Asked via DM (anonymized)
“I keep seeing TLP:CLEAR on your entries. What is it and do I need to care?”
The answer
TLP = Traffic Light Protocol (current version: TLP 2.0, maintained by FIRST), a labeling system for how widely information may be shared:
| Label | You may share with… |
|---|---|
| TLP:CLEAR | Anyone — no restriction |
| TLP:GREEN | The community (peers, sector), but not publicly |
| TLP:AMBER | Your organization and its clients on a need-to-know basis |
| TLP:AMBER+STRICT | Your organization only |
| TLP:RED | Named recipients only — the people in the room |
Do you need to care? Yes, the moment you share threat intel with anyone. It tells you whether forwarding that report to a vendor group chat is fine (CLEAR/GREEN) or a breach of trust that gets you cut out of sharing circles (AMBER/RED). Everything published on Rectifyq is TLP:CLEAR unless stated otherwise — share freely, credit appreciated.
Related: Rectifyq’s Style Guide · Ask your own: Tanya Rectifyq · Start Here