Description of the Traffic Light Protocol (TLP)

When communicating and exchanging information, CSIRT teams follow the so-called TLP (Traffic Light Protocol), which uses four colors to indicate different degrees of sensitivity of information and the appropriate ways to share that information. Using TLP version 2.0 looks like this:

TLP: RED – non-public information to which only authorized persons have access and cannot be further disseminated. It is normally used for information that cannot be effectively used without significant risk to the confidentiality, reputation and functioning of the organizations involved. It is not allowed to discuss this information in the presence of third parties.

TLP: AMBER - information can only be made available to persons participating in the exchange of information and persons within the organization and its constituents, on a "need to know" basis.

TLP: AMBER+STRICT - is used to indicate information that can only be shared within the receiving organization.

TLP: GREEN – information that can be shared with other organizations or individuals within the wider community or sector, but is not suitable for dissemination through publicly accessible communication channels, such as Web page.

TLP: CLEAR - information intended for the public, the distribution of which is not restricted. However, it is necessary to respect copyright when using them.