Traffic Light Protocol - Getting Started


The AAF uses TLP to communicate sensitive information for eduGAIN security incidents.


TLP is:

  • A requirement of the SIRTFI Security Incident Response Framework.
  • An information distribution scheme that specifies the extent to which information can be shared with other parties.
  • TLP only defines who should receive the information; it is NOT an information classification scheme.
  • TLP requires participants to use email and Word templates to share information.

Where are the AAF TLP templates?

The AAF has two sets of TLP templates:

  • Approved TLP templates in word format available at the AAF Support desk.
  • Approved TLP templates for emails (see below).


AAF TLP usage guidelines?


TLP colour
Usage
TLP:RED
Not for disclosure, restricted to participants only.
Distribution outside this audience requires written permission from the originator.
TLP:AMBER

Limited disclosure, restricted to participants’ organizations.
Distribution outside this audience requires written permission from the originator.
TLP:GREEN

Limited disclosure, restricted to the community/sector.
Distribution outside this audience requires written permission from the originator.
TLP:WHITE

Disclosure not limited.


Use the following matrix to determine when to use the different TLP designations and sharing restrictions:



Sending information via TLP

  • Liaise with Support Manager regarding use of TLP.
  • Once approved, confirm TLP level with Support Manager.
  • Construct email or supporting document using the templates in the Resources section below.
  • Create draft and forward to Support Manager for approval.
  • Before sending, confirm correct template, confirm originator name and confirm recipient names.
  • Send TLP communication.



Receiving information via TLP

  • Advise Technical Support Manager regarding incoming TLP communication.
  • The Technical Support Manager will advise how to respond to the communication.
  • See the above sending information via TLP" guidelines before responding.

 

Canned email - acknowledge incoming TLP communication

Dear <Original sender of information>,

We acknowledge receipt of your recent TLP communication. We are currently reviewing this information and will be in contact shortly.

Kind regards,

“Your Name”


TLP templates for emails

This section contains canned email responses for TLP.


To understand which TLP designation to use, or to access Word templates, see:-


Emails must contain the TLP designation in the header and at the start of the email body.


TLP-designated email correspondence must:

Indicate the corresponding TLP colour as per response level of information in the Subject line.

Indicate the TLP colour in the body of the email, prior to the designated information itself

State the TLP colour in capital letters: TLP:RED, TLP:AMBER, TLP:GREEN, or TLP:WHITE.

Cut/paste the following email templates if needed.


NOTE: Colours are to distinguish the different templates only; they are not required for template use.


-------------------------------------------------------

TLP:RED email usage


Subject-line: TLP:RED


Email body:

TLP:RED

Not for disclosure, restricted to participants only.

Distribution outside this audience requires written permission from the originator.
Originating organisation and contact details:
Original recipients and contact details:
<Enter information here>


-------------------------------------------------------

TLP:AMBER email usage


Subject-line: TLP:AMBER


Email body:

TLP:AMBER

Limited disclosure, restricted to participants’ organizations.
Distribution outside this audience requires written permission from the originator.
Originating organisation and contact details:
Original recipients and contact details:
<Enter information here>

-------------------------------------------------------


TLP:GREEN


Subject-line: TLP:GREEN


Email body:

TLP:GREEN

Limited disclosure, restricted to the community/sector.
Distribution outside this audience requires written permission from the originator.
Originating organisation and contact details
Original recipients and contact details

<Enter information here>

-------------------------------------------------------


TLP:WHITE


Subject-line: TLP:WHITE


Email body:

TLP:WHITE

Disclosure not limited.
Originating organisation and contact details
Original recipients and contact details

<Enter information here>