Reviewed October 6, 2026: DOE O 470.7, approved August 5, 2026, supersedes O 471.7 for its covered facilities and activities. Existing contractor requirements remain effective until formally changed. Determine the CUI safeguards, applicable NIST revision, and UCNI requirements from your contract and current DOE direction.
What the DOE lane involves
- We read DOE contracts, financial-assistance awards, and prime flow-downs for the CUI and cybersecurity terms they incorporate.
- DOE work can mix CUI Basic with specified categories, including UCNI, that carry additional handling rules. The boundary and access design follows each category's requirements.
- We implement and document NIST SP 800-171 at the revision your instrument incorporates, on Microsoft government cloud or an enclave architecture where the data warrants it.
- The SSP, POA&M, and objective-level evidence are structured for the demonstration your contract anticipates.
- Evidence collection and control validation continue after that under managed compliance.
Questions contractors ask us
Which DOE requirements apply to our contract?
DOE O 470.7 supersedes O 471.7 for covered facilities and activities, but existing contractor requirements remain effective until formally changed. Review the order, your contract and flow-downs, and current agency direction to establish CUI safeguards and the applicable NIST revision.
Is UCNI the same as CUI?
No. Unclassified Controlled Nuclear Information is its own statutory control regime with its own access and handling rules. Under the CUI program it's a specified category, with requirements beyond CUI Basic. If your DOE work touches UCNI, the boundary and handling design has to follow those specific rules as well as the general CUI requirements.
We support a national laboratory as a subcontractor. Who imposes the requirements?
Your prime's flow-downs, which trace back to the lab's M&O contract and DOE directives. In practice, that means reading the flow-down clauses you received. Primes sometimes flow down more or less than the directive requires, and your obligation is what's in your subcontract.
Map your DOE obligation before you design the boundary.
Tell us the contract type (direct award, lab subcontract, or financial assistance), and a practitioner will identify what applies and how to satisfy it. Or email rj@indirectit.com directly.