Introduction to the Incident Command System

A worksheet introducing the Incident Command System.

The Incident Command System (ICS) is a highly standardized, top-down, military-based management structure that supersedes the management structure of every other agency that responds to an event. This management tool is used to meet the demands of small or large emergency and nonemergency situations. It represents best practices and has become the standard for emergency management across the United States.

ICS standardizes position titles, responsibilities, and terminology. It uses titles that aren’t necessarily used in regular jobs, and it’s very clear about what responsibilities are. Benefits of the system are that it establishes common processes for planning and managing resources and that it allows for the integration of facilities, equipment, personnel, procedures, and communications operating within a common organization structure.


The full organization of the ICS structure is large. However, the full organization is rarely implemented. The organization can expand and contract depending on how many people are needed at any given moment. In a large crisis, like Hurricane Katrina, the whole structure could be implemented, but in a smaller incident, only one, two, or three of these positions might be filled. One person can fill more than one role. The rule of thumb is that every role that is left vacant is filled by the role above it. The Incident Commander is always the first position created (and sometimes the only position created), and it’s always the last position demobilized. Generally, an Incident Commander will appoint a command staff and general staff.

These three command staff positions are meant to shield the Incident Commander from getting too much information or getting too bogged down with little decisions, so that he/she can focus on the overall response instead.

Command Staff Positions:

Public Information Officer (PIO)
• Advises the Incident Commander on information dissemination and media relations (note that the Incident Commander approves information that the PIO releases).
• Obtains information from and provides information to the Planning Section.
• Obtains information from and provides information to the community and media.

Safety Officer
• Advises the Incident Commander on issues regarding incident safety.
• Works with the Operations Section to ensure safety of field personnel.
• Ensures the safety of all incident personnel.

Liaison Officer
Assists the Incident Commander by serving as a point of contact for representatives from other response organizations.
• Briefs and answers questions from supporting organizations.

The general staff fall into four different sections. Each section is responsible for a major functional area of the incident. There is typically one Section Chief, who, depending on the size of the disaster, can appoint more staff below him/her.

General Staff Sections:

Operations Section
• The first (and sometimes only) section created.
• Directs and coordinates all incident tactical operations.

Planning Section
• Collects, evaluates, and displays incident intelligence and information.
• Prepares and documents Incident Action Plans.
• Tracks resources assigned to the incident.
• Maintains incident documentation.
• Develops plans for demobilization.

Logistics Section
• Orders, obtains, maintains, and accounts for essential personnel, equipment, and supplies.
• Provides communication planning and resources.

Finance/Administration Section
• Negotiates and monitors contracts.
• Performs timekeeping.
• Analyzes cost.
• Arranges compensation for injury or damage to property.
• Documents reimbursement (e.g. under memorandums of understanding - MOUs).

Further Reading

Carmicheal, David W., Implementing the Incident Command System at the Institutional Level: A Handbook for Libraries, Archives Museum, and Other Cultural Institutions. Heritage Preservation and, 2010.

FEMA Emergency Management Institute, ICS-100: Introduction to the Incident Command System.


Agency: A division of government with a specific function offering a particular kind of assistance. In the Incident Command System, agencies are defined either as jurisdictional (having statutory responsibility for incident management) or as assisting or cooperating (providing resources or other assistance). Governmental organizations are most often in charge of an incident, though in certain circumstances private sector organizations may be included. Additionally, nongovernmental organizations may be included to provide support.

Area Command: An organization established to oversee the management of multiple incidents that are each being handled by a separate Incident Command System organization or to oversee the management of a very large or evolving incident that has multiple incident management teams engaged. An agency administrator/executive or other public official with jurisdictional responsibility for the incident usually makes the decision to establish an Area Command. An Area Command is activated only if necessary, depending on the complexity of the incident and incident management span-of-control considerations.

Assistant: Title for subordinates of the command staff positions. The title indicates a level of technical capability, qualifications, and responsibility subordinate to the primary positions. Assistants may also be assigned to Unit Leaders.

Assisting agency: An agency or organization providing personnel, services, or other resources to the agency with direct responsibility for incident management.

Badging: The assignment of physical incident-specific credentials to establish legitimacy and limit access to various incident sites.

Branch: The organizational level having functional or geographical responsibility for major aspects of incident operations. A Branch is organizationally situated between the Section Chief and the Division or Group in the Operations Section, and between the Section and Units in the Logistics Section. Branches are identified by the use of Roman numerals or by functional area.

Camp: A geographical site, within the general incident area, separate from the Incident Base, equipped and staffed to provide sleeping, food, water, and sanitary services to incident personnel.

Chain of command: The orderly line of authority within the ranks of the incident management organization.

Chief: The Incident Command System title for individuals responsible for management of functional Sections: Operations, Planning, Logistics, Finance/Administration, and Intelligence/Investigations (if established as a separate Section).

Command staff: The staff who report directly to the Incident Commander, including the Public Information Officer, Safety Officer, Liaison Officer, and other positions as required. They may have an assistant or assistants, as needed.

Common operating picture: An overview of an incident by all relevant parties that provides incident information enabling the Incident Commander/Unified Command and any supporting agencies and organizations to make effective, consistent, and timely decisions.

Cooperating agency: An agency supplying assistance other than direct operational or support functions or resources to the incident management effort.

Demobilization: The orderly, safe, and efficient return of an incident resource to its original location and status.

Deputy: A fully qualified individual who, in the absence of a superior, could be delegated the authority to manage a functional operation or perform a specific task. In some cases, a Deputy could act as relief for a superior and therefore must be fully qualified in the position. Deputies can be assigned to the Incident Commander, General Staff, and Branch Directors.

Director: The Incident Command System title for individuals responsible for supervision of a Branch.

Dispatch: The ordered movement of a resource or resources to an assigned operational mission, or an administrative move from one location to another.

Division: The organizational level having responsibility for operations within a defined geographic area. Divisions are established when the number of resources exceeds the manageable span of control of the Section Chief. See Group.

Emergency management/response personnel: Includes Federal, State, territorial, tribal, sub state regional, and local governments, private-sector organizations, critical infrastructure owners and operators, nongovernmental organizations, and all other organizations and individuals who assume an emergency management role. Also known as emergency responders.

Emergency Operations Center (EOC): The physical location at which the coordination of information and resources to support incident management (on-scene operations) activities normally takes place. An EOC may be a temporary facility or may be located in a more central or permanently-established facility, perhaps at a higher level of organization within a jurisdiction. EOCs may be organized by major functional disciplines (e.g., fire, law enforcement, and medical services), by jurisdiction (e.g., Federal, State, regional, tribal, city, and county), or some combination thereof.

Emergency Operations Plan (EOP): An ongoing plan for responding to a wide variety of potential hazards.

Field operations guide: Durable pocket or desk guide that contains essential information required to perform specific assignments or functions.

Finance/Administration Section: The Incident Command System Section responsible for all administrative and financial considerations surrounding an incident.

Function: One of the five major activities in the Incident Command System: Command, Operations, Planning, Logistics, and Finance/Administration. A sixth function, Intelligence/Investigations, may be established, if required, to meet incident management needs. The term is also used when describing the activity involved (e.g., the planning function).

General staff: A group of incident management personnel organized according to function and reporting to the Incident Commander. The general staff normally consists of the Operations Section Chief, Planning Section Chief, Logistics Section Chief, and Finance/Administration Section Chief. An Intelligence/Investigations Chief may be established, if required, to meet incident management needs.

Group: An organizational subdivision established to divide the incident management structure into functional areas of operation. Groups are composed of resources assembled to perform a special function not necessarily within a single geographic division. See Division.

Incident Action Plan (IAP): An oral or written plan containing general objectives reflecting the overall strategy for managing an incident. It may include the identification of operational resources and assignments. It may also include attachments that provide direction and important information for management of the incident during one or more operational periods.

Incident Base: The location at which primary Logistics functions for an incident are coordinated and administered. There is only one Base per incident. (Incident name or other designator will be added to the term Base.) The Incident Base may be co-located with the Incident Command Post.

Incident Command: The Incident Command System organizational element responsible for overall management of the incident and consisting of the Incident Commander (either single or unified command structure) and any assigned supporting staff.

Incident Commander (IC): The individual responsible for all incident activities, including the development of strategies and tactics and the ordering and the release of resources. The IC has overall authority and responsibility for conducting incident operations and is responsible for the management of all incident operations at the incident site.

Incident Command Post (ICP): The field location where the primary functions are performed. The ICP may be co-located with the Incident Base or other incident facilities.

Incident Command System (ICS): A standardized on-scene emergency management construct specifically designed to provide for the adoption of an integrated organizational structure that reflects the complexity and demands of single or multiple incidents, without being hindered by jurisdictional boundaries. ICS is the combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure, designed to aid in the management of resources during incidents. It is used for all kinds of emergencies and is applicable to small as well as large and complex incidents. ICS is used by various jurisdictions and functional agencies, both public and private, to organize field-level incident management operations.

Incident management: The broad spectrum of activities and organizations providing effective and efficient operations, coordination, and support applied at all levels of government, utilizing both governmental and nongovernmental resources to plan for, respond to, and recover from an incident, regardless of cause, size, or complexity.

Incident Management Team (IMT): An Incident Commander and the appropriate command and general staff personnel assigned to an incident. The level of training and experience of the IMT members, coupled with the identified formal response requirements and responsibilities of the IMT, are factors in determining “type,” or level, of IMT.

Joint Information Center (JIC): A facility established to coordinate all incident-related public information activities. It is the central point of contact for all news media at the scene of the incident. Public information officials from all participating agencies should co-locate at the JIC.

Joint Information System (JIS): A structure that integrates incident information and public affairs into a cohesive organization designed to provide consistent, coordinated, accurate, accessible, timely, and complete information during crisis or incident operations. The mission of the JIS is to provide a structure and system for developing and delivering coordinated interagency messages; developing, recommending, and executing public information plans and strategies on behalf of the Incident Commander (IC); advising the IC concerning public affairs issues that could affect a response effort; and controlling rumors and inaccurate information that could undermine public confidence in the emergency response effort.

Jurisdiction: A range or sphere of authority. Public agencies have jurisdiction at an incident related to their legal responsibilities and authority. Jurisdictional authority at an incident can be political or geographical (e.g., city, county, tribal, State, or Federal boundary lines) or functional (e.g., law enforcement or public health).

Liaison Officer (LNO): A member of the command staff responsible for coordinating with representatives from cooperating and assisting agencies or organizations.

Logistics Section: The Incident Command System Section responsible for providing facilities, services, and materials for the incident.

Management by objectives: A management approach that involves a five-step process for achieving the incident goal. The Management by Objectives approach includes the following: establishing overarching incident objectives; developing strategies based on overarching incident objectives; developing and issuing assignments, plans, procedures, and protocols; establishing specific, measurable tactics or tasks for various incident management functional activities and directing efforts to attain them, in support of defined strategies; and documenting results to measure performance and facilitate corrective action.

Manager: Individual within an Incident Command System organizational unit who is assigned specific managerial responsibilities (e.g., Staging Area Manager or Camp Manager).

Mission Assignment: The mechanism used to support Federal operations in a Stafford Act major disaster or emergency declaration. It orders immediate, short-term emergency response assistance when an applicable State or local government is overwhelmed by the event and lacks the capability to perform, or contract for, the necessary work. See also PreScripted Mission Assignment.

Mitigation: Activities providing a critical foundation in the effort to reduce the loss of life and property from natural and/or manmade disasters by avoiding or lessening the impact of a disaster and providing value to the public by creating safer communities. Mitigation seeks to fix the cycle of disaster damage, reconstruction, and repeated damage. These activities or actions, in most cases, will have a long-term sustained effect.

Mobilization: The process and procedures used by all organizations—Federal, State, tribal, and local— for activating, assembling, and transporting all resources that have been requested to respond to or support an incident.

Multiagency Coordination (MAC) Group: A group of administrators or executives, or their appointed representatives, who are typically authorized to commit agency resources and funds. A MAC Group can provide coordinated decision-making and resource allocation among cooperating agencies, and may establish the priorities among incidents, harmonize agency policies, and provide strategic guidance and direction to support incident management activities. MAC Groups may also be known as multiagency committees, emergency management committees, or as otherwise defined by the Multiagency Coordination System.

Multiagency Coordination Systems (MACS): A system that provides the architecture to support coordination for incident prioritization, critical resource allocation, communications systems integration, and information coordination. MACS assist agencies and organizations responding to an incident. The elements of a MACS include facilities, equipment, personnel, procedures, and communications. Two of the most commonly used elements are Emergency Operations Centers and MAC Groups.

Multijurisdictional incident: An incident requiring action from multiple agencies that each have jurisdiction to manage certain aspects of an incident. In the Incident Command System, these incidents will be managed under a Unified Command.

Mutual aid or Assistance agreement: Written or oral agreement between and among agencies/organizations and/or jurisdictions that provides a mechanism to quickly obtain emergency assistance in the form of personnel, equipment, materials, and other associated services. The primary objective is to facilitate rapid, short-term deployment of emergency support prior to, during, and/or after an incident.

National Incident Management System (NIMS): A set of principles that provides a systematic, proactive approach guiding government agencies at all levels, nongovernmental organizations, and the private sector to work seamlessly to prevent, protect against, respond to, recover from, and mitigate the effects of incidents, regardless of cause, size, location, or complexity, in order to reduce the loss of life or property and harm to the environment.

National Response Framework (NRF): A guide to how the United States conducts allhazards response.

Officer: The Incident Command System title for the person responsible for one of the command staff positions of Safety, Liaison, and Public Information.

Operational period: The time scheduled for executing a given set of operation actions, as specified in the Incident Action Plan. Operational periods can be of various lengths, although usually they last 12 to 24 hours.

Operations Section: The Incident Command System Section responsible for all tactical incident operations and implementation of the Incident Action Plan. In the Incident Command System, the Operations Section normally includes subordinate Branches, Divisions, and/or Groups.

Planning Section: The Incident Command System Section responsible for the collection, evaluation, and dissemination of operational information related to the incident, and for the preparation and documentation of the Incident Action Plan. This Section also maintains information on the current and forecasted situation and on the status of resources assigned to the incident.

Pre-positioned resource: A resource moved to an area near the expected incident site in response to anticipated resource needs.

Preparedness: A continuous cycle of planning, organizing, training, equipping, exercising, evaluating, and taking corrective action in an effort to ensure effective coordination during incident response. Within the National Incident Management System, preparedness focuses on the following elements: planning; procedures and protocols; training and exercises; personnel qualification and certification; and equipment certification.

Prevention: Actions to avoid an incident or to intervene to stop an incident from occurring. Prevention involves actions to protect lives and property. It involves applying intelligence and other information to a range of activities that may include such countermeasures as deterrence operations; heightened inspections; improved surveillance and security operations; investigations to determine the full nature and source of the threat; public health and agricultural surveillance and testing processes; immunizations, isolation, or quarantine; and, as appropriate, specific law enforcement operations aimed at deterring, preempting, interdicting, or disrupting illegal activity and apprehending potential perpetrators and bringing them to justice.

Public Information Officer (PIO): A member of the command staff responsible for interfacing with the public and media and/or with other agencies with incident-related information requirements.

Resources: Personnel and major items of equipment, supplies, and facilities available or potentially available for assignment to incident operations and for which status is maintained. Resources are described by kind and type and may be used in operational support or supervisory capacities at an incident or at an emergency operations center.

Response: Activities that address the short-term, direct effects of an incident. Response includes immediate actions to save lives, protect property, and meet basic human needs. Response also includes the execution of emergency operations plans and of mitigation activities designed to limit the loss of life, personal injury, property damage, and other unfavorable outcomes. As indicated by the situation, response activities include applying intelligence and other information to lessen the effects or consequences of an incident; increased security operations; continuing investigations into nature and source of the threat; ongoing public health and agricultural surveillance and testing processes; immunizations, isolation, or quarantine; and specific law enforcement operations aimed at preempting, interdicting, or disrupting illegal activity, and apprehending actual perpetrators and bringing them to justice.

Retrograde: To return resources back to their original location.

Safety Officer: A member of the command staff responsible for monitoring incident operations and advising the Incident Commander on all matters relating to operational safety, including the health and safety of emergency responder personnel.

Section: The Incident Command System organizational level having responsibility for a major functional area of incident management (e.g., Operations, Planning, Logistics, Finance/Administration, and Intelligence/Investigations (if established)). The Section is organizationally situated between the Branch and the Incident Command.

Single resource: An individual, a piece of equipment and its personnel complement, or a crew/team of individuals with an identified work supervisor that can be used on an incident.

Span of control: The number of resources for which a supervisor is responsible, usually expressed as the ratio of supervisors to individuals (under the National Incident Management System, an appropriate span of control is between 1:3 and 1:7, with optimal being 1:5; or between 1:8 and 1:10 for many largescale law enforcement operations).

Staging Area: Temporary location for available resources. A Staging Area can be any location in which personnel, supplies, and equipment can be temporarily housed or parked while awaiting operational assignment.

Standard operating guidelines: A set of instructions having the force of a directive, covering those features of operations which lend themselves to a definite or standardized procedure without loss of effectiveness.

Standard Operating Procedure (SOP): A complete reference document or an operations manual that provides the purpose, authorities, duration, and details for the preferred method of performing a single function or a number of interrelated functions in a uniform manner.

Strike Team: A set number of resources of the same kind and type that have an established minimum number of personnel, common communications, and a leader.

Supervisor: The Incident Command System title for an individual responsible for a Division or Group.

Supporting agency: An agency that provides support and/or resource assistance to another agency. See Assisting agency.

Supporting technology: Any technology that may be used to support the National Incident Management System, such as orthophoto mapping, remote automatic weather stations, infrared technology, or communications.

Task Force: Any combination of resources assembled to support a specific mission or operational need. All resource elements within a Task Force must have common communications and a designated leader.

Tracking and reporting resources: A standardized, integrated process conducted throughout the duration of an incident. This process provides incident managers with a clear picture of where resources are located; helps staff prepare to receive resources; protects the safety of personnel and security or supplies and equipment; and enables the coordination of movement of personnel, equipment, and supplies.

Unified Area Command: Version of command established when incidents under an Area Command are multijurisdictional. See Area Command.

Unified Command (UC): An Incident Command System application used when more than one agency has incident jurisdiction or when incidents cross political jurisdictions. Agencies work together through the designated members of the UC, often the senior persons from agencies and/or disciplines participating in the UC, to establish a common set of objectives and strategies and a single Incident Action Plan.

Unit: The organizational element with functional responsibility for a specific incident Planning, Logistics, or Finance/Administration activity.

Unit Leader: The individual in charge of managing Units within an Incident Command System functional Section. The Unit can be staffed by a number of support personnel providing a wide range of services. Some of the support positions are preestablished within the Incident Command System (e.g., Base/Camp Manager), but many others will be assigned as technical specialists.

Unity of command: An Incident Command System principle stating that each individual involved in incident operations will be assigned to only one supervisor.