Incident Command System

Incidents are defined within ICS as unplanned situations necessitating a response. Examples of incidents may include:

• Emergency medical situations (ambulance service)
• Hazardous material spills, releases to the air (toxic chemicals), releases to a drinking water supply
• Hostage crises or Active Shooter situation.
• Man-made disasters such as vehicle crashes, industrial accidents, train derailments, or structure fires
• Natural disasters such as wildfires, flooding, earthquake or tornado
• Public health incidents, such as disease outbreaks
• Search and Rescue operations
• Technological crisis
• Cyberattack, Cybersecurity Incident, or major information security breach.
• Terrorist attacks
• Traffic incidents

Events are defined within ICS as planned situations. Incident command is increasingly applied to events both in emergency management and non-emergency management settings. Examples of events may include:

• Concerts
• Parades and other ceremonies
• Fairs and other gatherings
• Training exercises

Each individual participating in the operation reports to only one supervisor. This eliminates the potential for individuals to receive conflicting orders from a variety of supervisors, thus increasing accountability, preventing freelancing, improving the flow of information, helping with the coordination of operational efforts, and enhancing operational safety. This concept is fundamental to the ICS chain of command structure.[12]

Individual response agencies previously developed their protocols separately, and subsequently developed their terminology separately. This can lead to confusion as a word may have a different meaning for each organization.

When different organizations are required to work together, the use of common terminology is an essential element in team cohesion and communications, both internally and with other organizations responding to the incident.

An incident command system promotes the use of a common terminology and has an associated glossary of terms that help bring consistency to position titles, the description of resources and how they can be organized, the type and names of incident facilities, and a host of other subjects. The use of common terminology is most evident in the titles of command roles, such as Incident Commander, Safety Officer or Operations Section Chief.[12]

Incidents are managed by aiming towards specific objectives. Objectives are ranked by priority; should be as specific as possible; must be attainable; and if possible given a working time-frame. Objectives are accomplished by first outlining strategies (general plans of action), then determining appropriate tactics (how the strategy will be executed) for the chosen strategy.[12]

Incident Command structure is organized in such a way as to expand and contract as needed by the incident scope, resources and hazards. Command is established in a top-down fashion, with the most important and authoritative positions established first. For example, Incident Command is established by the first arriving unit.

Only positions that are required at the time should be established. In most cases, very few positions within the command structure will need to be activated. For example, a single fire truck at a dumpster fire will have the officer filling the role of IC, with no other roles required. As more trucks get added to a larger incident, more roles will be delegated to other officers and the Incident Commander (IC) role will probably be handed to a more-senior officer.

Only in the largest and most complex operations would the full ICS organization be staffed.[12] Conversely, as an incident scales down, roles will be merged back up the tree until there is just the IC role remaining.

To limit the number of responsibilities and resources being managed by any individual, the ICS requires that any single person's span of control should be between three and seven individuals, with five being ideal. In other words, one manager should have no more than seven people working under them at any given time. If more than seven resources are being managed by an individual, then that individual is being overloaded and the command structure needs to be expanded by delegating responsibilities (e.g. by defining new sections, divisions, or task forces). If fewer than three, then the position's authority can probably be absorbed by the next highest rung in the chain of command.[12]

One of the benefits of the ICS is that it allows a way to coordinate a set of organizations who may otherwise work together sporadically. While much training material emphasizes the hierarchical aspects of the ICS, it can also be seen as an inter-organizational network of responders. These network qualities allow the ICS flexibility and expertise of a range of organizations. But the network aspects of the ICS also create management challenges. One study of ICS after-action reports found that ICS tended to enjoy higher coordination when there was strong pre-existing trust and working relationships between members, but struggled when authority of the ICS was contested and when the networks of responders was highly diverse.[13] Coordination on any incident or event is facilitated with the implementation of the following concepts:

Incident action plans (IAPs) ensures cohesion amongst anyone involved toward strictly set goals. These goals are set for specific operational periods. They provide supervisors with direct action plans to communicate incident objectives to both operational and support personnel. They include measurable, strategic objectives set for achievement within a time frame (also known as an operational period) which is usually 12 hours but can be any length of time. Hazardous material incidents (hazmat) must be written,[14] and are prepared by the planning section, but other incident reports can be both verbal and/or written.

The consolidated IAP is a very important component of the ICS that reduces freelancing and ensures a coordinated response. At the simplest level, all incident action plans must have four elements:

• What do we want to do?
• Who is responsible for doing it?
• How do we communicate with each other?
• What is the procedure if someone is injured?

The content of the IAP is organized by a number of standardized ICS forms that allow for accurate and precise documentation of an incident.[15]

• ICS 201 – Incident Briefing
• ICS 202 – Incident Objectives
• ICS 203 – Organization Assignment List
• ICS 204 – Assignment List
• ICS 205 – Incident Radio Communications Plan
• ICS 205A – Communications List
• ICS 206 – Medical Plan
• ICS 207 – Incident Organization Chart
• ICS 208 – Safety Message/Plan
• ICS 209 – Incident Summary
• ICS 210 – Resource Status Change
• ICS 211 – Incident Check-In List
• ICS 213 – General Message
• ICS 214 – Activity Log
• ICS 215 – Operational Planning Worksheet
• ICS 215A – Incident Action Plan Safety Analysis
• ICS 218 – Support Vehicle/Equipment Inventory
• ICS 219 – Resource Status Cards (T-Cards)
• ICS 220 – Air Operations Summary Worksheet
• ICS 221 – Demobilization Check-Out
• ICS 225 – Incident Personnel Performance Rating

Comprehensive resource management is a key management principle that implies that all assets and personnel during an event need to be tracked and accounted for. It can also include processes for reimbursement for resources, as appropriate. Resource management includes processes for:

• Categorizing resources
• Ordering resources
• Dispatching resources
• Tracking resources
• Recovering resources

Comprehensive resource management ensures that visibility is maintained over all resources so they can be moved quickly to support the preparation and response to an incident, and ensuring a graceful demobilization. It also applies to the classification of resources by type and kind, and the categorization of resources by their status.

• Assigned resources are those that are working on a field assignment under the direction of a supervisor.
• Available resources are those that are ready for deployment(staged), but have not been assigned to a field assignment.
• Out-of-service resources are those that are not in either the "available" or "assigned" categories. Resources can be "out-of-service" for a variety of reasons including: resupplying after a sortie (most common), shortfall in staffing, personnel taking a rest, damaged or inoperable.

T-Cards (ICS 219, Resource Status Card) are most commonly used to track these resources. The cards are placed in T-Card racks located at an Incident Command Post for easy updating and visual tracking of resource status.

Developing an integrated voice and data communications system, including equipment, systems, and protocols, must occur prior to an incident.

Effective ICS communications include three elements:

• Modes: The "hardware" systems that transfer information.
• Planning: Planning for the use of all available communications resources.
• Networks: The procedures and processes for transferring information internally and externally.

• Single incident commander – Most incidents involve a single incident commander. In these incidents, a single person commands the incident response and is the decision-making final authority.
• Unified command – A unified command involves two or more individuals sharing the authority normally held by a single incident commander. Unified command is used on larger incidents usually when multiple agencies or multiple jurisdictions are involved. A Unified command typically includes a command representative from major involved agencies and/or jurisdictions with one from that group to act as the spokesman, though not designated as an Incident Commander. A Unified Command acts as a single entity. It is important to note, that in Unified Command the command representatives will appoint a single operations section chief.[16]

• Area command – During multiple-incident situations, an area command may be established to provide for incident commanders at separate locations. Generally, an area commander will be assigned – a single person – and the area command will operate as a logistical and administrative support. Area commands usually do not include an operations function.

• Safety officer – The safety officer monitors safety conditions and develops measures for assuring the safety of all assigned personnel.[17]
• Public information officer – The public information officer (PIO or IO) serves as the conduit for information to and from internal and external stakeholders, including the media or other organizations seeking information directly from the incident or event. While less often discussed, the public information officer is also responsible for ensuring that an incident's command staff are kept apprised as to what is being said or reported about an incident. This allows public questions to be addressed, rumors to be managed, and ensures that other such public relations issues are not overlooked.[18]
• Liaison officer – A liaison serves as the primary contact for supporting agencies assisting at an incident.[19]

• Operations section chief: Tasked with directing all actions to meet the incident objectives.
• Planning section chief: Tasked with the collection and display of incident information, primarily consisting of the status of all resources and overall status of the incident.
• Finance/administration section chief: Tasked with tracking incident related costs, personnel records, requisitions, and administrating procurement contracts required by Logistics.
• Logistics section chief: Tasked with providing all resources, services, and support required by the incident.

At the ICS 200 level, the function of Information and Intelligence is added to the standard ICS staff as an option. This role is unique in ICS as it can be arranged in multiple ways based on the judgement of the Incident Commander and needs of the incident. The three possible arrangements are:

• Information & intelligence officer, a position on the command staff.
• Information & intelligence section, a section headed by an information & intelligence section chief, a general staff position.
• Information & intelligence branch, headed by an information & intelligence branch director, this branch is a part of the planning section.

At the ICS 300 level, the focus is on entry-level management of small-scale, all-hazards incidents with emphasis on the scalability of ICS. It acts as an introduction to the utilization of more than one agency and the possibility of numerous operational periods. It also involves an introduction to the emergency operations center.[20]

At the ICS 400 level, the focus is on large, complex incidents. Topics covered include the characteristics of incident complexity, the approaches to dividing an incident into manageable components, the establishment of an "area command", and the multi-agency coordination system (MACS).

ICS is organized by levels, with the supervisor of each level holding a unique title (e.g. only a person in charge of a section is labeled "chief"; a "director" is exclusively the person in charge of a branch). Levels (supervising person's title) are:

• Incident commander

• Command staff member (officer) - command staff
• Section (chief) - general staff

• Branch (director)

• Division (supervisor) – A division is a unit arranged by geography, along jurisdictional lines if necessary, and not based on the makeup of the resources within the division.
• Group (supervisor) – A group is a unit arranged for a purpose, along agency lines if necessary, or based on the makeup of the resources within the group.

• Unit, team, or force (leader) – Such as "communications unit," "medical strike team," or a "reconnaissance task force." A strike team is composed of same resources (four ambulances, for instance) while a task force is composed of different types of resources (one ambulance, two fire trucks, and a police car, for instance).

• Individual resource. This is the smallest level within ICS and usually refers to a single person or piece of equipment. It can refer to a piece of equipment and operator, and less often to multiple people working together.

ICS uses a standard set of facility nomenclature. ICS facilities include: pre-designated incident facilities: Response operations can form a complex structure that must be held together by response personnel working at different and often widely separate incident facilities. These facilities can include:

• Incident command post (ICP): The ICP is the location where the incident commander operates during response operations. There is only one ICP for each incident or event, but it may change locations during the event. Every incident or event must have some form of an incident command post. The ICP may be located in a vehicle, trailer, tent, or within a building. The ICP will be positioned outside of the present and potential hazard zone but close enough to the incident to maintain command. The ICP will be designated by the name of the incident, e.g., Trail Creek ICP.
• Staging area: Can be a location at or near an incident scene where tactical response resources are stored while they await assignment. Resources in staging area are under the control status. Staging areas should be located close enough to the incident for a timely response, but far enough away to be out of the immediate impact zone. There may be more than one staging area at an incident. Staging areas can be collocated with the ICP, bases, camps, helibases, or helispots.
• A base is the location from which primary logistics and administrative functions are coordinated and administered. The base may be collocated with the incident command post. There is only one base per incident, and it is designated by the incident name. The base is established and managed by the logistics section. The resources in the base are always out-of-service.
• Camps: Locations, often temporary, within the general incident area that are equipped and staffed to provide sleeping, food, water, sanitation, and other services to response personnel that are too far away to use base facilities. Other resources may also be kept at a camp to support incident operations if a base is not accessible to all resources. Camps are designated by geographic location or number. Multiple camps may be used, but not all incidents will have camps.
• A helibase is the location from which helicopter-centered air operations are conducted. Helibases are generally used on a more long-term basis and include such services as fueling and maintenance. The helibase is usually designated by the name of the incident, e.g. Trail Creek helibase.
• Helispots are more temporary locations at the incident, where helicopters can safely land and take off. Multiple helispots may be used.

Each facility has unique location, space, equipment, materials, and supplies requirements that are often difficult to address, particularly at the outset of response operations. For this reason, responders should identify, pre-designate and pre-plan the layout of these facilities, whenever possible.

On large or multi-level incidents, higher-level support facilities may be activated. These could include:

• Emergency operations center (EOC): An emergency operations center is a central command and control facility responsible for carrying out the principles of emergency preparedness and emergency management, or disaster management functions at a strategic level during an emergency, and ensuring the continuity of operation of a company, political subdivision or other organization. An EOC is responsible for the strategic overview, or "big picture", of the disaster, and does not normally directly control field assets, instead making operational decisions and leaving tactical decisions to lower commands. The common functions of all EOC's is to collect, gather and analyze data; make decisions that protect life and property, maintain continuity of the organization, within the scope of applicable laws; and disseminate those decisions to all concerned agencies and individuals. In most EOC's there is one individual in charge, and that is the Emergency Manager.
• Joint information center (JIC): A JIC is the facility whereby an incident, agency, or jurisdiction can support media representatives. Often co-located – even permanently designated – in a community or state EOC the JIC provides the location for interface between the media and the PIO. Most often the JIC also provides both space and technical assets (Internet, telephone, power) necessary for the media to perform their duties. A JIC very often becomes the "face" of an incident as it is where press releases are made available as well as where many broadcast media outlets interview incident staff. It is not uncommon for a permanently established JIC to have a window overlooking an EOC and/or a dedicated background showing agency logos or other symbols for televised interviews. The National Response Coordination Center (NRCC) at FEMA has both, for example, allowing televised interviews to show action in the NRCC behind the interviewer/interviewee while an illuminated "Department of Homeland Security" sign, prominently placed on the far wall of the NRCC, is thus visible during such interviews.
• Joint operations center (JOC): A JOC is usually pre-established, often operated 24/7/365, and allows multiple agencies to have a dedicated facility for assigning staff to interface and interact with their counterparts from other agencies. Although frequently called something other than a JOC, many locations and jurisdictions have such centers, often where Federal, state, and/or local agencies (often law enforcement) meet to exchange strategic information and develop and implement tactical plans. Large mass gathering events, such as a presidential inauguration, will also utilize JOC-type facilities although they are often not identified as such or their existence even publicized.
• Multiple agency coordination center (MACC): The MACC is a central command and control facility responsible for the strategic, or "big picture" of a disaster. A MACC is often used when multiple incidents are occurring in one area or are particularly complex for various reasons such as when scarce resources must be allocated across multiple requests. Personnel within the MACC use multi-agency coordination to guide their operations. The MACC coordinates activities between multiple agencies and incidents and does not normally directly control field assets, but makes strategic decisions and leaves tactical decisions to individual agencies. The common functions of all MACC's is to collect, gather and analyze data; make decisions that protect life and property, maintain continuity of the government or corporation, within the scope of applicable laws; and disseminate those decisions to all concerned agencies and individuals. While often similar to an EOC, the MACC is a separate entity with a defined area or mission and lifespan whereas an EOC is a permanently established facility and operation for a political jurisdiction or agency. EOCs often, but not always, follow the general ICS principles but may utilize other structures or management (such as an emergency support function (ESF) or hybrid ESF/ICS model) schemas. For many jurisdictions the EOC is where elected officials will be located during an emergency and, like a MACC, supports but does not command an incident.

ICS uses a standard set of equipment nomenclature. ICS equipment include:

• Tanker – This is an aircraft that carries fuel (fuel tanker) or water (water tanker).
• Tender – Like a tanker, but a ground vehicle, also carrying fuel (fuel tender), water (water tender), or even fire fighting foam (foam tender).

The importance of access to computer systems is becoming more common within the advancements to technology and to support the standardised approach to incident and emergency response. Commonly referred to within the Command and Control structure within United States Army, computers and computer-based systems allow responders to interface with each other to have access to the latest information for decision making. See Incident Command Post (ICP) for more information.

The "type" of resource describes the size or capability of a resource. For instance, a 50 kW (for a generator) or a 3-ton (for a truck). Types are designed to be categorized as "Type 1" through "Type 5" formally, but in live incidents more specific information may be used.

The "kind" of resource describes what the resource is. For instance, generator or a truck. The "type" of resource describes a performance capability for a kind of resource for instance,

In both type and kind, the objective must be included in the resource request. This is done to widen the potential resource response. As an example, a resource request for a small aircraft for aerial reconnaissance of a search and rescue scene may be satisfied by a National Guard OH-58 Kiowa helicopter (type & kind: rotary-wing aircraft, Type II/III) or by a Civil Air Patrol Cessna 182 (type & kind: fixed-wing aircraft, Type I). In this example, requesting only a fixed-wing or a rotary-wing, or requesting by type may prevent the other resource's availability from being known.

A role of responsibility can be transferred during an incident for several reasons: As the incident grows a more qualified person is required to take over as Incident Commander to handle the ever-growing needs of the incident, or in reverse where as an incident reduces in size command can be passed down to a less qualified person (but still qualified to run the now-smaller incident) to free up highly qualified resources for other tasks or incidents. Other reasons to transfer command include jurisdictional change if the incident moves locations or area of responsibility, or normal turnover of personnel due to extended incidents. The transfer of command process always includes a transfer of command briefing, which may be oral, written, or a combination of both.