Use TLP 2.0 to preserve the sharing boundary of incident information

Source facts: TLP expresses a source’s sharing boundary

The Forum of Incident Response and Security Teams publishes Traffic Light Protocol Version 2.0 as the current TLP standard, authoritative from August 2022. TLP helps a source indicate how recipients may share potentially sensitive information. The four valid labels are TLP:RED, TLP:AMBER, TLP:GREEN, and TLP:CLEAR. Written labels contain no spaces, should use capitals, and remain unchanged when the surrounding content is translated.

TLP:RED is limited to the individual recipients in the specific exchange, meeting, or conversation. TLP:AMBER permits limited sharing within recipients’ organizations and with clients who need the information to protect themselves or prevent further harm; the source may use TLP:AMBER+STRICT to limit sharing to the recipient organization. TLP:GREEN may be shared within a community, but not through publicly accessible channels. TLP:CLEAR carries no distribution limit, subject to ordinary copyright rules.

FIRST states that TLP is not a formal classification scheme and was not designed to specify licensing, encryption, or information-handling requirements. It does not override applicable law or regulation. The source may change a label, and a recipient who needs broader distribution should seek explicit permission rather than reinterpret the marking.

DSE recommendation: adopt the standard without inventing extra colors

Publish a short organizational procedure that uses the exact Version 2.0 labels and definitions. Define who may originate a marking, which default—if any—applies when a trusted source omits one, and how recipients request clarification. Do not create labels such as “TLP:BLUE” or use the retired “TLP:WHITE”; local handling categories should be named separately so partners do not mistake them for TLP.

Teach senders to choose the least restrictive label that safely enables action. Overmarking can prevent a defender from warning an affected provider or customer; undermarking can expose victims, investigative methods, personal information, or response plans. Record the intended audience and reason when the distinction matters.

DSE recommendation: make markings survive operational tools

1. Place the label visibly. Mark the beginning of written material and, where practical, headers, footers, subject lines, meeting notices, ticket fields, and exported reports.
2. Preserve source markings. Forward, quote, summarize, translate, or transform information only within the original boundary and keep the label associated with the derived material.
3. Control mixed content. If a report combines differently marked sources, separate the sections or apply a boundary that does not disclose the more restricted information. Do not silently downgrade.
4. Add handling rules separately. State encryption, approved channels, retention, deletion, attribution, privilege, regulatory, export, or need-to-know requirements outside the TLP label.
5. Prepare re-marking. Maintain a reachable source contact and a quick mechanism to approve broader sharing when circumstances change.

DSE recommendation: rehearse the boundary before an urgent incident

Use an exercise that requires responders to share indicators with internal operations, outside counsel, an insurer, a technology provider, an affected customer, a sector peer, and the public. Ask who is permitted under each label, what additional authorization is needed, and whether collaboration tools preserve the marking. Include meetings and verbal disclosures, not only email.

When information is received, log the source, label, receipt time, authorized audience, later permissions, and any disclosed recipients where risk warrants it. If a recipient believes law, safety, or another binding duty requires disclosure beyond the marking, escalate promptly to the appropriate authority rather than improvising.

Review misdirected messages, label questions, blocked warnings, and unauthorized redistribution after incidents and exercises. The goal is not to decorate every message. It is to give useful information a clear, shared boundary that supports timely defense while respecting the source and affected parties.

Official references

• Forum of Incident Response and Security Teams, FIRST Standards Definitions and Usage Guidance—Traffic Light Protocol Version 2.0, authoritative from August 2022; reviewed August 11, 2026.