TLP markings
Material on this site carries Traffic Light Protocol markings. The marking tells you how far you may pass a resource on. It is not advisory.
The Traffic Light Protocol is maintained by FIRST, the Forum of Incident Response and Security Teams. This site follows TLP version 2.0. Where anything here differs from the FIRST standard, the standard governs.
The markings you will see here
May be shared without restriction. Everything on this site is TLP:CLEAR once the public release has happened, except the controlled shelves.
May be shared within your community of practice, but not through public channels. Do not post it, and do not put it on a website.
May be shared with members of your own organisation, and with clients who need to know in order to protect themselves or their operations. No wider. Most material carries this marking while the embargo is in force.
May be shared within your own organisation only. Not with clients, not with partners, not onward. The program chronology carries this marking.
For the named recipients in the exchange only. Not to be shared further, including within your own organisation. Nothing on this site carries this marking; it appears in correspondence.
The marking and the access code are separate things
An access code decides whether a resource opens for you. A TLP marking decides what you may do with it afterwards. Holding a code that opens a TLP:AMBER-STRICT resource does not entitle you to forward it, and no technical control on this site enforces the marking. That part is on the recipient, which is what the protocol is for.
Markings change at release
Material published for the coordinated release moves from TLP:AMBER to TLP:CLEAR at the moment the embargo lifts. Controlled material under/intel/ keeps its marking indefinitely and does not open with the rest of the site.
If you are unsure what a marking permits in your situation, ask before you forward it: the ATG team.