TLP Use Cases

FIRST has developed the seven Traffic Light Protocol (TLP) use cases below to help clarify FIRST TLP Standards Definitions and Usage Guidance. The use cases show how originators and recipients of TLP-labeled information can apply TLP usage guidance in operational scenarios. Note that TLP may not be able to support all legal regimes that require or restrict further sharing of information. Originators and recipients sharing information should be aware that some policies and/or legal requirements may require disclosure regardless of the TLP label.

For any questions related to these use cases, please reach out to the FIRST TLP SIG at tlp-sig@first.org.

1. Considerations for the Originator
Use Case 1A

I do not want to share my information with individuals or organizations from certain countries. Can I indicate this restriction with the TLP:AMBER label?		 Yes, by adding accompanying instructions.

FIRST also recommends adding a rationale so that the recipient may request sharing a subset of information based on the reason for the restriction.

Example:
TLP:AMBER You may not share this information outside of the European Union due to GDPR-covered content.
Use Case 1B

I want my information to be used by the recipient’s service providers (for example, legal services, cybersecurity, payment processing) and supply chains, including incident response support. Can I label it TLP:AMBER and share it with service providers?		 Yes, by adding accompanying instructions.

According to definition of TLP:AMBER, this information should not be shared with service providers. However, you may authorize further sharing with instructions. FIRST recommends that you only allow sharing TLP:AMBER information to service providers as TLP:AMBER+STRICT. If you share this information with service providers as TLP:AMBER, they may share it with their other clients. Those clients may then share it with their other service providers. Each time this happens, it weakens the protection of TLP:AMBER.
Additionally, consider that the service provider or incident response support may be from another country.

Examples:
TLP:AMBER You may share this information as TLP:AMBER+STRICT with any organization providing you incident response support.

TLP:AMBER You may share this information as TLP:AMBER+STRICT with any domestic organization providing you ongoing services or incident response support.
Use Case 1C

I want to share information with a defined community.
Can I indicate this restriction with the TLP:GREEN label?		 Yes, by defining the community.

You can label the information as TLP:GREEN but indicate the community in accompanying instructions to ensure recipients are aware of the sharing restrictions.

Examples:
TLP:GREEN You may only share this information with healthcare sector cyber defense practitioners.

TLP:GREEN You may only share this information within the European Union.
Use Case 1D

I want to share information with a CSIRT that has multiple clients, but I only want the information to go to specific types of clients
Can I indicate this restriction with the TLP:AMBER label?		 Yes, by adding accompanying instructions

It may be helpful to determine what “client” means to the CSIRT (you may need to contact them, or this may be in the CSIRT’s RFC 2350 Charter). Add restrictions if needed.

Example:
TLP:AMBER You may only share this information with clients that your organization has a formal sharing agreement with.
Use Case 1E

I need to share information that is mostly one TLP label but includes some data that needs to be restricted to a different TLP. Can I?		 Yes.

The overall TLP label for the information should be the most restrictive TLP that is used anywhere in the information. Label the different portions of information accordingly. It may also be helpful to separate differently labeled information into different attachments, pages, or feeds.

Note: This may be useful for instances when you want technical information to be acted upon but contextual information to be kept separate and not shared or exposed.

Example:
TLP:AMBER+STRICT
Some information may be extracted for broader sharing as indicated.
[Sensitive content]
Start of TLP:GREEN
[Indicators of Compromise to share further]
End of TLP:GREEN Return to TLP:AMBER+STRICT
[Continue with sensitive content]

2. Considerations for Sharing in Different Media
Use Case 2A

I need to exchange TLP-labeled information in a chat room, oral presentation, or slide deck. Can I?		 Yes.

Each separate chat room or presentation should display—or, in the case of oral presentations, announce—a default TLP label. Otherwise, recipients may assume that all shared information is TLP:CLEAR. This can be done by:
  • Establishing a default TLP label for a chat room and pinning it or placing it in a login banner.
  • Labeling individual chat rooms with the desired TLP label before the topic name.
  • Putting up posters or backdrops showing the desired TLP label for oral presentations.
  • Labeling slide decks according to the TLP formatting guidelines with the most restrictive TLP label for the information contained.
Note: Less restricted information may be labeled by following the instructions in Other Considerations for Recipients Sharing Information.

3. Considerations for Sending Incident or Vulnerability Notifications
Use Case 3A

I need to send a notification directly to an impacted organization. I do not need to place restrictions on what is done with that information. Do I have to use TLP?		 No.

TLP is optional. You may let the recipient know further sharing is their choice unless otherwise indicated.

Note: The originator may restrict sharing some of the information, for example by labeling select paragraphs with TLP. Refer to Considerations for the Originator (Use Case 1E) for guidelines on how to use multiple TLP labels in a report or notification.

Example:
Although the source of this notification is TLP:RED, the content of this notification is TLP:CLEAR.
Use Case 3B

I need to send a notification directly to an impacted organization. I want to place restrictions on how some of that information may be shared. Can I use TLP?
 Yes.

Refer to Considerations for the Originator (Use Case 1E) for guidelines on how to use multiple TLP labels in a report or notification.
Use Case 3C

I need to send an incident notification indirectly to an impacted organization by sending it via an intermediary organization. I do not want to place restrictions on how the impacted organization can share the information, but I do want to restrict how the intermediary organization can share it. Can I use TLP?		 Yes.

The information should be protected until received by the intended recipient.
Be explicit with intermediaries (such as CERTs, CSIRTs with national responsibility, ISACs, or ISPs) on what they can share, and who they can share it with, beyond the impacted organization. You can do this by labeling certain parts of the information with TLP. Refer to Considerations for the Originator (Use Case 1E) for guidelines on how to use multiple TLP labels in a report or notification.

Example:
The impacted organization may share content from this notification with any individuals and organizations, and at any TLP label, they deem appropriate.
Intermediaries may not share any information in this notification except with the impacted organization.

4. Considerations for Recipients Sharing Information with Their Service Providers (e.g., Legal Services, Cybersecurity, Payment Processing) and Supply Chains
Use Case 4A

I received TLP:AMBER+STRICT information at my organization.
We outsource some of our services.
Can I share this information with the organizations providing me those services?		 No, not without permission.

Do not share TLP:AMBER+STRICT with outside organizations that provide you services without permission from the originator.
Permission may come from the originator in the form of:
  • A standing agreement,
  • An answer to your request, or
  • Instructions that accompany the information.
Use Case 4B

I received TLP:AMBER information at my organization.
We outsource some of our services.
Can I share this with the organizations providing me those services?		 No, not without permission.

Do not share TLP:AMBER with outside organizations that provide you services without permission from the originator.
Permission may come from the originator in the form of:
  • A standing agreement,
  • An answer to your request, or
  • Instructions that accompany the information.
Use Case 4C

I received TLP:GREEN information restricted to a defined community at my organization.
We outsource some of our services.
Can I share this with the organizations providing me those services?		 It depends.

You may share TLP:GREEN with organizations that provide you services if they are part of the defined community.

You may not share TLP:GREEN with organizations that provide you services if they are not part of the defined community.
Use Case 4D

I received TLP:GREEN information with no defined community at my organization.
We outsource some of our services.
Can I share this with the organizations providing me those services?		 Yes.

You may share TLP:GREEN with organizations that provide you services.

5. Considerations for Recipients in Formal Sharing Groups
Use Case 5A

I received TLP:AMBER+STRICT information in my role as a representative of the managing/operating body of a formal sharing group (e.g., an information sharing and analysis center [ISAC]). Can I share this information with group members?		 No, not without permission.

Do not share TLP:AMBER+STRICT with any outside organizations, including members of a sharing group, without permission from the originator.
Permission may come from the originator in the form of:
  • A standing agreement,
  • A request, or
  • Instructions that accompany the information.
    Use Case 5B

    I received TLP:AMBER+STRICT information at my organization, which is a member of a formal sharing group (e.g., an information sharing and analysis center [ISAC]). Can I share this information with group members?    		 No, not without permission.

    Do not share TLP:AMBER+STRICT with any outside organizations, including other members of a sharing group or the managing/operating body of the group, without permission from the originator.
    Permission may come from the originator in the form of:
    • A standing agreement,
    • A request, or
    • Instructions that accompany the information.
      Use Case 5C

      I received TLP:AMBER information in my role as a representative of the managing/operating body of a formal sharing group (e.g., an information sharing and analysis center [ISAC]). Can I share this information with group members?      		 Yes.

      You may share TLP:AMBER with organizations that are members of the formal sharing group if the originator sent the information directly to the formal sharing group.
      Use Case 5D

      I received TLP:AMBER information at my organization, which is a member of a formal sharing group (e.g., an information sharing and analysis center [ISAC]). Can I share this information with group members?      		 It depends.

      You may share TLP:AMBER with organizations that are members of the formal sharing group if the originator sent you the information in your role as a member of the formal sharing group.

      You may not share TLP:AMBER with organizations that are members of the formal sharing group if the originator did not send the information to you in your role as a member of the formal sharing group.
      Use Case 5E

      I received TLP:GREEN information with a defined community at my organization, which is a member of a formal sharing group (e.g., an ISAC), or in my role as a representative of the managing/operating body of a formal sharing group. Can I share this information with group members?      		 It depends.

      You may share with any organization within the defined community.

      Example:
      If the Health ISAC’s European Council received TLP:GREEN information for the health sector in the European Union, they could share with ISAC members in the European Union.

      6. Considerations for Recipients in Computer Security Incident Response Teams (CSIRTs) with National Responsibility
      Use Case 6A

      I received TLP:AMBER+STRICT information at my organization. We are a CSIRT with national responsibility. Can I share this information with constituents, national security partners, or my country’s regional governments?      		 No, not without permission.

      Do not share TLP:AMBER+STRICT with any outside organizations, including other members of a sharing group or the managing/operating body of the group, without permission from the originator.
      Permission may come from the originator in the form of:
      • A standing agreement,
      • A request, or
      • Instructions that accompany the information.
        Use Case 6B

        I received TLP:AMBER information at my organization. We are a CSIRT with national responsibility. Can I share this information with constituents, national security partners, or my country’s regional governments?        		 Yes.

        You may share this information with national security partners, constituents, or your country’s regional governments.

        Note: The originator is responsible for understanding the receiving entity's constituency.
        Use Case 6C

        I received TLP:GREEN information with a defined community at my organization. We are a CSIRT with national responsibility. Can I share this information with constituents and national security partners, and my country’s regional governments?        		 Yes.

        You may share this information with national security partners and your country’s regional governments. You may share with constituents that are in the defined community.

        7. Other Considerations for Recipients Sharing Information
        Use Case 7A

        I receive TLP-labeled information regularly from an organization and I want to share it in a way not allowed by the TLP label.
        Can I?        		 No. However, you may:

        • Ask the originator to add or change accompanying instructions to the information.
        • Establish a standing agreement with the originator.
        • Ask the originator each time.
        • Ask the originator to add the entities you want to share with to the regular distribution list.

        FIRST TLP Posters

        TLP Posters

        Download TLP Posters Format A4 (Three color schemes, the text content is all the same)