A supplier forwards a TLP:AMBER briefing to its entire operations mailing list. Is that permitted? Only if everyone receiving it is within the allowed audience and needs it to protect the organisation or its clients. A familiar mailing list is not evidence of need-to-know. Check the source’s restrictions before forwarding.
Traffic Light Protocol explained: what TLP is for, and what it isn’t
TLP states who may receive information onward. It is not a security classification and does not replace sensitivity, handling, privacy or access rules. A document can carry both a classification and a TLP marking. The source sets the sharing boundary; ask that source before widening it.
The protocol was built for threat intelligence and incident sharing between organisations — CERTs, ISACs, sector coordination groups — where a source needs to hand over something useful without losing control of who sees it next. It has since spread into general use inside single organisations, sharing internal security reporting, incident detail and vulnerability information, because the same problem exists there: people don’t know if they’re allowed to pass something on.
Four colours, including the AMBER+STRICT restriction
The current version of the protocol, TLP 2.0, published by FIRST (the Forum of Incident Response and Security Teams) in 2022, defines four colours. AMBER also has a stricter variant.
| Label | What it permits | Typical use |
|---|---|---|
| TLP:RED | No further disclosure. Limited to the named recipients in the room or on the distribution, not to be shared more broadly even inside your own organisation. | A live incident detail discussed on a call, an active exploit against a named target |
| TLP:AMBER | Share within the recipient’s organisation and with its clients who need the information to protect themselves. The need-to-know restriction still applies. | A vulnerability bulletin sent to member organisations of an ISAC |
| TLP:AMBER+STRICT | Need-to-know sharing within the recipient’s organisation only. Clients and other outside recipients require the source’s permission. | The same bulletin, sent to an organisation the source doesn’t want redistributing it downstream |
| TLP:GREEN | Limited disclosure, restricted to the community or sector the information was shared within. Not for public release. | A sector-wide threat trend briefing |
| TLP:CLEAR | No restriction on disclosure, subject to standard copyright rules. Replaced TLP:WHITE in the 2022 revision. | A public advisory once cleared for release |
Marking it correctly
- State the label before the content, not after. Subject line:
TLP:AMBER — <subject>. Verbally, at the start of a briefing: “everything from here is TLP:AMBER.” - Mark every artefact independently. An email body, its attachment, and any extract copied into a ticket each need their own marking. A TLP:AMBER attachment inside an unmarked email is a common failure point.
- Never upgrade or downgrade a label you didn’t originate without asking the source. If you need to share more broadly than the label allows, ask first.
- Carry the marking forward when you summarise or quote the source, even if you’ve reworded it. Paraphrasing doesn’t strip the restriction.
- When originating information, identify who needs to act and choose the narrowest sharing boundary that allows that. If the permitted audience is unclear, clarify it before distributing the material.
Worked example
A three-site logistics firm receives a TLP:AMBER bulletin from its state ISAC describing a vulnerability in a fleet-tracking vendor’s software. The security manager can:
- Forward it to the internal engineering team responsible for patching, on a need-to-know basis — permitted under AMBER.
- Include a summary in a risk note to executives who need it for protection or action — permitted on that need-to-know basis. The summary must retain the applicable restrictions; paraphrasing does not remove them.
She cannot:
- Post it to the company’s general IT Slack channel where every staff member can read it — that exceeds “need-to-know.”
- Forward it unmodified to the fleet-tracking vendor’s competitor, even if the competitor asks nicely — that recipient is not automatically within AMBER’s permitted organisation-and-client audience. Obtain the source’s permission; GREEN would still require the recipient to belong to the intended community.
Adopting TLP inside a single organisation
TLP was built for information moving between organisations, but there’s nothing stopping a single organisation adopting it for internal use, and many do — particularly for incident response communications and board or executive papers on live security matters. The value is the same one it was designed for: a shared, unambiguous instruction for how far something can travel, attached at the point it’s created rather than worked out later by whoever happens to be holding it.
The risk in adopting it internally is over-formalising something that was meant to be lightweight. If every internal email ends up needing a TLP label and a sign-off before it can be sent, staff will route around it. Keep the scope narrow to start: incident response traffic, security committee papers, and anything currently being handled by informal rules like “don’t forward this” that nobody has written down. Expand it only once people are using it correctly in that smaller scope.
Common mistakes
- Stamping everything TLP:AMBER by default. It becomes noise, and staff stop reading the label at all.
- Marking the email but not the attachment, or marking the slide deck but not the recording of the meeting where it was presented.
- Reclassifying received information without checking with the originator, particularly loosening a TLP:RED item because it feels like old news.
- Assuming TLP is only a document control. It applies to what you say out loud in a briefing just as much as to what’s written down.
For the authoritative definitions, consult FIRST’s current TLP standard and usage guidance.
Free working resource
Keep the sharing rules where people use them
The TLP Toolkit ZIP contains three print-ready PDFs: an A3 wall chart, an A4 wall chart and an A4 one-page practitioner guide. They cover RED, AMBER, AMBER+STRICT, GREEN and CLEAR, with marking and handling guidance.
Download the free TLP charts and guide
Opens the SRMBOK product page. Add the free item to your cart and complete the $0 order to receive the download. Check the newsletter choice at checkout.