TLP 2.0 in Practice: Which Sharing Label Should You Use?
Choose TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, or TLP:RED from the source's intended sharing boundary.
TLP tells recipients how far information may be shared. It does not say whether the information is true, secret, encrypted, or safe to store. FIRST’s current standard is TLP version 2.0, authoritative since August 2022.
The source selects the least restrictive label that still protects the people, operations, relationships, or investigations at risk. If the boundary is unclear, clarify it before sharing.
Match the Label to the Audience
Use TLP:CLEAR for unlimited distribution, subject to ordinary rights. Use TLP:GREEN for a defined community but not public channels. Use TLP:AMBER for need-to-know sharing within recipients’ organizations and their clients; use TLP:AMBER+STRICT for the recipient organization only. Use TLP:RED for the individual recipients in that exchange.
Write labels exactly and keep them on excerpts and attachments.
Add Controls TLP Does Not Provide
State the source, contact, reason, audience, expiry or review, and any privacy, legal, contractual, or operational restrictions. Separate differently labeled material when possible; the most restrictive part can otherwise constrain the whole package.
Before onward sharing, check the original label and whether the recipient fits its boundary. Ask the source when in doubt.
Correct Mistakes Through the Source
If information was mislabeled or overshared, stop further distribution, notify the source and responsible handling owner, identify recipients, and follow incident or privacy procedures. Request a corrected copy rather than editing history silently.
Use threat intelligence sharing guidance to decide whether sharing is useful before choosing its boundary.
Frequently asked questions
Is TLP a data classification scheme?
No. TLP indicates permitted sharing boundaries; classification, sensitivity, storage, and legal controls may still apply separately.
Can a recipient change a TLP label?
Recipients should not change it unilaterally; ask the source for permission or a relabeled version.
What is TLP:AMBER+STRICT?
It limits sharing to the recipient organization, while TLP:AMBER permits limited need-to-know sharing with the recipient's organization and clients.
Can TLP:RED be forwarded to a colleague?
It is limited to individual recipients and normally should not be shared beyond the specific exchange without source permission.
Does TLP:CLEAR remove copyright or privacy duties?
No. It permits broad distribution but does not override copyright, privacy, contract, law, or other restrictions.
