Compliance Node Overview
The Traffic Light Protocol (TLP) Version 2.0, maintained by the Forum of Incident Response and Security Teams (FIRST), is the canonical four-label classification scheme for restricting the onward sharing of sensitive information in incident response and threat intelligence communities. TLP 2.0 became authoritative in August 2022, replacing TLP 1.0 by renaming TLP:WHITE to TLP:CLEAR and adding TLP:AMBER+STRICT. The four labels and their handling instructions are: TLP:RED - for the eyes and ears of individual recipients only with no further disclosure, used when information cannot be effectively acted upon without significant risk to privacy, reputation, or operations; TLP:AMBER - limited disclosure where recipients can spread only on a need-to-know basis within their organisation and its clients, used when the information requires support to be effectively acted upon but carries risk if shared outside the organisations involved; TLP:AMBER+STRICT - the same as TLP:AMBER but restricted to the organisation only and excluding clients, used when client-side onward sharing is itself a risk; TLP:GREEN - limited disclosure where recipients can spread within their community of peers and partner organisations but not via publicly accessible channels, used when information is useful to increase awareness within their wider community; TLP:CLEAR - recipients can spread to the world with no limit on disclosure, used when the information carries minimal or no foreseeable risk of misuse in accordance with applicable rules and procedures for public release. TLP labels are applied at the sender's discretion and operate by convention and trust within FIRST member communities, ISACs, ISAOs, CERTs, ISACs, and the wider CTI ecosystem. TLP markings are embedded in STIX 2.1 as marking-definition objects referenced via object_marking_refs and granular_markings. TLP 2.0 is openly available at first.org/tlp/ and is the operative version; TLP 1.0 documents should be migrated to TLP 2.0 vocabulary and labels.
Pillar: Cybersecurity · Authority: FIRST (Forum of Incident Response and Security Teams) · Version: 1.0.0 · Last updated:
Primary source: https://www.first.org/tlp/
SHA-256 integrity: c1715f7d4567d53c3557b72d5f53e9f3a1de2a056ac77a3d7b80417fd88fcbc3
Primary Citations — 7 traced to source
- FIRST Traffic Light Protocol Version 2.0, Forum of Incident Response and Security Teams, authoritative since August 2022, published at first.org/tlp/; replaces TLP 1.0 by renaming TLP:WHITE to TLP:CLEAR and adding TLP:AMBER+STRICT.
- TLP:RED handling: 'For the eyes and ears of individual recipients only, no further disclosure.' Sources employ this when 'information cannot be effectively acted upon without significant risk for the privacy, reputation, or operations of the organizations involved.'
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access