What is the Traffic Light Protocol?
The Traffic Light Protocol (TLP) is a small set of labels that tells the recipient of sensitive information how far they may share it. The source picks a color before sending an advisory, an indicator list or a briefing, and everyone who receives it follows that limit. FIRST, the global Forum of Incident Response and Security Teams, maintains the standard. The current version, TLP 2.0, was published in 2022 and is used by ISACs, CERTs, government agencies and security vendors.
The five labels
| Label | Who may receive it |
|---|---|
| TLP:RED | Only the individuals it was given to, such as the attendees of one meeting; no further sharing |
| TLP:AMBER+STRICT | The recipient's own organization only, on a need-to-know basis |
| TLP:AMBER | The recipient's organization and its clients, on a need-to-know basis |
| TLP:GREEN | The wider community, such as peer organizations, but not public channels |
| TLP:CLEAR | Anyone; no limit on disclosure |
TLP 2.0 renamed the old TLP:WHITE to TLP:CLEAR and added TLP:AMBER+STRICT for material that clients should not see. Labels are written in capitals with no spaces, as in TLP:AMBER+STRICT.
Using TLP correctly
The label goes where the reader sees it before the content: in an email's subject line and just before the information in the body, or in the header and footer of every page of a document. In machine-readable sharing, STIX objects can carry TLP markings so that platforms can filter what they forward. Only the source can loosen a label. A recipient who needs to share more widely than the color allows asks the source for permission rather than deciding alone.
TLP is an agreement between people, not a technical control. Nothing prevents someone from forwarding a TLP:RED email except trust and the consequences of breaking it, such as losing membership in a sharing community. It is also not a classification scheme like government secrecy levels or a company's data labels, and it does not override legal obligations. It simply sets expectations for onward sharing.
An example decision
A hospital's security team receives an ISAC alert labeled TLP:AMBER+STRICT about a ransomware group exploiting a particular remote access product. The team can brief its own IT and incident response staff who need to act on it. It cannot forward the alert to a partner clinic, and it cannot post it on a public forum. Had the alert been TLP:GREEN, the team could share it with other hospitals in its region, but it still could not publish it on a blog or social media.
TLP vs. related terms
- Data classification labels such as Confidential or Restricted describe how an organization protects its own data; TLP describes how far shared intelligence may travel.
- An NDA is a legal contract; TLP is a lightweight convention that may sit on top of one.
- STIX and TAXII describe and move intelligence; TLP labels it.
Traffic Light Protocol on the CompTIA Security+ exam
TLP is taught with threat intelligence sharing under SY0-801 objective 2.1, which covers where threat information comes from and how it is shared. The acronym is not on the SY0-801 acronym list. Wording such as "may be shared only within the recipient's organization", "label how widely shared information may be redistributed" or "no restrictions on disclosure" points to TLP, and a question may ask you to match a color to the limit described. Distractors include data classification levels, STIX, TAXII and an NDA.