Glossary
Traffic Light Protocol (TLP)
A labelling scheme (TLP:RED, AMBER, GREEN, CLEAR) that tells recipients how widely they may share sensitive information.
The Traffic Light Protocol (TLP) is a set of labels used to indicate how sensitive information may be shared. It is maintained by FIRST (the Forum of Incident Response and Security Teams); version 2.0 is the current standard.
The four labels are:
- TLP:RED: for the eyes and ears of individual recipients only, no further disclosure;
- TLP:AMBER: limited disclosure, recipients may share with members of their own organisation and its clients on a need-to-know basis (TLP:AMBER+STRICT restricts sharing to the organisation only);
- TLP:GREEN: limited disclosure, recipients may share within their community but not publicly;
- TLP:CLEAR: no restriction on disclosure, subject to standard copyright rules.
In tabletop programmes, TLP is useful for labelling scenario packs (so players don't see them in advance), for after-action reports that describe weaknesses, and for threat-intelligence material used as injects. See writing the after-action report.