Reviewed October 6, 2026: DOE O 470.7, approved August 5, 2026, supersedes O 471.7 for its covered facilities and activities. Existing contractor requirements remain effective until formally changed. Determine the CUI safeguards, applicable NIST revision, and UCNI requirements from your contract and current DOE direction.
Two regimes in one contract
DOE CUI follows the government-wide CUI framework and the safeguards your contract incorporates. O 470.7 supersedes O 471.7 for covered activities; older contractor requirements continue until formally changed. UCNI has its own determination, access, and handling rules under the Atomic Energy Act and 10 CFR Part 1017. A compliant CUI environment alone does not establish an individual's right to access UCNI.
Boundary design principles
- Classify the data before the systems. Decide which information is CUI Basic, which falls in a specified category, and which is UCNI, using your contract, DOE guidance, and (for UCNI) the applicable determinations. Every later design decision depends on that inventory.
- Nest UCNI inside the CUI boundary. Build a compliant CUI boundary and put a tighter UCNI compartment inside it, with stricter access control, explicit need-to-know grants, and separate marking and handling. Enforce those rules in configuration (Conditional Access, Purview labels, segmented storage). A policy memo alone does not enforce them.
- Grant access per person and per purpose. Keep UCNI access lists deliberate and documented. Membership in a group called "Engineering" is not a need-to-know determination.
- Your flow-downs set your obligations. Lab subcontractors receive obligations through primes whose M&O contracts trace back to DOE directives. Your program implements what your subcontract says, so read each obligation from the flow-down text itself instead of inferring it from the directive.
- Keep separate evidence for each regime. One environment produces two sets of proof: 800-171 objective evidence for the CUI program, and access and handling records that show UCNI is controlled under its own rules.
With the nested compartment, your DOE reviewer sees UCNI handled as UCNI, your CUI assessment sees a clean 800-171 boundary, and your engineers manage one environment instead of two. It is the single-implementation approach of our Factory, applied to nuclear-adjacent work.
Get the DOE boundary designed before the audit designs it for you.
Tell us the contract type and the data mix, and a practitioner will map the CUI and UCNI compartment design and the evidence each one needs. Or email rj@indirectit.com directly.