Security tag used when a piece of information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved.

The Traffic Light Protocol (TLP) is a system for classifying sensitive information. TLP:AMBER is used when information requires sharing within an organization or with its clients on a need-to-know basis to take protective action. Its primary restriction is that it cannot be shared outside of the involved organizations because of the risk to privacy, reputation, or operations. This level appropriately balances the need for internal collaboration with the containment of sensitive data, which directly matches the scenario described in the question.

A. TLP:GREEN: This level permits sharing with partner organizations within a specific community or sector, which is a broader scope than the "organizations involved" described.
C. TLP:RED: This is too restrictive. It limits information to the direct recipients only ("eyes only") and prohibits any further sharing, even within their own organization.
D. TLP:WHITE: This level has no distribution limits and allows for public disclosure, which is contrary to the stated risk of sharing the information.

1. Forum of Incident Response and Security Teams (FIRST). Traffic Light Protocol (TLP) - FIRST Standards Definitions and Usage Guidance — Version 2.0. Section 3.3

"TLP:AMBER".

"Recipients may only share TLP:AMBER information with members of their own organization

and with clients or customers who need to know the information to protect themselves or prevent further harm

on a need-to-know basis."

2. ServiceNow Product Documentation. Security Incident Response > Security tags in Security Incident Response > Security tag sources for Security Incident Response.

The documentation outlines the use of the Traffic Light Protocol (TLP) as a predefined security tag source. The definition for the snsi.tlpamber tag aligns with the FIRST standard

indicating its use for limited disclosure restricted to participants' organizations.