Traffic Light Protocol
The Traffic Light Protocol ("TLP") was created by the Cybersecurity and Infrastructure Security Agency (CISA) of the U.S. Government in 2022 to better control the sharing of information in the cyberspace (click the link below in References to learn more). A TLP is a designation used on documents and/or emails to ensure that information is shared with the appropriate audience(s). Documents and/or Emails containing these designations are rarely used by Security & Emergency Management, but may be used to signal to the reader that the information should be safeguarded in a specific manner. An example of a document containing this designation may be an Incident Action Plan that contains sensitive security information such as floor plans, personal protection strategies, shelter locations, and Personally Identifiable Information ("PII"). These markings are used in relation to the sharing of information.
TLP:RED
Do not share, restricted to original recipients only.
TLP:AMBER+STRICT
Sharing is allowed, but original recipients will use their discretion to share beyond themselves and sharing outside of SPPS is prohibited.
TLP:AMBER
Sharing is allowed, but original recipients will use their discretion to share beyond themselves.
TLP:GREEN
Sharing is allowed to any staff, contractor, or volunteer working within SPPS, but not beyond SPPS.
TLP:CLEAR
No restriction, sharing is allowed to anyone.
Other markings used
There may be times that a document or email contains other markings because the information may be governed or controlled by law, policy, procedure, or best practice. These markings are in relation to what type of information is within the document or email.
//FYSA (For Your Situational Awareness)
There is no expectation of the recipient to take action. Information is being shared for the recipient to be better informed in the event the shared information impacts them.
//PII (Personally Identifiable Information)
May contain information that identified a specific person, such as name, student ID number, date of birth, enrolled school, or other information.
//FERPA (Family Educational Rights and Privacy Act)
May contain information that is deemed educational data.
References