Reviewed October 6, 2026: DOE O 470.7, approved August 5, 2026, supersedes O 471.7 for its covered facilities and activities. Existing contractor requirements remain effective until formally changed. Determine the CUI safeguards, applicable NIST revision, and UCNI requirements from your contract and current DOE direction.
What the DOE lane involves
- Instrument and flow-down review — DOE contracts, financial-assistance awards, and prime flow-downs read for the CUI and cybersecurity terms they incorporate.
- Category-aware boundary design — DOE work can mix baseline CUI with specified categories (including UCNI) that carry additional handling rules; the boundary and access design respects each category's actual requirements.
- 800-171 implementation — the standard implemented and documented at the revision your instrument incorporates, on Microsoft government cloud or enclave architecture where the data warrants it.
- SSP, POA&M, and evidence — objective-level artifacts structured for the demonstration your contract anticipates.
- Sustainment — continuous evidence and control validation under managed compliance.
Questions contractors ask us
Which DOE requirements apply to our contract?
DOE O 470.7 supersedes O 471.7 for covered facilities and activities, but existing contractor requirements remain effective until formally changed. Review the order, your contract and flow-downs, and current agency direction to establish CUI safeguards and the applicable NIST revision.
Is UCNI the same as CUI?
No. Unclassified Controlled Nuclear Information is its own statutory control regime with its own access and handling rules; under the CUI program it's handled as a specified category with requirements beyond the CUI baseline. If your DOE work touches UCNI, the boundary and handling design must respect those specific rules — not just the generic CUI baseline.
We support a national laboratory as a subcontractor. Who imposes the requirements?
Your prime's flow-downs, which trace back to the lab's M&O contract and DOE directives. Practically, that means reading the flow-down clauses you actually received — primes sometimes flow more, or less, than the directive strictly requires, and your obligation is what's in your subcontract.
Get the DOE obligation mapped before it maps you.
Tell us the contract type — direct award, lab subcontract, financial assistance — and a practitioner will identify what actually applies and how to satisfy it. Or email rj@indirectit.com directly.