-9 / SR-3	DOES CIO + Privacy Officer	Only triggers if GenAI features added. Deferred pending scope decision.	Deferred	⚪ Deferred
YPMS-POAM-104	Low	Vendor lock-in and data-portability provisions in payroll/LMS contracts	NIST SA-4	DOES OGC + Procurement	Included as clauses during vendor selection.	2027-01-31	🔴 Open
YPMS-POAM-105	Low	Legacy data-migration plan (7 tools: PF3, TMS, MicroStrategy, Host/Participant App, Scanning, Transfer, manual payroll)	NIST SI-12	DOES CIO + OYP + OIT	M1: source inventories — 90 days. M2: mapping and transform design — 180 days. M3: cutover strategy — pre-Go-Live.	2027-05-31	🔴 Open
YPMS-POAM-106	Low	Legacy system decommission schedule and destruction evidence	NIST MP-6 / SR-3	DOES CIO + OIT	Follows successful cutover.	Post-Go-Live	⚪ Deferred

---

4. Closed Items

Closures retained for traceability.

ID	Title	Closure Date	Verification / Evidence
YPMS-POAM-002	AO designated in writing for YPMS	2026-09-30	Chris Tonjes (DOES CIO) designated as AO. Role-concentration risk accepted per SSP §5. Update SSP §3.2 reflects the designation.
YPMS-POAM-090	ISSO assigned in writing for YPMS	2026-09-30	Chris Tonjes designated as ISSO. Role-concentration risk accepted per SSP §5. Update SSP §4 reflects the designation.
—	Stack decision (partial closure of YPMS-POAM-040)	2026-09-30	Python 3.12 / FastAPI / SQLAlchemy / Postgres selected (OWC alignment).
—	Architecture document v0.1 (partial closure of YPMS-POAM-040)	2026-09-30	ypms/ARCHITECTURE.md drafted; forward-looking design following the OWC pattern.
—	Phase 0 plan v0.1 (partial closure of YPMS-POAM-040)	2026-09-30	ypms/PHASE0_PLAN.md drafted: framework vendor-in, auth, RBAC, audit, Registrant vertical slice, 501 stubs on remaining ARCH §6.1 entities.
—	Phase 0 milestone 0.1 shipped (partial closure of YPMS-POAM-040)	2026-09-30	Repo scaffold, Docker Compose, FastAPI factory with /healthz + /readyz, structlog + request-id middleware, Alembic baseline, CI workflow, README + CONTRIBUTING. Tests green (3 passing, ruff + mypy clean). Committed as 393631a.
—	Phase 0 milestone 0.2 shipped (partial closure of YPMS-POAM-040)	2026-09-30	OWC framework vendored (base/crud/bulk/pagination/router/version_history + audit + security/rbac + users + auth stub) with owc→ypms renames. YPMS pii_audit decorator added. Pagination bug in upstream OWC fixed here (peek-ahead cursor). 26 tests passing, 93.10% coverage. Migration 0002 creates the framework tables.
—	Phase 0 milestone 0.3 shipped (partial closure of YPMS-POAM-040)	2026-09-30	Local password auth + JWT access/refresh tokens with YPMS-specific claims (uid, roles, iam.assurance_level, mfa_verified). Endpoints: /auth/login, /auth/refresh, /auth/me, /auth/change-password. NIST AC-7 lockout at 5 attempts / 15 min (source RFP C.5.7.10). 43 tests passing, 93.47% coverage.
—	Phase 0 milestone 0.4 shipped (partial closure of YPMS-POAM-040)	2026-09-30	Data-driven RBAC seed: 8 roles + permissions matrix (30 entities × 8 actions) at src/ypms/seed/. Bootstrap admin auto-seeded (chris / DOES_SYSTEM_ADMIN). Loader idempotent + validates cell references. python -m ypms.seed.run chained into docker-compose. 53 tests passing, 92.20% coverage.
—	Phase 0 milestone 0.5 shipped (partial closure of YPMS-POAM-040)	2026-09-30	Registrant vertical slice: model, schemas, router, migration 0003. SSN app-layer encrypted (AES-256-GCM, column-bound AAD) and masked in the serializer (C.5.7.50 / SC-28). pii_read audit on every read path (C.5.6.9 #5 / AU-14). Audit + version-history snapshots redact ciphertext via __audit_redact__. Portal-only roles limited to own row. 98 tests passing, 94.83% coverage. Evidence trace at docs/coverage/registrant.md.
—	Phase 0 milestone 0.6 shipped (partial closure of YPMS-POAM-040)	2026-09-30	501-stub routers for 26 entities; every route enforces RBAC and writes an audit row before returning 501 (source RFP C.5.7.27; NIST AC-3, AU-12). Matrix-driven test sweep covers every entity × role × action. Permission-matrix review items recorded in PHASE0_STATUS.md. 138 tests passing, 95.05% coverage.

---

5. Maintenance and Reporting Cadence

Activity	Frequency	Owner
POA&M review — status update on every open item	Monthly	DOES ISSO
POA&M report to AO	Quarterly	DOES CIO
New-finding intake (from scans, assessments, incidents)	Continuous	DOES ISSO
Milestone-slip escalation to CIO	On any 30-day slip past target date	DOES ISSO
Closure verification (independent from remediator)	Per closure	DOES ISSO
POA&M archive at ATO decision	At initial ATO and each reauthorization	DOES CIO

Reporting format for status update

Each open item gets a one-line status update per monthly cycle, retained in an append-only status log (ypms/POAM_STATUS_LOG.md — to be created on first cycle):

YYYY-MM-DD YPMS-POAM-NNN [🔴|🟡|🟢|🔵|⚪|❓] {status text ≤ 200 chars}

Status text records: what moved, blockers, next milestone due.

---

End of draft v0.1.