TLP labels explained: RED, AMBER, GREEN and CLEAR

The Traffic Light Protocol, or TLP, is a set of labels that tell a recipient how widely a piece of threat information may be shared. Version 2.0 has five: TLP:RED, TLP:AMBER, TLP:AMBER+STRICT, TLP:GREEN and TLP:CLEAR. The label travels with the information, so the sender controls the audience.

Who maintains it

The FIRST Traffic Light Protocol Special Interest Group governs the standard. TLP 2.0 became authoritative in August 2022, and version 1.0 was deprecated at that point. If you still see the older TLP:WHITE label, the source is using the old scheme.

The five labels

• TLP:RED: individual recipients only, no further disclosure. In a meeting, only those present.
• TLP:AMBER: your organization and its clients, on a need to know basis.
• TLP:AMBER+STRICT: your organization only. Clients are excluded.
• TLP:GREEN: peers and partner organizations in your community, but not publicly accessible channels.
• TLP:CLEAR: no limit. May be shared publicly, subject to copyright.

Practical examples

A sector group member shares details of an active intrusion marked TLP:AMBER. You may tell your own security and IT teams who need to act. You may also brief a client who is affected, if they need it. You may not post it in a public channel.

The same report marked TLP:AMBER+STRICT stays inside your company. Briefing a client would break the label.

A TLP:GREEN advisory can go to peers in the same community, such as other members of an information sharing group, but not onto a public blog.

TLP:RED is rare and personal. Treat it like a private conversation: do not forward it, and do not summarize it for the team unless they were in the room.

Handling rules worth writing down

• Put the label in the subject line and at the top of every document.
• Do not strip the label when you paste text into a ticket or chat.
• If the label is missing, ask the sender. Do not guess.
• Store labeled material where access matches the label.
• When you add your own analysis to a labeled report, keep the original label unless the source agrees to change it.

Why this matters for small teams

Trust is the currency of sharing groups. If one member leaks a restricted note, people stop sharing. Following the label exactly is how you stay invited.

Common mistakes

Forwarding an AMBER message to a client without checking whether the client needs it. Pasting a labeled item into a public issue tracker. Assuming an unlabeled message is public. Treating the label as a classification of how serious the threat is, when it only controls who may receive it.

Another mistake is mixing labels in one document. If a report has parts with different audiences, split it, or apply the most restrictive label to the whole.

Building the habit

Add the label list to your incident and intelligence templates, with the five options and the one line rule for each. People follow rules they can see at the point of use. Review a few forwarded items each quarter to check that labels were kept.

Quick check

Sources

• FIRST Traffic Light Protocol

Last reviewed: 19 October 2026.