Kristopher Dykstra brought a Bivens1 action against the United States Bureau of Prisons alleging that prison officials violated his rights under the Eighth Amendment. He also sued under the Federal Tort Claims Act (FTCA), 28 U.S.C. § 1346(b) (1994), claiming that prison officials 1) were negligent in failing to protect him from an assault, and 2) were negligent in treating his post-traumatic stress disorder (PTSD). The District Court dismissed Dykstra’s Eighth Amendment claim. Next, the court dismissed Dykstra’s claim that prison officials were negligent in failing to protect him from an assault, concluding that the discretionary function exception to the FTCA, 28 U.S.C. § 2680(a) (1994), barred the claim. The case proceeded to a bench trial on the remaining claim that officials at six correctional facilities to which Dykstra had been sent were negligent in treating his PTSD. The District Court found that officials in one facility were negligent, but that Dykstra was contributorily negligent, thus precluding any recovery. The court found that none of the other correctional facilities was negligent.
Dykstra appeals, arguing that the District Court erred in dismissing under the discretionary function exception his FTCA claim that prison officials were negligent in failing to protect him from an assault. He also asserts that the District Court’s findings regarding his PTSD treatment are clearly erroneous.2 We affirm.
I.
Dykstra pleaded guilty to bank robbery. Prior to his sentencing, Dykstra was sent to *794the United States Medical Center for Federal Prisoners (USMCFP) in Springfield, Missouri, for a mental evaluation. William Bennett, a counselor, performed Dykstra’s intake interview. Dykstra was twenty-one at the time but purportedly looked somewhat younger. Dykstra claims that Bennett never mentioned that Dykstra’s youthful appearance might make him vulnerable to attack if he were not placed in protective custody.3 Bennett informed Dykstra that, because Dykstra had not yet been sentenced, he could request protective custody. Bennett, however, told Dykstra that he could instead work, which would help pass the time. To be eligible for work, Dykstra signed a waiver, wherein he waived his option to be placed in protective custody. The waiver indicated that it was revocable at any time. Several days after he was admitted to his housing unit, Dykstra claims he told a correctional officer that another inmate had been staring at him.4 Dykstra did not identify the other inmate to the correctional officer. The officer told Dykstra to let him know if there was any problem. Later, inmate Robert Jackson sexually assaulted Dykstra. As a result of the sexual assault, Dykstra developed PTSD.
After the assault, Dykstra was transferred several times. From USMCFP, officials transferred Dykstra to a correctional facility in Talladega, Alabama. Upon his arrival, Dykstra met once with a psychologist. Despite their knowledge of the assault that had taken place at USMCFP, Talladega prison officials did not follow up with Dykstra after the initial psychologist’s meeting to inquire whether Dykstra wanted to continue therapy. On the other hand, Dykstra exhibited no PTSD symptoms and did not ask for therapy. Dykstra began suffering from severe kidney problems and was transferred to a correctional facility in Carville, Louisiana.
At Carville, Dykstra saw a psychologist at intake and indicated that he wanted treatment. Carville officials encouraged Dykstra to return to psychology services as needed for counseling, but Dykstra never sought counseling at that facility. Dykstra continued to experience kidney problems. From Carville, Dykstra was sent to a medical center for federal prisoners in Rochester, Minnesota.
At Rochester, Dykstra exhibited symptoms of PTSD and asked to see a psychologist. His request was honored within two days. Dykstra began psychotherapy sessions with a psychologist and was seen twice by a psychiatrist. After his kidney condition improved, he was transferred to a prison camp in Marion, Illinois.
At Marion, Dykstra was provided the opportunity to meet regularly with a counseling intern. Dykstra met with the intern on a weekly basis, but discontinued the sessions because he claims he found them unhelpful. Dykstra testified that he recalled requesting medication from the prison psychologist, but that the doctor never responded to his request. While at Marion, Dykstra left the prison camp for a rendezvous with his girlfriend. They met in a motel room located in a nearby town, and Dykstra returned to camp a few hours later. Because of this misconduct, Dykstra was housed at the Williamson County Jail for a brief period and then transferred to a correctional facility in Sandstone, Minnesota.
At Sandstone, Dykstra was seen multiple times, both by psychiatrists and psychologists. The doctors monitored Dykstra’s medication and consulted with him periodically. During this time, Dykstra was getting into disciplinary trouble and, as a result, was again transferred, this time to a correctional facility in Pekin, Illinois.
Upon Dykstra’s arrival at Pekin, the psychology department did an initial screening and discontinued his medication. The medication was restarted several weeks later. Thereafter, Dykstra complained about his medications. Each request for a change in *795medication was honored by the prison psychologist.
II.
Dykstra first contends that the District Court erred in dismissing his claim that prison officials at USMCFP were negligent in failing to protect Dykstra from a sexual assault. We review de novo a district court’s grant of a motion to dismiss under the discretionary function exception to the FTCA. See Tracor/MBA, Inc. v. United States, 933 F.2d 663, 665 (8th Cir.1991).
We begin with the fundamental rule that the United States cannot be sued without a waiver of its sovereign immunity. See United States v. Orleans, 425 U.S. 807, 814, 96 S.Ct. 1971, 1975-76, 48 L.Ed.2d 390 (1976). The FTCA waives sovereign immunity and allows suits against the United States for personal injuries caused by governmental employees acting within the scope of their employment. See 28 U.S.C. § 1346(b). The FTCA does not waive immunity, however, when a claim is “based upon the exercise or performance or the failure to exercise or perform a discretionary function or duty on the part of a federal agency or an employee of the Government, whether or not the discretion involved be abused.” Id. § 2680(a). This discretionary function exception to the FTCA “marks the boundary between Congress’ willingness to impose tort liability upon the United States and its desire to protect certain governmental activities from exposure to suit by private individuals.” United States v. S.A Empresa de Viacao Aerea Rio Grandense (Varig Airlines), 467 U.S. 797, 808, 104 S.Ct. 2755, 2761-62, 81 L.Ed.2d 660 (1984). To the extent an alleged act falls within the discretionary function exception, a court lacks subject matter jurisdiction. See Jurzec v. American Motors Corp., 856 F.2d 1116, 1118 (8th Cir.1988).
The Supreme Court has developed a two-step test to determine whether the discretionary function exception applies, thereby barring the claim. See Berkovitz v. United States, 486 U.S. 531, 536-37, 108 S.Ct. 1954, 1958-59, 100 L.Ed.2d 531 (1988). For the exception to apply, the first step requires that the challenged governmental action be the product of “judgment or choice.” United States v. Gaubert, 499 U.S. 315, 322, 111 S.Ct. 1267, 1273, 113 L.Ed.2d 335 (1991) (quoting Berkovitz, 486 U.S. at 536, 108 S.Ct. at 1958-59). Under this step, we must determine whether a statute, regulation, or policy mandates a specific course of action. If such a mandate exists, the discretionary function exception does not apply and the claim may move forward. When no mandate exists, however, the governmental action is considered the product of judgment or choice (i.e., discretionary), and the first step is satisfied. The second step requires that the judgment or choice be based on “considerations of public policy.” Id. at 323, 111 S.Ct. at 1274 (quoting Berkovitz, 486 U.S. at 537, 108 S.Ct. at 1959). Under this step, we determine whether the judgment is grounded in social, economic, or political policy. If the judgment of the governmental official is based on any of these policy considerations, then the discretionary function exception applies and the claim is barred.
Dykstra bases his negligence claim on two decisions made by prison officials. The first was counselor Bennett’s decision not to inform Dykstra that his youthful appearance placed him at risk if he were not placed in protective custody. The second was the correctional officer’s decision not to place Dykstra in protective custody or to take any other action when Dykstra told the officer a fellow inmate had been staring at him. We examine each in turn.
With respect to counselor Bennett’s decision, Dykstra claims that prison regulations require prison personnel to obtain an informed waiver of protective custody. Dykstra argues that, because a specific course of action was mandated, Bennett was in violation when he failed to warn Dykstra that his youthful appearance made him vulnerable to attack. Significantly, however, Dykstra points to no regulation that required a warning by Bennett in this situation. No regulatory mandate exists, so we move to the second step.
When established policy allows governmental agents to exercise discretion, “it *796must be presumed that the agent’s acts are grounded in policy when exercising that discretion.” Gaubert, 499 U.S. at 324, 111 S.Ct. at 1274. Dykstra must rebut this presumption. Dykstra has failed, however, to allege any facts establishing that Bennett’s decision was not grounded in policy considerations. We therefore presume the decision was based on public policy considerations. The discretionary function exception to the FTCA applies to Bennett’s decision to not warn Dykstra.
With respect to the correctional officer’s decision to take no action on the basis of Dykstra’s statement that another inmate had been staring at him, there is no regulation that mandates a specific course of action in such circumstances. Dykstra did not specifically name an inmate, nor did he mention any threats, so there was nothing to cause the officer to take any particular action, and the applicable regulations grant to the prison officials broad discretion in determining whether to place an inmate in protective custody:
The Warden may ... place an inmate in [protective custody] when the inmate’s continued presence in the general population poses a serious threat to life, property, self, staff, other inmates or to the security or orderly running of the institution and when the inmate ... [requests admission to [protective custody] for the inmate’s own protection, or staff determines that admission to ... [protective custody] is necessary for the inmate’s own protection (see § 541.23).
28 C.F.R. § 541.22(a) (1997). Section 541.23 provides that “[s]taff may consider ... as protection eases ... [i]nmates about whom staff has good reason to believe the inmate is in serious danger of bodily harm.” Id. § 541.23(a). There is no mandatory language in the regulations. To the contrary, the use of the term “may” in the regulations imports discretion. See Calderon v. United States, 123 F.3d 947, 949-50 (7th Cir.1997) (holding that discretionary function exception applied where prisoner had told at least four officers about another inmate’s overt threats).
Because the regulations expressly grant discretion, we presume the prison officials’ actions are grounded in public policy. See Gaubert, 499 U.S. at 324, 111 S.Ct. at 1274-75. Dykstra asserts, “There is no claim by the United States that a policy decision was made not to respond to a threat.” Appellant’s Brief at 20. But it is Dykstra, not the United States, who must assert facts that show the decision was not based on policy considerations; he has not done so, and probably could not succeed in doing so in any event. Prison officials supervise inmates based upon security levels, available resources, classification of inmates, and other factors. These factors upon which prison officials base such decisions are inherently grounded in social, political, and economic policy. We have no difficulty in concluding that the discretionary function exception applies to the correctional officer’s decision not to place Dykstra in protective custody or to take other protective action.
We now turn to Dykstra’s final issue on appeal. The District Court entered judgment in favor of the government on Dykstra’s claim that prison officials negligently treated his PTSD. The court found that the Talladega facility was negligent in treating Dykstra’s PTSD, but that Dykstra was contributorily negligent, thus barring recovery under Alabama law.5 The court found none of the other facilities was negligent. We review a district court’s findings of negligence vel non under the clearly erroneous standard. See Davis v. Liberty Mut. Ins. Co., 55 F.3d 1365, 1367 (8th Cir.1995). A finding is clearly erroneous if it is not supported by substantial evidence. See Norwest Capital Management & Trust Co. v. United States, 828 F.2d 1330, 1335 (8th Cir.1987).
*797There was substantial evidence for the District Court to find as it did. Regarding Dykstra’s treatment at Talladega, the court found both parties to be negligent. Despite being aware of the assault Dykstra had suffered, prison officials did not follow up with him or otherwise advise him of the availability of psychiatric services. On the other hand, Dykstra did not request treatment or even complain to prison officials about his PTSD. Neither of the District Court’s findings is clearly erroneous.
The court’s finding that none of the other correctional facilities was negligent in treating Dykstra’s PTSD was also supported by substantial evidence. At Carville, Dykstra did not complain about any PTSD symptoms, nor did he receive any treatment. But unlike officials at the Talladega facility, prison officials at Carville encouraged Dykstra to seek psychological help. At Rochester, Dykstra requested psychological services for the first time. Within two days, Dykstra met with a psychologist and continued therapy sessions until his departure from Rochester. At Marion, Dykstra received counseling from a psychological intern until Dykstra himself terminated the sessions. At Sandstone, an intake evaluation noted that Dykstra’s symptoms were not acute and that there was no reason to treat him on an emergency basis. Dykstra was seen at least seven times while at Sandstone and his medications were adjusted there. At Pekin, officials discontinued Dykstra’s medications but restarted them at his request without delay. Pekin officials gave Dykstra a variety of medications, but Dykstra decided they were unhelpful and discontinued their use. The District Court’s finding that none of these correctional facilities was negligent is not clearly erroneous.
III.
We hold that the discretionary function exception to the PTCA bars Dykstra’s claim that prison officials were negligent in failing to protect him from the assault and therefore affirm the District Court’s dismissal of that claim. We also affirm the District Court’s judgment in favor of the United States on Dykstra’s claim that prison officials were negligent in treating his PTSD.