FIRST CSIRT Services Framework and Standards FIRST-TLP-v2: FIRST Traffic Light Protocol (TLP) v2.0 (2022) - Information-Sharing Classification

FIRST Traffic Light Protocol (TLP) v2.0 published August 2022 + replaces TLP v1.0. TLP v2 CATEGORIES: (a) TLP:RED - not for disclosure + restricted to participants only + verbal communication preferred; (b) TLP:AMBER - limited disclosure + restricted to participants and their organizations; (c) TLP:AMBER+STRICT (NEW in v2) - limited disclosure + restricted to participants only (NOT their organizations - clarifying v1 TLP:AMBER ambiguity); (d) TLP:GREEN - limited disclosure + restricted to the community; (e) TLP:CLEAR (renamed from TLP:WHITE in v2 for accessibility + inclusiveness) - disclosure is not limited. USAGE GUIDANCE: TLP is recipient-applied + non-binding per FIRST + relies on community trust; TLP markings should be prominently displayed in the header + footer of communications + embedded in metadata for structured data (STIX + IEP + JSON); TLP must be respected per the originator's intent + may be DOWNGRADED only by the originator. INTEGRATION: TLP integrates with STIX/TAXII + IEP for machine-readable handling + automated routing. NATIONAL ADOPTION: TLP is adopted by US-CERT/CISA + UK NCSC + EU ENISA + AusCERT + JPCERT/CC + most national CSIRTs.