---
kind: "section"
citation: "32 C.F.R. § 236.3"
title: "32"
number: "236.3"
heading: "Policy."
url: "https://uscodex.org/cfr/32/236.3"
---

# §236.3. Policy.


It is DoD policy to:

- (a) Establish a comprehensive approach to require safeguarding of covered defense information on covered contractor information systems and to require contractor cyber incident reporting.
- (b) Increase Government stakeholder and DIB situational awareness of the extent and severity of cyber threats to DoD information by implementing a streamlined approval process that enables the contractor to elect, in conjunction with the cyber incident reporting and sharing, the extent to which DoD may share cyber threat information obtained from a contractor (or derived from information obtained from the company) under this part that is not information created by or for DoD with:
  - (1) DIB CS Program participants to enhance their cybersecurity posture to better protect covered defense information on covered contractor information systems, or a contractor's ability to provide operationally critical support; and
  - (2) Other Government stakeholders for lawful Government activities, including cybersecurity for the protection of Government information or information systems, law enforcement and counterintelligence (LE/CI), and other lawful national security activities directed against the cyber threat (e.g., those attempting to infiltrate and compromise information on the contractor information systems).
- (c) **Modify eligibility criteria to permit greater participation in the voluntary DIB CS Program.**

## Notes

### Amendments

[80 FR 59584, Oct. 2, 2015, as amended at 81 FR 68317, Oct. 4, 2016; 89 FR 17747, Mar. 12, 2024]

### Authority

Authority: 10 U.S.C. 391, 393, and 2224; 44 U.S.C. 3506 and 3554; 50 U.S.C. 3330.

### Source

Source: 80 FR 59584, Oct. 2, 2015, unless otherwise noted.

### Amendments

[80 FR 59584, Oct. 2, 2015, as amended at 81 FR 68317, Oct. 4, 2016; 89 FR 17747, Mar. 12, 2024]