10 CFR Part 810: Can a Nuclear Plant Run Microsoft 365 and Azure?

The enterprise Microsoft 365 and Azure program has reached the plant, and three groups have three different answers. Engineering wants drawings and procedures in SharePoint and Teams, operations wants plant data in Azure for reporting, and the cyber security program owner wants to know what new path out of the plant is being proposed. Four sets of words decide it: DOE’s export rule for nuclear technology, the NRC’s cyber security rule and its guidance, the NRC’s rule for Safeguards Information, and what Microsoft has published about its own clouds. This guide puts them side by side for the IT leader who has to decide where each class of plant data goes. It describes how the rules are built; it does not decide whether a specific document, person or system is covered, which belongs to your export-control officer, your cyber security program owner, DOE and the NRC. Every DOE, NRC and Microsoft source cited was read on September 24, 2026.

A placement argument stalls when no one has sorted the data first, because each group is arguing about a different file. The four sets of rules attach to the kind of information, not to the application that holds it, which is why the sorting comes before the cloud choice. Each row names the rule and, where one exists, Microsoft’s statement; where no source read for this guide speaks to a cell, the cell says so.

The planning rule is to classify before migrating. Where a document’s class is unclear, it goes to the export-control officer before it moves, not after a migration tool has already copied it.

When engineering asks to move its document set, the files that raise the most concern describe how the reactor and the equipment around it are built, run and maintained. Among the activities 10 CFR Part 810 covers, section 810.2(b) lists “Nuclear reactor development, production or use of the components within or attached directly to the reactor vessel, the equipment that controls the level of power in the core, and the equipment or components that normally contain or come in direct contact with or control the primary coolant of the reactor core;” Two definitions in section 810.3 decide how far that reaches. The first reads “Use means operation, installation (including on-site installation), maintenance (checking), repair, overhaul, or refurbishing.” The second reads “Technical data means data in such forms as blueprints, plans, diagrams, models, formulae, engineering designs, specifications, manuals, and instructions written or recorded on other media or devices such as disks, tapes, read-only memories, and computational methodologies, algorithms, and computer codes that can directly or indirectly affect the production of special nuclear material.” Read together, the rule reaches use of that equipment, which it defines to include operation and maintenance, and not only its design. This guide does not say whether any particular drawing, procedure or data set meets those definitions. Some information sits outside the part altogether. Section 810.2(c) lists among the things the part does not apply to “Transfer of publicly available information, publicly available technology, or the results of fundamental research;” At the other end, section 810.7 reads “Any person requires a specific authorization by the Secretary before:” and lists, among other activities, “Providing or transferring sensitive nuclear technology to any foreign country or entity; or” The determination is DOE’s. According to the eCFR text of section 810.5(a), “The advice of the DOE Office of Nonproliferation and Arms Control may be requested on whether a proposed activity falls outside the scope of this part, is generally authorized under § 810.6, or requires a specific authorization under § 810.7. However, unless authorized by the Secretary in writing, no interpretation of the regulations in this part other than a written interpretation by the DOE General Counsel is binding upon DOE.” Route unclear documents to your export-control officer first and, where the answer turns on the rule itself, to DOE’s Office of Nonproliferation and Arms Control.

When export rules come up in a cloud review, the transfer that matters can be a person inside the United States opening a file, not only a shipment abroad. 10 CFR Part 810 covers “The transfer of technology that involves any of the activities listed in paragraph (b) of this section either in the United States or abroad by such persons or by licensees, contractors or subsidiaries under their direction, supervision, responsibility, or control.” It defines the person who matters: “Foreign national means an individual who is not a citizen or national of the United States, but excludes U.S. lawful permanent residents and protected individuals under the Immigration and Naturalization Act (8 U.S.C. 1324b(a)(3)).” Among the transfers the part does not apply to is “Transfer of technology to any individual who is lawfully admitted for permanent residence in the United States or is a protected individual under the Immigration and Naturalization Act (8 U.S.C. 1324b(a)(3)).” For foreign nationals working at a plant, the part carries a general authorization with conditions attached. According to the eCFR text of section 810.6(b), that authorization applies “provided that no sensitive nuclear technology or assistance described in § 810.7 is involved”, and it covers “Transfer of technology to a citizen or national of a country other than the United States not listed in the Appendix to this part and working at an NRC-licensed facility, provided: (1) The foreign national is lawfully employed by or contracted to work for a U.S. employer in the United States; (2) The foreign national executes a confidentiality agreement with the U.S. employer to safeguard the technology from unauthorized use or disclosure; (3) The foreign national has been granted unescorted access in accordance with NRC regulations at an NRC-licensed facility; and (4) The foreign national’s U.S. employer authorizing access to the technology complies with the reporting requirements in § 810.12(g).” According to the eCFR text, section 810.12(g) adds “Persons engaging in generally authorized activities under § 810.6(b) are required to notify DOE that a citizen or national of a country not listed in the Appendix to this part has been granted access to information subject to § 810.2 in accordance with Nuclear Regulatory Commission access requirements.” In a tenant design, that makes access a question of each person’s status, not only of where the person sits. An engineer on site, a contractor working remotely and a cloud operator’s support engineer are three different questions under the same rule.

Once access is designed by status, the cloud operator’s own staff are the part of the question an internal team can leave out. Microsoft’s DoE 10 CFR Part 810 compliance page, last updated September 2022, says “Azure Government can accommodate customers subject to DoE 10 CFR Part 810 export control requirements because it is designed to meet specific controls that restrict access to information and systems to US persons among Azure operations personnel.” It adds “Azure Government also imposes background screening requirements mandated by US Government on operations personnel with access to production systems.” The same page says “you’re responsible for getting a DoE authorization for your own systems, including the use of cloud services.” Read that as Microsoft’s statement of where responsibility sits; whether a given use needs an authorization is still the question DOE answers. Microsoft’s Azure support for export controls page, last updated July 8, 2026, says “Azure Government provides an extra layer of protection through contractual commitments regarding storage of your customer data in the United States and limiting potential access to systems processing your data to screened US persons”. Commercial Azure is different. Microsoft’s NERC CIP standards and cloud computing page, last updated May 7, 2023, says “Azure Government is designed to meet specific controls that restrict access to information and systems to US persons. This commitment isn’t applied in Azure. Therefore, customers deploying on Azure should conduct proper risk assessment to determine if extra technical measures should be deployed to secure data that shouldn’t be disclosed to foreign persons.” The same page says “Nuclear utility customers are wholly responsible for ensuring their own compliance with all applicable laws and regulations.” A detail that is easy to miss in a design review sits on Microsoft’s Compare Azure Government and global Azure page, last updated August 21, 2025: “You’re responsible for designing and deploying your applications to meet US export control requirements such as the requirements prescribed in the EAR, ITAR, and DoE 10 CFR Part 810. In doing so, you shouldn’t include sensitive or restricted information in Azure resource names” Getting into Azure Government is its own step. Microsoft’s What is Azure Government? page, last updated May 19, 2026, says “Azure Government customers (US federal, state, and local government or their partners) are subject to validation of eligibility. If there’s a question about eligibility for Azure Government, you should consult your account team.” Three planning rules follow. Design access by each person’s status for every controlled data class, not only by the employee’s location. Include the cloud operator’s staff in that analysis, using Microsoft’s own statements for each cloud. Keep export-controlled terms out of resource names, subscription names and tags from the first deployment. What moving existing workloads from Azure commercial into Azure Government involves is covered in Azure Government Migration: What Moving from Azure Commercial Actually Takes.

When engineering documents are headed for SharePoint and Teams, the question moves from Azure to Microsoft 365. Microsoft’s Part 810 compliance page, last updated September 2022, lists one cloud in its applicability section, Azure Government, and names no Microsoft 365 cloud. None of the Microsoft pages read for this guide names Part 810 technology for a Microsoft 365 cloud. That is a statement about what those pages say, not a verdict on what any Microsoft 365 cloud can or cannot hold. Microsoft’s Microsoft 365 Government how-to-buy page, last updated August 13, 2024, says “Microsoft 365 Government is available to eligible government customers and nongovernment organizations sponsored to hold or process controlled information.” Its list of accepted government data types for a commercial private entity includes “Department of Energy (DoE) UCNI” and “Other types of data that require Microsoft 365 Government”, and it says “Proof of membership in one of the groups listed previously is required for access to Microsoft 365 Government offerings.” UCNI is a DOE category of its own; Microsoft’s export controls page says “For data subject to DOE export controls, the classification system is augmented by the Unclassified Controlled Nuclear Information (UCNI) controls established by Section 148 of the AEA.” Where GCC High is proposed instead, Microsoft’s Office 365 GCC High and DoD page, last updated August 3, 2026, describes why that environment exists: “To meet the unique and evolving requirements of the United States Department of Defense, as well as contractors holding or processing DoD controlled unclassified information (CUI) or subject to International Traffic in Arms Regulations (ITAR), Microsoft offers GCC High and DoD environments.” It also says “Office 365 staff don’t have standing access to GCC High and DoD production. Any staff who requests temporary permission elevation that would grant access to customer content must first have passed the following background checks.” The first check in its table is “Verification of U.S. citizenship”. The page names no DOE or Part 810 data. The planning rule: before Part 810 technology enters any Microsoft 365 tenant, ask your Microsoft account team for Microsoft’s position in writing and file it with the export-control record. The wider choice between Microsoft’s government clouds is covered in Microsoft 365 GCC vs GCC High: Which Government Cloud Does Your Organization Need?.

When your cyber security program owner objects to a cloud project, the objection is about a new path out of the plant more than about Microsoft. 10 CFR 73.54 opens “Each licensee subject to the requirements of this section shall provide high assurance that digital computer and communication systems and networks are adequately protected against cyber attacks, up to and including the design basis threat as described in § 73.1.” The systems it protects are those serving “(i) Safety-related and important-to-safety functions; (ii) Security functions; (iii) Emergency preparedness functions, including offsite communications; and (iv) Support systems and equipment which, if compromised, would adversely impact safety, security, or emergency preparedness functions.” Two requirements in that rule bear on any cloud project. Licensees must “Analyze digital computer and communication systems and networks and identify those assets that must be protected against cyber attacks to satisfy paragraph (a) of this section,” and must “Ensure that modifications to assets, identified by paragraph (b)(1) of this section, are evaluated before implementation to ensure that the cyber security performance objectives identified in paragraph (a)(1) of this section are maintained.” A reporting feed that connects to one of those assets is the kind of change the program evaluates before it is built. The NRC’s guidance describes how. Regulatory Guide 5.71, Revision 1, with an issue date of February 2023, says “This regulatory guide (RG) describes an approach that is acceptable to the staff of the U.S. Nuclear Regulatory Commission (NRC) to meet regulatory requirements in Title 10 of the Code of Federal Regulations (10 CFR) 73.54,” and “This RG applies to operating power reactors licensed in accordance with 10 CFR Part 50,” It is an acceptable approach, not a rule. In the defensive architecture the guide describes, “CDAs associated with safety-related, important-to-safety, and security functions, as well as support systems and equipment that, if compromised, would adversely impact safety-related, important-to-safety, and security functions, are allocated to Level 4 and are protected from all lower levels.” and “Only one-way data flow is allowed from Level 4 to Level 3 and from Level 3 to Level 2.” In the same approach acceptable to the staff, the guide names the cloud directly. Its glossary defines external systems as “Systems that are outside the control of a licensee or applicant such that the licensee or applicant has no direct supervision or authority over the application of security controls or the assessment of the security controls.” and ends its list of examples with “cloud service providers” “(e.g., infrastructure as a service, platform as a service, or software as a service).” Its control on the use of external systems says “The intent of this control is to ensure CDAs are prohibited from access by, or communication with, external systems that are not within the same security level.” and lists as a licensee activity “prohibiting the use of an external system to access CDAs or to process, store, or transmit organization-controlled information except when [Licensee/Applicant] verifies the implementation of equivalent security measures on the external system.” Records follow the program. 10 CFR 73.54 says “Policies, implementing procedures, site-specific analysis, and other supporting technical information used by the licensee need not be submitted for Commission review and approval as part of the cyber security plan but are subject to inspection by NRC staff on a periodic basis.” and “The licensee shall retain all records and supporting technical documentation required to satisfy the requirements of this section as a record until the Commission terminates the license for which the records were developed, and shall maintain superseded portions of these records for at least three (3) years after the record is superseded, unless otherwise specified by the Commission.” Three planning rules follow. Plant data bound for a cloud report leaves by the one-way path the cyber security plan already defines, and nothing in the cloud connects back toward a critical digital asset. Treat the Microsoft 365 or Azure tenant as an external system and write down the equivalent-measures verification before organization-controlled information goes to it. Keep that verification with the program’s records, under the program’s retention rule.

If a document set includes Safeguards Information, a shared tenant is the wrong starting assumption. 10 CFR 73.22, in its paragraph on electronic processing, says “Safeguards Information may be stored, processed or produced on a stand-alone computer (or computer system) for processing of Safeguards Information.” It defines stand-alone as “means a computer or computer system to which access is limited to individuals authorized access to Safeguards Information.” and adds “A stand-alone computer or computer system shall not be physically or in any other way connected to a network accessible by users who are not authorized access to Safeguards Information.” The same paragraph ends “Other systems may be used if approved for security by the appropriate NRC office.” Stated plainly, a shared Microsoft 365 or Azure tenant is not the stand-alone system the rule describes, and any other system is a question for the appropriate NRC office to approve. This guide does not say whether the NRC has approved any cloud system for Safeguards Information.

Once Part 810 has a clean answer, the other rulebooks your estate answers to are still open. 10 CFR Part 810 says in section 810.8(b) that a general or specific authorization “Does not relieve a person from complying with the relevant laws or the regulations of other U.S. Government agencies applicable to exports; and” Part 810 is DOE’s regime and ITAR is the State Department’s, and one does not stand in for the other; for estates that also hold ITAR technical data, see Redesigning an ITAR Export-Control Compliance Program to Be Efficient, Not Just Compliant. Where the operator’s company also owns grid-facing assets, it can carry separate NERC CIP obligations for them, which are a different regime from the NRC’s and are not covered. Plants licensed under 10 CFR Part 53 follow a different cyber security rule, 10 CFR 73.110, and the NRC’s Regulatory Guide 5.96, with an issue date of March 2026, describes its approach for “establishing, implementing, and maintaining a cybersecurity program at commercial nuclear plants that are licensed under Title 10 of the Code of Federal Regulations (10 CFR) Part 53”; this guide does not cover that path.

If one of these conditions holds, the cloud choice is not the decision at all, and forcing it wastes the review.

• If DOE’s advice is that the data in scope is outside Part 810, or the data is public, the Part 810 sections do not drive the cloud choice; the cyber security plan and the Safeguards Information rule still apply where their data is involved.
• If the data comes from critical digital assets at the higher security levels, the question is the plan’s one-way path out, not which cloud receives it.
• If the plant is licensed under 10 CFR Part 53, the NRC’s rule 10 CFR 73.110 and its Regulatory Guide 5.96 apply instead of the sources this guide explains.
• If Microsoft’s eligibility validation does not admit the operator to a government cloud, the decision becomes which data stays on premises, not which Microsoft cloud holds it.

Whoever does the work, the design review has to see these before any plant data moves.

• A written data-class map that names the source rule for each class.
• Access designed by each person’s status for every controlled class, including the cloud operator’s staff.
• A route for unclear documents to the export-control officer and, when needed, to DOE’s Office of Nonproliferation and Arms Control.
• The equivalent-measures verification written down for each external system that receives organization-controlled information.
• Nothing connected back toward a critical digital asset, and plant data leaving only by the plan’s one-way path.
• Export-controlled terms kept out of resource names, subscription names and tags.
• Verification and design records kept under the cyber security program’s retention rule.
• Senior, US-based delivery, stated as a location and nothing more.

When the placement decisions turn into a project, the work is a governed migration. i3solutions plans and runs governed Azure and Microsoft 365 migrations with senior, U.S.-based engineers. Applied to plant data, the method begins with the data-class map and the access design, with the export-control officer and the cyber security program owner making the determinations that belong to them. i3solutions maps governance to named control families, enforces it in the platform through Entra ID, Purview, and Azure Policy, and evidences it continuously rather than reconstructing it at audit. On a nuclear power operator, i3solutions replaced a manual reporting process with an automated dashboard that saved over $293,000 a year and, more importantly for the control environment, removed the manual reconciliation that had been the audit exposure. i3solutions has deployed Power BI inside a GCC High tenant and inside Azure Government for a federal customer. Delivery is senior and US-based. The governance service line is described in Embedding Governance into How the Enterprise Operates and Scales.