Reviewed October 6, 2026: DOE O 470.7, approved August 5, 2026, supersedes O 471.7 for its covered facilities and activities. Existing contractor requirements remain effective until formally changed. Determine the CUI safeguards, applicable NIST revision, and UCNI requirements from your contract and current DOE direction.
Two regimes in one contract
DOE CUI follows the government-wide CUI framework and the safeguards your contract incorporates. O 470.7 supersedes O 471.7 for covered activities; older contractor requirements continue until formally changed. UCNI has its own determination, access, and handling rules under the Atomic Energy Act and 10 CFR Part 1017. A compliant CUI environment alone does not establish an individual's right to access UCNI.
Boundary design principles
- Classify the data before the systems. Which information is baseline CUI, which is a specified category, which is UCNI — determined from your contract, DOE guidance, and (for UCNI) the applicable determinations. The inventory drives everything.
- Nest, don't flatten. The working pattern is a compliant CUI boundary with a tighter UCNI compartment inside it: stricter access control, explicit need-to-know grants, and separate marking and handling discipline — enforced in configuration (Conditional Access, Purview labels, segmented storage), not in a memo.
- Access is granted per person, per purpose. UCNI access lists are deliberate and documented. A group called "Engineering" is not a need-to-know determination.
- Flow-downs decide your slice. Lab subcontractors receive obligations through primes whose M&O contracts trace back to DOE directives. Your program implements what your subcontract says — verified against the flow-down text, not assumed from the directive.
- Evidence both regimes distinctly. One environment, two proof sets: 800-171 objective evidence for the CUI program, and access/handling records that demonstrate UCNI discipline on its own terms.
Design once, defend twice: the nested-compartment pattern means your DOE reviewer sees UCNI handled as UCNI, your CUI assessment sees a clean 800-171 boundary, and your engineers manage one environment instead of two. That's the same one-implementation philosophy as the rest of the Factory — applied where the stakes are nuclear-adjacent.
Get the DOE boundary designed before the audit designs it for you.
Tell us the contract type and the data mix — a practitioner will map the CUI/UCNI compartment design and what it takes to evidence both. Or email rj@indirectit.com directly.