FIRST TLP 2.0 documentation page. — Screenshot: FIRST, TLP 2.0 documentation stating that TLP labels mark sharing boundaries and are not a formal classification scheme (fair use).

Did You Know: TLP Labels Limit Sharing Scope, Not Severity

FIRST's Traffic Light Protocol version 2.0 uses four labels, TLP:RED, TLP:AMBER, TLP:GREEN, and TLP:CLEAR, to mark how far recipients may share potentially sensitive information. FIRST states that TLP is not a formal classification scheme. A TLP label answers who may see the tip; it does not set alert severity, CVSS, or triage priority.

Priya Shah, Threat IntelSingaporeOctober 21, 20263 min read

SINGAPORE - Traffic Light Protocol labels and severity scores answer different questions. On the public FIRST TLP documentation site, version 2.0 of the FIRST Standards Definitions and Usage Guidance is the current standard, authoritative from August 2022. FIRST defines TLP as a set of four labels that indicate the sharing boundaries recipients must apply. The labels are TLP:RED, TLP:AMBER, TLP:GREEN, and TLP:CLEAR. In written form they must not contain spaces and should be capitalized. FIRST also states the design limit in clear terms: TLP provides a simple schema for indicating with whom potentially sensitive information can be shared. TLP is not a formal classification scheme.

FIRST TLP usage guidance and color-coding table. — Screenshot: FIRST, TLP usage guidance and color codes for TLP:RED, TLP:AMBER, TLP:GREEN, and TLP:CLEAR (fair use).

The definitions map to disclosure scope, not urgency. TLP:RED is limited to the individual recipients present, with no further disclosure. TLP:AMBER allows need-to-know sharing inside the recipient organization and its clients. When the source wants organization-only circulation, FIRST requires TLP:AMBER+STRICT. TLP:GREEN may move among peers and partner organizations inside a community, but not through publicly accessible channels. TLP:CLEAR has no disclosure limit, subject to ordinary copyright and public-release rules. FIRST's August 2022 newsroom release notes that TLP:WHITE became TLP:CLEAR in version 2.0 and that TLP:AMBER+STRICT was added for organization-only restriction. None of those colors is a substitute for the severity field on an alert, the priority on an incident ticket, or a vulnerability score.

FIRST TLP-SIG page. — Screenshot: FIRST, TLP-SIG page on governing the standard and TLP 2.0 adoption (fair use).

SOCtember diagram separating what TLP controls from what it does not set. — Illustration: SOCtember, what TLP controls (sharing) versus what it does not set (severity, priority), paraphrased from FIRST TLP 2.0.

For a Threat Intel desk handing tips into detection and response, the operational takeaway is practical. Respect the source's sharing boundary, including any extra restrictions FIRST says the source may attach. If analysts need to circulate a tip more widely than the label allows, FIRST requires explicit permission from the source first. Separately, set severity and response priority from evidence, impact, and your own playbooks. Mixing those jobs, treating TLP:RED as "critical" or TLP:CLEAR as "informational," collapses a sharing protocol into a triage score it was never built to be.

SOCtember diagram of the four TLP 2.0 labels and their relative sharing scope. — Illustration: SOCtember, four TLP 2.0 labels and relative sharing scope, paraphrased from FIRST definitions.

Sources:

Priya Shah covers threat intelligence sharing and adversary tradecraft for SOCtember from Singapore.

Did You Know: TLP Labels Limit Sharing Scope, Not Severity

Sources:

Related stories

Untuned Alerts Can Hide Active Intrusions From the SOC

Did You Know: Patching a KEV Host Before Collecting Evidence Can Erase the Intrusion Trail