According to the Traffic Light Protocol (TLP) 2.0 standard, which classification is used for information that is restricted to the specific individuals involved in an investigation and cannot be shared further?
The Traffic Light Protocol (TLP) is an international standard used by SOCs and CSIRTs to ensure that sensitive information is shared with the correct audience.
TLP:RED (D): This is the most restrictive level. Information marked RED is for the recipients' eyes only . In the context of an investigation, it means the data cannot be shared outside of the specific meeting or incident response group it was provided to.
TLP:AMBER (C): Restricted to the participants' organization (and its clients) on a need-to-know basis.
TLP:GREEN (B): Restricted to the wider security community or sector.
TLP:CLEAR (A): No restrictions on sharing; the information is effectively public.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit