## Traffic Light Protocol (TLP)\n\n### What is TLP?\n\nTLP is a set of designations used to ensure that sensitive information is shared with the appropriate audience.\n\n### TLP 2.0 Designations\n\n| Color | Sharing | Example Use |\n|-------|---------|-------------|\n| 🔴 **TLP:RED** | Named recipients only | Active investigation details |\n| 🟠 **TLP:AMBER** | Organization + clients | Sector-specific threats |\n| 🟠 **TLP:AMBER+STRICT** | Organization only | Internal incidents |\n| 🟢 **TLP:GREEN** | Community | General threat advisories |\n| ⚪ **TLP:CLEAR** | Public | Press releases |\n\n### When to Use Each Level\n\n**TLP:RED** 🔴\n- Source protection required\n- Active investigation\n- Named individuals\n- Ongoing operations\n\n**TLP:AMBER** 🟠\n- Client-relevant threats\n- Sector intelligence\n- Limited external sharing\n\n**TLP:GREEN** 🟢\n- General awareness\n- Widely applicable\n- Community benefit\n\n**TLP:CLEAR** ⚪\n- Public information\n- Already published\n- Marketing/awareness\n\n### Applying TLP\n\n```markdown\n# Threat Advisory: New Ransomware Campaign\n**TLP:AMBER** - For organizational use and clients\n\n## Summary\nA new ransomware variant has been observed targeting...\n```\n\n### Common Mistakes\n\n❌ Over-classifying (everything TLP:RED)\n❌ Under-classifying (sensitive data as CLEAR)\n❌ Not marking at all\n❌ Ignoring TLP when sharing