(TLP:CLEAR) WaterISAC’s Traffic Light Protocol (TLP) Information Sharing Guidelines

Starting the week of January 27, 2025, WaterISAC is adopting the Traffic Light Protocol (TLP) information sharing guidelines for all its written products and webinars. The use of TLP aligns WaterISAC with the widely adopted international guidelines for sharing information and facilitating more frequent and effective collaboration. Several federal agencies, such as CISA and Office of the National Cyber Director (ONCD) use the TLP.

The Traffic Light Protocol (TLP) is a widely recognized protocol designed to enhance the sharing of potentially sensitive information by indicating expected sharing boundaries to be applied by the recipient(s). TLP uses simple color-coded labels—TLP:RED, TLP:AMBER, TLP:GREEN, and TLP:CLEAR—to indicate how information can be shared, with whom, and how it can be further shared, if necessary. This approach helps to ensure that information shared by WaterISAC is disclosed appropriately, protecting both the confidentiality of sensitive details and the broader security interests of the water sector.

Here’s how this change will impact your WaterISAC experience:

1. Improved Clarity: Each email you receive, report you read, or content we post on our website will include a concise TLP designation, helping you quickly understand how the information should be handled and shared.
   • TLP:CLEAR – Commonly used, in cases when there are minimal or no risks and the intent is to distribute the information as widely as possible.
     • This is applied in cases when there is minimal or no foreseeable risk of misuse and the intent is to reach the largest audience possible. There is no restriction on recipients sharing this information further, barring any copyright rules.
   • TLP:GREEN – Commonly used, in cases when there is minimal risk and the intent is also to distribute the information widely but limit it from being shared in the public domain.
     • Unlike with TLP:CLEAR, information under this designation is to be kept within the sector, allowing it to be communicated among utilities and other stakeholders but not released to the public (including by being posted to a website accessible to the public). Under this designation, the information may be communicated from a member to non-member; it may even be desired that members assist with disseminating the information to the rest of the sector.
   • TLP:AMBER – Less commonly used, in cases when there are some risks and/or the information is intended primarily for WaterISAC members.
     • This designation applies when there is some risk to privacy, reputation, or operations, including for an individual utility, partner or other type of organization, or the sector at large. Unlike with TLP:GREEN, recipients may not share this information as freely with other organizations. In the case of WaterISAC member utilities, they could not share the information with non-member utilities. However, as the information may require support to be acted upon, members may share the information with clients and other partners on a need-to-know basis to protect themselves and prevent further harm.
   • TLP:AMBER+STRICT – Rarely used, in cases when there are some risks and the information is not to be shared with anyone beyond the recipients’ organizations.
     • The same restrictions for TLP:AMBER information apply, with the added caveat that the information is restricted to the recipient organization only. Individual recipients may only share the information with members of their own organization.
   • TLP:RED – Very rarely used, in cases when there are significant risks and the information is for the individual recipients only.
     • This designation applies in a very limited number of cases, such as times when WaterISAC Staff are communicating information of such sensitivity it is not to be shared with anyone else, including other personnel in the recipient’s organization. Given the limitation, this designation is unlikely to be practical in all but the most unique of circumstances.
2. Enhanced Security: By following TLP guidelines, we can reduce the risk of unintentional information exposure and ensure that potentially sensitive information is shared only with the appropriate audiences.
3. Consistency Across Communications: Adopting the TLP standard ensures that WaterISAC communications are consistent with those issued by trusted external partners, making it easier to collaborate and respond to potentially sensitive information.

For questions about shareability, including cases when the TLP seems to restrict sharing, reach out to us at an*****@*******ac.org or (866)-H2O-ISAC.

Read more about TLP guidelines at CISA.