Traffic Light Protocol (TLP)
Definition
A standardised colour-coded scheme for marking intelligence sharing restrictions. TLP:RED is for named recipients only; TLP:AMBER is for members' organisations; TLP:GREEN is for the wider community; TLP:CLEAR (formerly TLP:WHITE) is unrestricted.
- TLP:RED
- Named recipients only
- TLP:AMBER
- Members' organisations
- TLP:GREEN
- Wider community
- TLP:CLEAR
- Unrestricted (formerly TLP:WHITE)
Common questions
Why was TLP:WHITE renamed to TLP:CLEAR?+
The industry-wide rename moved away from a colour term carrying unrelated connotations while keeping the exact same meaning: unrestricted disclosure of the marked information.
What happens if a TLP:AMBER item is shared outside the intended organisation?+
It breaches the sharing agreement the recipient accepted on receipt, which can damage trust between parties and jeopardize the recipient's future access to intelligence from that source.
Related terms
- IoC (Indicator of Compromise)
- Observable artefact linked to malicious activity. File hashes (MD5, SHA-256, ImpHash, ssdeep, TLSH), IPs, domains, URLs, registry keys, mutex names, named pipes,...
- ISAC (Information Sharing and Analysis Center)
- A sector-specific membership organisation that collects, analyses, and redistributes threat intelligence among its members under confidentiality agreements. Examples include FS-ISAC (financial services),...
- STIX (Structured Threat Information eXpression)
- An OASIS open standard that defines a JSON-based language for describing cyber threat intelligence. STIX 2.1 defines objects for indicators, threat actors,...
- TAXII (Trusted Automated eXchange of Indicator Information)
- An OASIS open standard that defines an HTTPS-based protocol for transporting STIX content between organisations. A TAXII server exposes collections; clients poll...
- Threat Intelligence
- Processed, analysed information about adversaries, their capabilities, and their current or anticipated activities. Includes strategic intelligence (actor motivations and trends) and tactical...