Process and analysis

What is Traffic Light Protocol?

A simple label set (TLP:RED, AMBER, GREEN, CLEAR) that tells recipients how widely they may share a piece of information.

The Traffic Light Protocol is a set of labels that tell recipients how far they may share information. In version 2.0, maintained by FIRST: TLP:RED is for named recipients only, TLP:AMBER for their organisation and clients on a need-to-know basis (TLP:AMBER+STRICT for the organisation only), TLP:GREEN for the wider community, and TLP:CLEAR for anyone.

TLP covers sharing, not classification or encryption. It works because it is simple and widely understood across sharing groups, vendors and governments.

Where you learn it

See Traffic Light Protocol in a real investigation

Our missions put you in front of real logs, domains and forums, with these terms underlined where they appear.

Start learning free