What Is the Incident Command System (ICS)?

This section provides a basic overview (directly below) and material on concepts and principles. It is derived from training materials distributed by the Federal Emergency Management Agency (FEMA).

ICS is the model tool for command, control, and coordination of a response and provides a means to coordinate the efforts of individual agencies as they work toward the common goal of stabilizing the incident and protecting life, property, and the environment. ICS uses principles that have been proven to improve efficiency and effectiveness in a business setting and applies the principles to emergency response.

Why do you need to know about ICS? We live in a complex world in which responding to emergencies, from single-car accidents to large-scale disasters, often requires cooperation among several agencies. In an emergency, you and other personnel from your agency may be called upon to help with the response. Given the current movement toward using an ICS structure for emergency response, it is likely, therefore, that you will function in an ICS environment.

In an emergency, you may not be working for your day-to-day supervisor, or you may be working in a different location. Thus, emergency response operations are not "business as usual." This unit will provide you with information that you will need to work in an ICS environment, including the rationale for using ICS and how ICS can be used to manage all types of incidents. It also will describe the basic ICS organization, how ICS can form the basis for an effective emergency management system, and how ICS can enhance EOC operations.

When Is ICS Used?

ICS has been proven effective for responding to all types of incidents, including:

  • Hazardous materials (HAZMAT) incidents
  • Planned events (celebrations, parades, concerts, official visits, etc.)
  • Response to natural hazards
  • Single and multiagency law enforcement incidents
  • Lack of comprehensive resource management strategy
  • Fires
  • Incidents involving multiple casualties
  • Multijurisdictional and multiagency incidents
  • Air, rail, water, or ground transportation accidents
  • Wide-area search and rescue missions
  • Private sector emergency management program

Federal law requires the use of ICS for response to HAZMAT incidents. Many States are adopting ICS as their standard for responding to all types of incidents. ICS has been endorsed by the American Public Works Association and the International Association of Chiefs of Police (IACP) and has been adopted by the National Fire Academy as its standard for incident response. ICS is included in the National Fire Protection Association (NFPA) "Recommended Practice for Disaster Management." ICS is also part of the National Interagency Incident Management System (NIIMS).

ICS History

ICS was developed in the 1970s in response to a series of major wildland fires in southern California. At that time, municipal, county, State, and Federal fire authorities collaborated to form the Firefighting Resources of California Organized for Potential Emergencies (FIRESCOPE). FIRESCOPE identified several recurring problems involving multiagency responses, such as:

  • Nonstandard terminology among responding agencies.
  • Lack of capability to expand and contract as required by the situation.
  • Nonstandard and nonintegrated communications.
  • Lack of consolidated action plans.
  • Lack of designated facilities.

Efforts to address these difficulties resulted in the development of the original ICS model for effective incident management. Although originally developed in response to wildfires, ICS has evolved into an all-risk system that is appropriate for all types of fire and non-fire emergencies. Much of the success of ICS has resulted directly from applying:

  • A common organizational structure
  • Key management principles in a standardized way

The remainder of this unit will introduce these concepts and principles.

Many incidents--whether major accidents (such as HazMat spills), minor incidents (such as house fires and utility outages), or emergencies and major disasters (such as tornadoes, hurricanes, and earthquakes)--require a response from a number of different agencies. Regardless of the size of the incident or the number of agencies involved in the response, all incidents require a coordinated effort to ensure an effective response and the efficient, safe use of resources.

No single agency or department can handle an emergency situation of any scale alone. Everyone must work together to manage the emergency. To coordinate the effective use of all of the available resources, agencies need a formalized management structure that lends consistency, fosters efficiency, and provides direction during a response. The ICS organization is built around five major components [diagram]:

  • Command
  • Planning
  • Operations
  • Logistics
  • Finance/Administration

These five major components are the foundation upon which the ICS organization develops. They apply during a routine emergency, when preparing for a major event, or when managing a response to a major disaster. In small-scale incidents, all of the components may be managed by one person, the Incident Commander. Large-scale incidents usually require that each component, or section, is set up separately. As you will see later in this unit, each of the primary ICS sections may be divided into smaller functions as needed.

The ICS organization has the capability to expand or contract to meet the needs of the incident, but all incidents, regardless of size or complexity, will have an Incident Commander. A basic ICS operating guideline is that the Incident Commander is responsible for on-scene management until command authority is transferred to another person, who then becomes the Incident Commander.

Incident Command

The command function is directed by the Incident Commander, who is the person in charge at the incident, and who must be fully qualified to manage the response. Major responsibilities for the Incident Commander include:

  • Performing command activities, such as establishing command and establishing the ICP
  • Protecting life and property
  • Controlling personnel and equipment resources
  • Maintaining accountability for responder and public safety, as well as for task accomplishment
  • Establishing and maintaining an effective liaison with outside agencies and organizations, including the EOC, when it is activated
  • Establishing command
  • Ensuring responder safety
  • Assessing incident priorities
  • Determining operational objectives
  • Developing and implementing the Incident Action Plan (Incident Action Plan)
  • Developing an appropriate organizational structure
  • Maintaining a manageable span of control
  • Managing incident resources
  • Coordinating overall emergency activities
  • Coordinating the activities of outside agencies
  • Authorizing the release of information to the media
  • Keeping track of costs

An effective Incident Commander must be assertive, decisive, objective, calm, and a quick thinker. To handle all of the responsibilities of this role, the Incident Commander also needs to be adaptable, flexible, and realistic about his or her limitations. The Incident Commander also needs to have the capability to delegate positions appropriately as needed for an incident. Initially, the Incident Commander will be the senior first-responder to arrive at the scene. As additional responders arrive, command will transfer on the basis of who has primary authority for overall control of the incident. As incidents grow in size or become more complex, the responsible jurisdiction or agency may assign a more highly qualified Incident Commander. At transfer of command, the outgoing Incident Commander must give the incoming Incident Commander a full briefing and notify all staff of the change in command.

As incidents grow, the Incident Commander may delegate authority for performing certain activities to others, as required. When expansion is required, the Incident Commander will establish other Command Staff positions: Information Officer, Safety Officer, Liaison Officer.

  • The Information Officer handles all media inquiries and coordinates the release of information to the media with the Public Affairs Officer at the EOC
  • The Safety Officer monitors safety conditions and develops measures for ensuring the safety of all assigned personnel
  • The Liaison Officer is the on-scene contact for other agencies assigned to the incident

The Incident Commander will base the decision to expand (or contract) the ICS organization on three major incident priorities:

  • Life safety. The Incident Commander's first priority is always the life safety of the emergency responders and the public.
  • Incident stability. The Incident Commander is responsible for determining the strategy that will:

Minimize the effect that the incident may have on the surrounding area.

Maximize the response effort while using resources efficiently. The size and complexity of the command system that the Incident Commander develops should be in keeping with the complexity (i.e., level of difficulty in the response) of the incident, not the size (which is based on geographic area or number of resources).

  • Property conservation. The Incident Commander is responsible for minimizing damage to property while achieving the incident objectives. As incidents become more involved, the Incident Commander can activate additional General Staff sections (that is, Planning, Operations, Logistics, and/or Finance/Administration), as necessary.

Planning Section

In smaller events, the Incident Commander is responsible for planning, but when the incident is of larger scale, the Incident Commander establishes the Planning Section. The Planning Section's function includes the collection, evaluation, dissemination, and use of information about the development of the incident and status of resources. This section's responsibilities can also include creation of the Incident Action Plan (Incident Action Plan), which defines the response activities and resource utilization for a specified time period.

Operations Section

The Operations Section Incident Command Finance/ Administration Section Logistics Section Operations Section Planning Section The Operations Section is responsible for carrying out the response activities described in the Incident Action Plan. The Operations Section Chief coordinates Operations Section activities and has primary responsibility for receiving and implementing the Incident Action Plan. The Operations Section Chief reports to the Incident Commander and determines the required resources and organizational structure within the Operations Section. The Operations Section Chief's main responsibilities are to:

  • Direct and coordinate all operations, ensuring the safety of Operations Section personnel
  • Assist the Incident Commander in developing response goals and objectives for the incident
  • Implement the Incident Action Plan
  • Request (or release) resources through the Incident Commander
  • Keep the Incident Commander informed of situation and resource status within operations

Logistics Section

The Logistics Section is responsible for providing facilities, services, and materials, including personnel to operate the requested equipment for the incident. This section takes on great significance in long-term or extended operations. It is important to note that the Logistics Section functions are geared to support the incident responders. For example, the Medical Unit in the Logistics Section provides care for the incident responders not civilian victims.

Finance Section

Though sometimes overlooked, the Finance/ Administration Section is critical for tracking incident costs and reimbursement accounting. Unless costs and financial operations are carefully recorded and justified, reimbursement of costs is difficult, if not impossible. The Finance/Administration Section is especially important when the incident is of a magnitude that may result in a Presidential Declaration. Each of these functional areas can be expanded into additional organizational units with further delegation of authority. They also may be contracted as the incident deescalates.

[top] [ICS menu] [ICS diagram]


The adaptable ICS structure is composed of major components to ensure quick and effective resource commitment and to minimize disruption to the normal operating policies and procedures of responding organizations. Remember that ICS concepts and principles have been tested and proven over time-in business and industry and by response agencies at all governmental levels. ICS training is required to ensure that all who may become involved in an incident are familiar with ICS principles. In this section you will find how the application of these concepts and principles makes ICS work. An ICS structure should include:

  • Common terminology (plain-English radio codes, area-wide standards for unit IDs)
  • A modular organization
  • Integrated communications (800 MHz radio?, common frequencies, radio patch capability)
  • Unity of command
  • A unified command structure
  • Consolidated Incident Action Plans
  • A manageable span of control
  • Designated incident facilities (alternate, mobile or consolidated comm centers)
  • Comprehensive resource management

Common terminology is essential in any emergency management system, especially when diverse or other than first-response agencies are involved in the response. When agencies have slightly different meanings for terms, confusion and inefficiency can result. Do you know what a Staging Area is? Will all responders understand what a Staging Area is? In ICS, major organizational functions, facilities, and units are predesignated and given titles. ICS terminology is standard and consistent among all of the agencies involved. To prevent confusion when multiple incidents occur at the same time within the same For example, an incident that occurs at 14th and Flower might be called "Flower Street Command." One that occurs at 14th and Penn could be called "Penn Street Command." Other guidelines for establishing common terminology include:

  • Response personnel should use common names for all personnel and equipment resources, as well as for all facilities in and around the incident area
  • Radio transmissions should use clear text (that is, plain English, without "ten" codes or agency-specific codes)

All common terminology applies to all organizational elements, position titles, and resources. A modular organization develops from the top-down organizational structure at any incident. "Top-down" means that, at the very least, the Command function is established by the first-arriving officer who becomes the Incident Commander. As the incident warrants, the Incident Commander activates other functional areas (i.e., sections).

In approximately 95 percent of all incidents, the organizational structure for operations consists of command and single resources (e.g., one fire truck, an ambulance, or a tow truck). If needed, however, the ICS structure can consist of several layers. Integrated communications is a system that uses a common communications plan, standard operating procedures, clear text, common frequencies, and common terminology. Several communication networks may be established, depending on the size and complexity of the incident.

Unity of command is the concept by which each person within an organization reports to only one designated person. A unified command allows all agencies with responsibility for the incident, either geographic or functional, to manage an incident by establishing a common set of incident objectives and strategies. Unified command does not mean losing or giving up agency authority, responsibility, or accountability. The concept of unified command means that all involved agencies contribute to the command process by:

  • Determining overall objectives
  • Planning jointly for operational activities while conducting integrated operations
  • Maximizing the use of all assigned resources

Under unified command, the following always apply:

  • The incident functions under a single, coordinated Incident Action Plan
  • One Operations Section Chief has responsibility for implementing the Incident Action Plan
  • One ICP is established

Some examples of how unified command is applied are shown in the visual below. Consolidated Incident Action Plans describe response goals, operational objectives, and support activities. The decision to have a written Incident Action Plan is made by the Incident Commander. ICS requires written plans whenever:

  • Resources from multiple agencies are used
  • Several jurisdictions are involved
  • The incident is complex (e.g., changes in shifts of personnel or equipment are required)

Incident Action Plans should cover all objectives and support activities that are needed during the entire operational period. A written plan is preferable to an oral plan because it clearly demonstrates responsibility, helps protect the community from liability suits, and provides documentation when requesting State and Federal assistance. Incident Action Plans that include the measurable goals and objectives to be achieved are always prepared around a timeframe called an operational period. Operational periods can be of various lengths, but should be no longer than 24 hours. Twelve-hour operational periods are common for large-scale incidents. The Incident Commander determines the length of the operational period based on the complexity and size of the incident. A manageable span of control is defined as the number of individuals one supervisor can manage effectively. In ICS, the span of control for any supervisor falls within a range of three to seven resources, with five being the optimum. If those numbers increase or decrease, the Incident Commander should reexamine the organizational structure.

Designated incident facilities include:

  • An ICP at which the Incident Commander, the Command Staff, and the General Staff oversee all incident operations.
  • Staging Areas at which resources are kept while awaiting incident assignment. Other incident facilities may be designated for incidents that are geographically dispersed, require large numbers of resources, or require highly specialized resources.

Comprehensive resource management:

  • Maximizes resource use
  • Consolidates control of single resources
  • Reduces the communications load
  • Provides accountability
  • Reduces freelancing
  • Ensures personnel safet

All resources are assigned to a status condition.

  • Assigned resources are performing active functions.
  • Available resources are ready for assignment.

Out-of-service resources are not ready for assigned or available status. Any changes in resource location and status must be reported promptly to the Resource Unit by the person making the change. Personnel accountability is provided throughout all of ICS. All personnel must check in as soon as they arrive at an incident. Resource units, assignment lists, and unit logs are all ways for personnel to be accounted for. When personnel are no longer required for the response, they must check out so that they can be removed from the resource lists. The ICS principles can and should be used for all types of incidents, both small and large-from a warrant execution to a hostage situation or a search for a missing child. Because ICS can be used at virtually any type of incident of any size, it is important that all responders use the ICS approach.

[top] [ICS menu] [ICS diagram]