Traffic Light Protocol (TLP).

How Does the Traffic Light Protocol Work?

Information sharing goes from a source to one or more recipients. The source puts a TLP label on the information, and the recipient follows the sharing limit that the label describes. TLP was created to make it easier to share potentially sensitive information and to collaborate more effectively.

The label goes directly before the information in a message, and in the header and footer of each page in a document. In email, the label should be in the subject line. If a recipient needs to share more widely than the label allows, they must ask the source for explicit permission.

What Do the TLP Labels Mean?

FIRST describes TLP version 2.0 as the current version, authoritative from August 2022. It defines four labels:

• TLP:RED: for the eyes and ears of individual recipients only, with no further disclosure.
• TLP:AMBER: limited disclosure. Recipients may share it on a need-to-know basis within their organization and its clients. TLP:AMBER+STRICT limits sharing to the organization only.
• TLP:GREEN: limited disclosure. Recipients may share it with peers and partner organizations in their community, but not through publicly accessible channels.
• TLP:CLEAR: recipients may share it with the world, with no limit on disclosure, subject to standard copyright rules.

In written form, labels contain no spaces and should be in capital letters. They stay in their original form, even when the text around them is translated.

Why Does TLP Matter for Threat Intelligence?

Threat intelligence helps defenders when people are willing to share it, and some of it is sensitive: it can touch a victim’s privacy, reputation or operations. A shared label removes guesswork. The source says what is allowed, and the recipient knows the limit without a long conversation.

A label does not stop a leak by itself. The standard states that TLP is not a formal classification scheme, and it was not designed to handle licensing terms, information handling rules or encryption. The source also stays responsible for making sure recipients understand how to follow the label.

How Do You Use TLP in Practice?

• Label every report, email and chat message with the right TLP level before it leaves your team.
• Pick the least restrictive label that still protects the people involved, and say if you add extra sharing limits.
• Define who “community” and “organization” mean for your group, so recipients do not have to guess.
• Keep the label exactly as written, in capitals, with no spaces.
• Ask the source before sharing anything beyond what the label allows.

In Brandefense Atlas reports, company-specific reports carry TLP:AMBER and public catalogue reports carry TLP:CLEAR. FIRST maintains TLP, and Brandefense CTI is a FIRST Associate member. Our post on joining FIRST explains what that membership is and what it is not.