TLP and PAP marking: FAQ

Voir en français

Version 1 (16/11/2022)

1. Frequently asked questions

Listed hereunder are the most frequent questions that may be asked about the marking policy of ANSSI for its operational information.

Yes, as long as the requirements of the given TLP and PAP levels are respected and the adequacy of the use has been verified.

Sharing with a contractor by TLP level
TLP:CLEAR	TLP:GREEN	TLP:AMBER	TLP:RED
Yes, regardless of contractor type.	Yes, regardless of contractor type, exclusively for the protection of the entity's IS.	Yes, regardless of contractor type, exclusively for the protection of the entity's IS.	No, unless it is an embedded contractor.

The contractor has no right to share the information received, in particular with other clients, except for TLP:CLEAR information.

Sharing with parent or subsidiary entity by TLP level
TLP:CLEAR	TLP:GREEN	TLP:AMBER	TLP:RED
Yes	Yes	Yes	No

If the parent entity or subsidiary entity wishes to further share TLP:AMBER information, it must obtain the express authorisation of ANSSI.

Sharing with supply-chain suppliers by TLP level
TLP:CLEAR	TLP:GREEN	TLP:AMBER	TLP:RED
Yes	Yes	No, unless there is a contractual framework between the constituent and its supplier where both parties commit to guarantee the sharing and handling constraints set by ANSSI.	No

The supplier has no right to share the information received, except for TLP:CLEAR information.

Cloud storage by PAP level
PAP:CLEAR	PAP:GREEN	PAP:AMBER	PAP:RED
Yes	Yes	Yes	Yes

This investigation or detection infrastructure must have been designed and secured in such a way as to ensure isolation in the event of a compromise of the supervised IS.

Searches on production IS by PAP level
PAP:CLEAR	PAP:GREEN	PAP:AMBER	PAP:RED
Yes	Yes	Yes	No

Local detection and response solution by PAP level
PAP:CLEAR	PAP:GREEN	PAP:AMBER	PAP:RED
Yes	Yes	Yes for detection No for blocking	No

For SEARCHES (e.g. use of search engines or public knowledge databases accessible on the Internet):

Open source searches by PAP level
PAP:CLEAR	PAP:GREEN	PAP:AMBER	PAP:RED
Yes	Yes	Yes	No

For SUBMISSION of the information received, or files containing it, to an online analysis service, which may share this information or the results of this analysis (e.g. Virus Total, urlscan, online sandboxes):

Open source submissions by PAP level
PAP:CLEAR	PAP:GREEN	PAP:AMBER	PAP:RED
Yes	Yes	No	No

In general, accessible public knowledge databases have general terms and conditions of use that may differ depending on the service subscribed to. You must ensure that the offer you have subscribed to commits to not sharing your searches with third parties.

Searches on disconnected databases by PAP level
PAP:CLEAR	PAP:GREEN	PAP:AMBER	PAP:RED
Yes	Yes	Yes	Yes

Flow blocking by PAP level
PAP:CLEAR	PAP:GREEN	PAP:AMBER	PAP:RED
Yes	Yes	No	No

Yes, this can be considered as an infrastructure dedicated to investigations and detections.

ANSSI only applies its interpretation of the TLP/PAP marking to information it produces itself. Information received from outside and marked only with TLP is interpreted in accordance with the FIRST definition. However, ANSSI encourages its partners to detail the handling conditions of the information they share by tagging it with a PAP tag or by indicating the limitations associated with its use.

2. Some use cases

In order to get started with this sharing and handling policy, a few use cases are described in the tables hereunder. For each case details are given regarding who can use the operational information received and on which perimeter.

Use case — Hunting
TLP/PAP combination	Who?	Where?
TLP:CLEAR / PAP:CLEAR	Anyone	Anywhere
TLP:GREEN / PAP:GREEN	A member of the community	On all its infrastructure
TLP:GREEN / PAP:AMBER	A member of the community	On all its infrastructure
TLP:AMBER / PAP:GREEN	The constituent or a contractor	On all its infrastructure
TLP:AMBER / PAP:AMBER	The constituent or a contractor	On all its infrastructure
TLP:AMBER / PAP:RED	The constituent or a contractor	On a dedicated investigation network, for instance after having collected elements of interest
TLP:RED / PAP:AMBER	The constituent or its embedded contractor	On all its infrastructure
TLP:RED / PAP:RED	The constituent or its embedded contractor	On a dedicated investigation network, for instance after having collected elements of interest

Use case — Real time detection
TLP/PAP combination	Who?	Where?
TLP:CLEAR / PAP:CLEAR	Anyone	Anywhere
TLP:GREEN / PAP:GREEN	A member of the community	On all its infrastructure
TLP:GREEN / PAP:AMBER	A member of the community	On all its infrastructure
TLP:AMBER / PAP:GREEN	The constituent or a contractor	On all its infrastructure
TLP:AMBER / PAP:AMBER	The constituent or a contractor	On the constituent's infrastructure. On the constituent's cloud based infrastructure if there is an agreement with the cloud provider which provides for the exclusive control of its data by the constituent.
TLP:AMBER / PAP:RED	The constituent or a contractor	On a dedicated investigation network
TLP:RED / PAP:AMBER	The constituent or its embedded contractor	On the constituent's infrastructure. On the constituent's cloud based infrastructure if there is an agreement with the cloud provider.
TLP:RED / PAP:RED	The constituent or its embedded contractor	On a dedicated investigation network

Use case — Real time blocking
TLP/PAP combination	Who?	Where?
TLP:CLEAR / PAP:CLEAR	Anyone	Anywhere
TLP:GREEN / PAP:GREEN	A member of the community	On all its infrastructure
TLP:GREEN / PAP:AMBER	N/A	N/A
TLP:AMBER / PAP:GREEN	The constituent or a contractor	On all its infrastructure
TLP:AMBER / PAP:AMBER	N/A	N/A
TLP:AMBER / PAP:RED	N/A	N/A
TLP:RED / PAP:AMBER	N/A	N/A
TLP:RED / PAP:RED	N/A	N/A

Back to the Sharing and Handling Policy

Haut de page

TLP and PAP marking: FAQ

1. Frequently asked questions

2. Some use cases

Accédez au portail authentifié du CERT-FR (ClubSSI)

Suivez-nous sur les réseaux

TLP and PAP marking: FAQ

1. Frequently asked questions

1. May the information received be used for the protection of all kind of information systems (hereafter « IS ») (e.g. vital/critical IS or not, essential IS or not?)

2. For the protection of the IS of my entity, may the information received be shared with a contractor (for detection or incident response)?

3. May the information received be shared with a parent entity (Group) or with a subsidiary entity?

4. Is it possible to share the information received with critical suppliers of my supply-chain (identified in my risk assessment), that may have an impact on the continuity of service or security of my business?

5. May the information received be stored or used in clear on an IaaS or SaaS public cloud service dedicated to investigation, log exploitation or detection?

6. May the information received be used to search on a production IS, including in the cloud?

7. May the information received be used through a local detection and response solution (e.g. Endpoint detection response) deployed on workstations or production servers?

8. Are open source searches or submissions allowed with the information received?

9. May the information received be searched on a public knowledge base disconnected from public networks (e.g. public base replicated on an infrastructure not connected to the Internet?)

10. Is the blocking of network or application flows, on the basis of the information received, possible (e.g. blocking of an IP address on a firewall or of a web address on a proxy server)?

11. Is it possible to use PAP:RED information on a dedicated workstation disconnected from the production IS (and not exposed to a public network)?

12. How does ANSSI consider information received from third parties tagged only with TLP?

2. Some use cases

Hunting

Real time detection

Real time blocking

Accédez au portail authentifié du CERT-FR (ClubSSI)

Suivez-nous sur les réseaux