DOE offices and designated contractors shall establish internal controls for ensuring that the customer access codes assigned for their accounts are properly protected.