Chris TonjesandClaude Opus 4.7
8712e93258
Pre-development state; no code yet. Delivery model: in-house build by DOES OIT on Azure Government, matching the DCYWP / OWC / Employer 360 pattern. Stack decision (2026-09-30): Python 3.12 / FastAPI / SQLAlchemy / Postgres, aligning with OWC. System Owner / ISSO / AO: Chris Tonjes (DOES CIO). Role concentration recorded in SSP §5 with risk-acceptance rationale. Source functional and security requirements derived from the prior YPMS RFP (Solicitation Docxxxxx, April 2025) — 54 C.5.7 security requirements and Appendix E non-functional requirements — treated as source specifications, not as Contractor obligations. Documents included: - CLAUDE.md, OVERVIEW.md — project router and program-level summary - SYSTEM_SECURITY_PLAN.md v0.3 — NIST 800-53 Moderate baseline SSP - NIST_800_53_CONTROL_MAPPING.md v0.2 — full control-family mapping with in-house ownership tags and evidence-artifact expectations - POAM.md v0.1 — 62-item POA&M seeded from tailorings, open decisions, missing companion docs, and pre-ATO deliverables; two items closed - PRIVACY_IMPACT_ASSESSMENT.md v0.1 — full PIA covering minors, SSN, banking, FERPA-covered OSSE records, CFSA foster/ward flags, and the dormant emergency health-record path - ARCHITECTURE.md v0.1 — forward-looking design blueprint, OWC-aligned - PHASE0_PLAN.md v0.1 — framework vendor-in, auth, RBAC, audit, Registrant vertical slice, 501 stubs for remaining entities - TODO.md — 12-section working checklist tied to POA&M IDs - OLA_RESPONSE_2026-09-30.md — Q&A for OLA / City Administrator Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
4.6 KiB
YPMS — OLA Questions Response
Re: Modernization of the Marion Barry Summer Youth Employment Program Web-Based Data Management System (YPMS) — DOES Strategic Initiative FY27 Prepared for: OLA / City Administrator Date: 2026-09-30
1. What data will populate in this system?
Applicant and participant records (youth, hosts/employers, parents/guardians, DOES staff) including:
- Identity: name, DOB, address, phone/email, parent/guardian contact
- SSN (for SSA cross-match; masked in display)
- Education: school enrollment status ingested from OSSE
- Eligibility: age, residency (validated against DC MAR), foster/ward-of-state flag from CFSA
- Program participation: applications, certifications, orientation completion, enrollments, job matches, worksite assignments
- Employment: hours worked, resumes, job preferences
- Financial: banking for direct-deposit payroll, tax info, W-2/1099 records via the third-party payroll integration
- Operational: host/employer registrations, worksites, job postings, transportation vouchers, communications, audit logs
2. How much of this data will be provided to the public?
Very little. The public surface is limited to available programs and dates, host-employer job postings, application forms, static help and training content, and aggregate program information. No individual PII is exposed publicly. Press and public reporting uses de-identified counts; FOIA responses go through DOES OGC with PII redacted.
3. Will the system contain information on students served across fiscal years, broken out by sub-programs?
Yes. The system tracks program details year-over-year and supports each OYP sub-program as a first-class object — MBSYEP, HSIP, MBYLI (SIT / School Year / Global Education), CRESP, and any future OYP program. Reporting is in scope; MicroStrategy (the current reporting tool) is one of the legacy components YPMS replaces. Historical participant data with sub-program breakdowns is retained per DOES records schedule.
4. Is there something similar for other workforce programs at DOES?
Partially, but nothing consolidated the way YPMS will be:
- Adult unemployment insurance: UIBS — being modernized separately.
- Adult workforce services: Geographic Solutions' Virtual One-Stop (VOS).
- Workers' compensation: OWC — a separate DOES modernization on its own ATO path.
- Youth today: fragmented across seven legacy tools (Host/Participant Application, Scanning, Transfer, TMS timekeeping, MicroStrategy, PF3 admin backdoor, manual payroll scripts) — YPMS consolidates these.
YPMS is the youth-specific consolidation; it doesn't replace anything on the adult side.
5. Will the system house SYEP participants' personal information — addresses, SSN, banking, etc. — and are there privacy concerns?
Yes. YPMS will store address, SSN, DOB, banking for direct-deposit payroll, tax info, parent/guardian contact, school records (FERPA-covered, from OSSE), foster/ward status (from CFSA), and — under emergency scenarios — health records.
Privacy concerns and how they are addressed:
| Concern | Mitigation |
|---|---|
| Population is primarily minors — heightened stewardship required | Strict role-based access; data minimization by reusing eligibility across programs; parental co-authentication under consideration |
| SSN is a high-value identity-theft target | Masked/anonymized in display; encrypted at rest and in transit using FIPS-validated cryptography |
| Banking data | Encrypted; passed to the third-party payroll vendor via secured integration; payroll processing itself lives outside YPMS |
| School records (OSSE) | Handled under FERPA; requires a formal DOES–OSSE data-sharing agreement |
| Foster/ward status (CFSA) | Confidential under DC Code Title 4; access limited on need-to-know |
| Detection and response | IDS/IPS and SIEM required; unauthorized disclosures are reported immediately through the DOES OIT → DC OCTO CISO chain, with a full internal report within 24 hours and a remediation plan within 2 business days |
| Assurance baseline | NIST 800-53 Moderate; DC OCTO IT policies; SSA electronic exchange requirements |
| Records-access oversight | DOES OIT maintains and reviews a full list of personnel with data access, updated at least quarterly with additions and deletions tracked |
Open questions flagged for the AO: whether social-media login is acceptable for minors without full identity proofing before payroll actions, and treatment of the dormant health-record ingest path. YPMS will be built in-house by DOES OIT and hosted on Azure Government, matching the OWC and Employer 360 posture.