TLP: what the Traffic Light Protocol means

In short

Whoever writes a document, an advisory or an email labels it with TLP: followed by the colour, clearly visible at the top. The colour does not say how "secret" the information is in a general sense: it says how far it may travel. It is the common language of CSIRTs, SOCs, security vendors and authorities when they exchange details about vulnerabilities and incidents.

The labels in version 2.0

Version 2.0 has been in force since August 2022. Compared with the previous version, it renamed TLP:WHITE to TLP:CLEAR and added TLP:AMBER+STRICT, to distinguish what must not leave the organisation. Older documents still carry the version 1.0 labels.

Why it matters

During an incident, sensitive information is exchanged: indicators of compromise, vulnerabilities not yet fixed, names of affected systems. Without a clear rule, either nothing is shared out of caution, or too much is shared. TLP resolves the dilemma with a simple rule, written on the document itself. In management systems it is also a sign of maturity: classified procedures and reports show the auditor that the company knows who should read what.

TLP does not replace the internal information classification required by ISO/IEC 27001, nor contractual confidentiality obligations: it works alongside them, in a language that is understood outside the company too.

Example

While handling a ransomware incident, a company's CSIRT receives from its security provider a report marked TLP:AMBER+STRICT with the addresses used by the attackers. The IT contact can pass it to the colleague who manages the firewall, but not to the supplier of the management software. When the analysis is complete, the provider publishes a reduced version of the report as TLP:GREEN for the other companies in the industry, which can then look for the same indicators in their own logs.

Related terms

• Threat intelligence
• CSIRT
• Statement of Applicability (SoA)
• Indicators of compromise (IoC)