ConfidentialityLevelType: Add amberStrict + use ISO verbs

[bact]

• Add amberStrict (for TLP:AMBER+STRICT, added in TLP 2.0), as suggested by [3.1-RC1] Add amberStrict (TLP 2.0) to ConfidentialityLevelType #1366
• Revise entry description to use ISO verbs. Parts of description are adapted from Wikipedia

To close #1366

@henrylyons - please review

[bobmartin3000]

LGTM

[bact]

Discussed in AI WG call. Few adjustments made during the call (reorder the entries, and removal of the word "Personal" from "red"). The definitions and added description aligned with https://www.first.org/tlp/. Approved.

[goneall]

To avoid possible contradictions, I would suggest we just refer to the standard rather than add our own slightly different definitions.

[bact]

To avoid possible contradictions, I would suggest we just refer to the standard rather than add our own slightly different definitions.

@goneall would you prefer something like this?

• red: Indicates a sharing restriction equivalent to TLP:RED, as defined by the FIRST Traffic Light Protocol standard.
• amberStrict: Indicates a sharing restriction equivalent to TLP:AMBER+STRICT, as defined by the FIRST Traffic Light Protocol standard.
• amber: Indicates a sharing restriction equivalent to TLP:AMBER, as defined by the FIRST Traffic Light Protocol standard.
• green: Indicates a sharing restriction equivalent to TLP:GREEN, as defined by the FIRST Traffic Light Protocol standard.
• clear: Indicates a sharing designation equivalent to TLP:CLEAR, as defined by the FIRST Traffic Light Protocol standard.

that would do although they will be a less self-contained definition.

[bact]

Also, if we strict to FIRST standard, the clients will be limited to "those people or entities that receive cybersecurity services from an organization".

The vocabulary will be less applicable to other kinds of entities.

[bact]

Definitions in 3.0.1, for comparison: https://spdx.github.io/spdx-spec/v3.0.1/model/Dataset/Vocabularies/ConfidentialityLevelType/

[goneall]

To avoid possible contradictions, I would suggest we just refer to the standard rather than add our own slightly different definitions.

@goneall would you prefer something like this?

• red: Indicates a sharing restriction equivalent to TLP:RED, as defined by the FIRST Traffic Light Protocol standard.
• amberStrict: Indicates a sharing restriction equivalent to TLP:AMBER+STRICT, as defined by the FIRST Traffic Light Protocol standard.
• amber: Indicates a sharing restriction equivalent to TLP:AMBER, as defined by the FIRST Traffic Light Protocol standard.
• green: Indicates a sharing restriction equivalent to TLP:GREEN, as defined by the FIRST Traffic Light Protocol standard.
• clear: Indicates a sharing designation equivalent to TLP:CLEAR, as defined by the FIRST Traffic Light Protocol standard.

that would do although they will be a less self-contained definition.

Yes - I think that would be better - but I don't feel strongly if others feel if the readability is more important than the consistency. We could also add links to the standard in the bullets to make it easier to navigate.

[bact]

Also, if we strict to FIRST standard, the clients will be limited to "those people or entities that receive cybersecurity services from an organization".

The vocabulary will be less applicable to other kinds of entities.

I suggest to get more feedback from the next Tech call.
Not sure if the strict adoption of FIRST will have effects on non-cybersecurity service use cases or not

[bobmartin3000]

The scope difference is important - Bob From: goneall ***@***.***> Date: Thursday, July 30, 2026 at 3:20 PM To: spdx/spdx-3-model ***@***.***> Cc: Robert A Martin ***@***.***>; Comment ***@***.***> Subject: [EXT] Re: [spdx/spdx-3-model] ConfidentialityLevelType: Add amberStrict + use ISO verbs (PR #1419) This Message Is From an External Sender This message originates outside of MITRE. If you feel this is suspicious, please report it via "Report Suspicious Email" button in Outlook. [https://avatars.githubusercontent.com/u/378172?s=20&v=4]goneall left a comment (spdx/spdx-3-model#1419)<https://urldefense.us/v2/url?u=https-3A__github.com_spdx_spdx-2D3-2Dmodel_pull_1419-23issuecomment-2D5135271520&d=DwMFaQ&c=Al8V6E3U0yBSSEuVtdZbGtsvjPA49U3WmtZAsdW0D_Q&r=yyf_tMRBY80wjAUP82gpfmv0fTJk5mALsolNn8pXnYc&m=ev1cijHVjYTgWKz69vMCXsaFEdquAS30FcIsX_uvRhRoquJlQRLIs2wRsANHMT0U&s=wM_VfhTRIwanjv-i2IWdUZcYNqSmwBCsniiraLESufU&e=> To avoid possible contradictions, I would suggest we just refer to the standard rather than add our own slightly different definitions. @goneall<https://urldefense.us/v2/url?u=https-3A__github.com_goneall&d=DwMFaQ&c=Al8V6E3U0yBSSEuVtdZbGtsvjPA49U3WmtZAsdW0D_Q&r=yyf_tMRBY80wjAUP82gpfmv0fTJk5mALsolNn8pXnYc&m=ev1cijHVjYTgWKz69vMCXsaFEdquAS30FcIsX_uvRhRoquJlQRLIs2wRsANHMT0U&s=Tccz6mF_AhyJ4poatpE8f6nJNAEnbdCpIkiPykBR5UU&e=> would you prefer something like this? * red: Indicates a sharing restriction equivalent to TLP:RED, as defined by the FIRST Traffic Light Protocol standard. * amberStrict: Indicates a sharing restriction equivalent to TLP:AMBER+STRICT, as defined by the FIRST Traffic Light Protocol standard. * amber: Indicates a sharing restriction equivalent to TLP:AMBER, as defined by the FIRST Traffic Light Protocol standard. * green: Indicates a sharing restriction equivalent to TLP:GREEN, as defined by the FIRST Traffic Light Protocol standard. * clear: Indicates a sharing designation equivalent to TLP:CLEAR, as defined by the FIRST Traffic Light Protocol standard. that would do although they will be a less self-contained definition. Yes - I think that would be better - but I don't feel strongly if others feel if the readability is more important than the consistency. We could also add links to the standard in the bullets to make it easier to navigate. — Reply to this email directly, view it on GitHub<https://urldefense.us/v2/url?u=https-3A__github.com_spdx_spdx-2D3-2Dmodel_pull_1419-3Femail-5Fsource-3Dnotifications-26email-5Ftoken-3DAUYBD7EOKABXWXHM3OTOBVT5HONYPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJTGUZDOMJVGIYKM4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLDGN5XXIZLSL5RWY2LDNM-23issuecomment-2D5135271520&d=DwMFaQ&c=Al8V6E3U0yBSSEuVtdZbGtsvjPA49U3WmtZAsdW0D_Q&r=yyf_tMRBY80wjAUP82gpfmv0fTJk5mALsolNn8pXnYc&m=ev1cijHVjYTgWKz69vMCXsaFEdquAS30FcIsX_uvRhRoquJlQRLIs2wRsANHMT0U&s=GN-A8IuToztHUJ0ZIVEI_V3CDnrHnaWCs6oDHNxGWXc&e=>, or unsubscribe<https://urldefense.us/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AUYBD7H3UQXJRM6MXCP2PFD5HONYPAVCNFSNUABFKJSXA33TNF2G64TZHM2DCOBSG4ZDOOJTHNEXG43VMU5TIOJVGM2DONZTGY3KC5QC&d=DwMFaQ&c=Al8V6E3U0yBSSEuVtdZbGtsvjPA49U3WmtZAsdW0D_Q&r=yyf_tMRBY80wjAUP82gpfmv0fTJk5mALsolNn8pXnYc&m=ev1cijHVjYTgWKz69vMCXsaFEdquAS30FcIsX_uvRhRoquJlQRLIs2wRsANHMT0U&s=7hbXBE-4rNMIlwB2QRVpVyxW_KP6EuQ5s2k_feQNzLA&e=>. Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS<https://urldefense.us/v2/url?u=https-3A__github.com_notifications_mobile_ios_AUYBD7FG6YTDK7RSQCIOHYL5HONYPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJTGUZDOMJVGIYKM4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJKTGN5XXIZLSL5UW64Y&d=DwMFaQ&c=Al8V6E3U0yBSSEuVtdZbGtsvjPA49U3WmtZAsdW0D_Q&r=yyf_tMRBY80wjAUP82gpfmv0fTJk5mALsolNn8pXnYc&m=ev1cijHVjYTgWKz69vMCXsaFEdquAS30FcIsX_uvRhRoquJlQRLIs2wRsANHMT0U&s=Y_qUUiYBB9ykBGEmXdNXBfIG4eS3iDo13uqBw9Up6C8&e=> and Android<https://urldefense.us/v2/url?u=https-3A__github.com_notifications_mobile_android_AUYBD7EWRYOFAWXGN3NKGLD5HONYPA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMJTGUZDOMJVGIYKM4TFMFZW63VHMNXW23LFNZ2KKZLWMVXHJLTGN5XXIZLSL5QW4ZDSN5UWI&d=DwMFaQ&c=Al8V6E3U0yBSSEuVtdZbGtsvjPA49U3WmtZAsdW0D_Q&r=yyf_tMRBY80wjAUP82gpfmv0fTJk5mALsolNn8pXnYc&m=ev1cijHVjYTgWKz69vMCXsaFEdquAS30FcIsX_uvRhRoquJlQRLIs2wRsANHMT0U&s=zCPmIj9AxkVpdwmhCLsqPuOY28BjG_ikPesCNf-duSc&e=>. Download it today! You are receiving this because you commented.