Incident Command System

ICS basic organization chart (ICS-100 level depicted)

The Incident Command System (ICS) is a standardized approach to the command, control, and coordination of emergency response providing a common hierarchy within which responders from multiple agencies can be effective.[1]

ICS was initially developed to address problems of inter-agency responses to wildfires in California and Arizona but is now a component of the National Incident Management System (NIMS)[2] in the US, where it has evolved into use in All-Hazards situations, ranging from active shootings to HazMat scenes.[3] In addition, ICS has acted as a pattern for similar approaches internationally.[4]


ICS consists of a standard management hierarchy and procedures for managing temporary incident(s) of any size. ICS procedures should be pre-established and sanctioned by participating authorities, and personnel should be well-trained prior to an incident.[5]

ICS includes procedures to select and form temporary management hierarchies to control funds, personnel, facilities, equipment, and communications. Personnel are assigned according to established standards and procedures previously sanctioned by participating authorities. ICS is a system designed to be used or applied from the time an incident occurs until the requirement for management and operations no longer exist.

ICS is interdisciplinary and organizationally flexible to meet the following management challenges:


The ICS concept was formed in 1968 at a meeting of Fire Chiefs in Phoenix, Arizona. The program was built primarily to take after the management hierarchy of the US Navy and it was mainly for fire fighting of wildfires in California and Arizona. During the 1970s, ICS was fully developed during massive wildfire suppression efforts in California (FIRESCOPE) that followed a series of catastrophic wildfires, starting with the massive Laguna fire in 1970. Property damage ran into the millions, and many people died or were injured. Studies determined that response problems often related to communication and management deficiencies rather than lack of resources or failure of tactics.[6][7]

Weaknesses in incident management were often due to:

Emergency Managers determined that the existing management structures — frequently unique to each agency — did not scale to dealing with massive mutual aid responses involving dozens of distinct agencies and when these various agencies worked together their specific training and procedures clashed. As a result, a new command and control paradigm was collaboratively developed to provide a consistent, integrated framework for the management of all incidents from small incidents to large, multi-agency emergencies.

It should be noted that at the beginning of this work, despite the recognition that there were incident or field level shortfalls in organization and terminology, there was no mention of the need to develop an on the ground incident management system like ICS. Most of the efforts were focused on the multiagency coordination challenges above the incident or field level. It wasn’t until 1972 when Firefighting Resources of Southern California Organized for Potential Emergencies (FIRESCOPE) was formed that this need was recognized and the concept of ICS was first discussed. Also, ICS was originally called Field Command Operations System.[8]

ICS became a national model for command structures at a fire, crime scene or major incident. ICS was used in New York at the first attack on the World Trade Center in 1993. On 1 March 2004, the Department of Homeland Security, in accordance with the passage of Homeland Security Presidential Directive 5 (HSPD-5) calling for a standardized approach to incident management amongst all federal, state, and local agencies, developed the National Incident Management System (NIMS) which integrates ICS. Additionally, it was mandated that NIMS (and thus ICS) must be utilized to manage emergencies in order to receive federal funding.

The Superfund Amendment and Re-authorization Act title III mandated that all first responders to a hazardous materials emergency must be properly trained and equipped in accordance with 29 CFR 1910.120(q). This standard represents OSHA's recognition of ICS.[9]

HSPD-5 and thus the National Incident Management System came about as a direct result of the terrorist attacks on 11 September 2001, which created numerous All-Hazard, Mass Casualty, multi-agency incidents.[10]

Jurisdiction and legitimacy[]

In the United States, ICS has been tested by more than 30 years of emergency and non-emergency applications. All levels of government are required to maintain differing levels of ICS training and private sector organizations regularly use ICS for management of events. ICS is widespread in use from law enforcement to every-day business, as the basic goals of clear communication, accountability, and the efficient use of resources are common to incident and emergency management as well as daily operations. ICS is mandated by law for all Hazardous Materials responses nationally and for many other emergency operations in most states. In practice, virtually all EMS and disaster response agencies utilize ICS, in part after the United States Department of Homeland Security mandated the use of ICS for emergency services throughout the United States as a condition for federal preparedness funding. As part of FEMA's National Response Plan (NRP), the system was expanded and integrated into the National Incident Management System (NIMS).

ICS is widely used in the United Kingdom and the United Nations recommended the use of ICS as an international standard. ICS is also used by agencies in Canada.[11]

New Zealand has implemented a similar system, known as the Coordinated Incident Management System, Australia has the Australasian Inter-Service Incident Management System and British Columbia, Canada, has BCERMS developed by the Emergency Management BC.

In Brazil, ICS is also used by The Fire Department of the State of Rio de Janeiro (CBMERJ) and by the Civil Defense of the State of Rio de Janeiro in every emergency or large-scale events.



Incidents are defined within ICS as unplanned situations necessitating a response. Examples of incidents may include:


Events are defined within ICS as planned situations. Incident command is increasingly applied to events both in emergency management and non-emergency management settings. Examples of events may include:

Key concepts[]

Unity of command[]

Each individual participating in the operation reports to only one supervisor. This eliminates the potential for individuals to receive conflicting orders from a variety of supervisors, thus increasing accountability, preventing freelancing, improving the flow of information, helping with the coordination of operational efforts, and enhancing operational safety. This concept is fundamental to the ICS chain of command structure.[12]

Common terminology[]

Individual response agencies previously developed their protocols separately, and subsequently developed their terminology separately. This can lead to confusion as a word may have a different meaning for each organization.

When different organizations are required to work together, the use of common terminology is an essential element in team cohesion and communications, both internally and with other organizations responding to the incident.

An incident command system promotes the use of a common terminology and has an associated glossary of terms that help bring consistency to position titles, the description of resources and how they can be organized, the type and names of incident facilities, and a host of other subjects. The use of common terminology is most evident in the titles of command roles, such as Incident Commander, Safety Officer or Operations Section Chief.[12]

Management by objective[]

Incidents are managed by aiming towards specific objectives. Objectives are ranked by priority; should be as specific as possible; must be attainable; and if possible given a working time-frame. Objectives are accomplished by first outlining strategies (general plans of action), then determining appropriate tactics (how the strategy will be executed) for the chosen strategy.[12]

Flexible and modular organization[]

Incident Command structure is organized in such a way as to expand and contract as needed by the incident scope, resources and hazards. Command is established in a top-down fashion, with the most important and authoritative positions established first. For example, Incident Command is established by the first arriving unit.

Only positions that are required at the time should be established. In most cases, very few positions within the command structure will need to be activated. For example, a single fire truck at a dumpster fire will have the officer filling the role of IC, with no other roles required. As more trucks get added to a larger incident, more roles will be delegated to other officers and the Incident Commander (IC) role will probably be handed to a more-senior officer.

Only in the largest and most complex operations would the full ICS organization be staffed.[12] Conversely, as an incident scales down, roles will be merged back up the tree until there is just the IC role remaining.

Span of control[]

To limit the number of responsibilities and resources being managed by any individual, the ICS requires that any single person's span of control should be between three and seven individuals, with five being ideal. In other words, one manager should have no more than seven people working under them at any given time. If more than seven resources are being managed by an individual, then they are being overloaded and the command structure needs to be expanded by delegating responsibilities (e.g. by defining new sections, divisions, or task forces). If fewer than three, then the position's authority can probably be absorbed by the next highest rung in the chain of command.[12]


One of the benefits of the ICS is that it allows a way to coordinate a set of organizations who may otherwise work together sporadically. While much training material emphasizes the hierarchical aspects of the ICS, it can also be seen as an inter-organizational network of responders. These network qualities allow the ICS flexibility and expertise of a range of organizations. But the network aspects of the ICS also create management challenges. One study of ICS after-action reports found that ICS tended to enjoy higher coordination when there was strong pre-existing trust and working relationships between members, but struggled when authority of the ICS was contested and when the networks of responders was highly diverse.[13] Coordination on any incident or event is facilitated with the implementation of the following concepts:

Incident Action Plans[]

Incident Action Plans (IAPs) ensure that everyone is working in concert toward the same goals set for that operational period by providing all incident supervisory personnel with direction for actions to be taken during the operational period identified in the plan. Incident Action Plans provide a coherent means of communicating the overall incident objectives for both operational and support activities. They include measurable strategic objectives to be achieved in a time frame called an Operational Period, which may be any interval of time but is commonly 12 hours. They may be verbal or written except for hazardous material incidents where it must be written,[14] and are prepared by the Planning Section.

The consolidated IAP is a very important component of the ICS that reduces freelancing and ensures a coordinated response. At the simplest level, all Incident Action Plans must have four elements:

The content of the IAP is organized by a number of standardized ICS forms that allow for accurate and precise documentation of an incident.[15]

FEMA ICS forms[]

Example modified ICS forms[]

ICS-202 (EMSI, Inc.)

ICS Forms in Spanish

US Coast Guard ICS Forms

Comprehensive resource management[]

Comprehensive resource management is a key management principle that implies that all assets and personnel during an event need to be tracked and accounted for. It can also include processes for reimbursement for resources, as appropriate. Resource management includes processes for:

Comprehensive resource management ensures that visibility is maintained over all resources so they can be moved quickly to support the preparation and response to an incident, and ensuring a graceful demobilization. It also applies to the classification of resources by type and kind, and the categorization of resources by their status.

T-Cards (ICS 219, Resource Status Card) are most commonly used to track these resources. The cards are placed in T-Card racks located at an Incident Command Post for easy updating and visual tracking of resource status.

Integrated communications[]

Developing an integrated voice and data communications system, including equipment, systems, and protocols, must occur prior to an incident.

Effective ICS communications include three elements:


Incident commander[]

Command staff[]

General Staff[]

200-Level ICS[]

At the ICS 200 level, the function of Information and Intelligence is added to the standard ICS staff as an option. This role is unique in ICS as it can be arranged in multiple ways based on the judgement of the Incident Commander and needs of the incident. The three possible arrangements are:

300-Level ICS[]

At the ICS 300 level, the focus is on entry-level management of small-scale, All-Hazards incidents with emphasis on the scalability of ICS. It acts as an introduction to the utilization of more than one agency and the possibility of numerous operational periods. It also involves an introduction to the Emergency Operations Center.[20]

400-Level ICS[]

At the ICS 400 level, the focus is on large, complex incidents. Topics covered include the characteristics of incident complexity, the approaches to dividing an incident into manageable components, the establishment of an "Area Command", and the MultiAgency Coordination System (MACS).



ICS is organized by levels, with the supervisor of each level holding a unique title (e.g. only a person in charge of a Section is labeled "Chief"; a "Director" is exclusively the person in charge of a Branch). Levels (supervising person's title) are:

  • Incident Commander
  • Command Staff Member (Officer)- Command Staff
  • Section (Chief)- General Staff
  • Branch (Director)
  • Division (Supervisor) - A Division is a unit arranged by geography, along jurisdictional lines if necessary, and not based on the makeup of the resources within the Division.
  • Group (Supervisor) - A Group is a unit arranged for a purpose, along agency lines if necessary, or based on the makeup of the resources within the Group.
  • Unit, Team, or Force (Leader) - Such as "Communications Unit," "Medical Strike Team," or a "Reconnaissance Task Force." A Strike Team is composed of same resources (four ambulances, for instance) while a Task Force is composed of different types of resources (one ambulance, two fire trucks, and a police car, for instance).
  • Individual Resource. This is the smallest level within ICS and usually refers to a single person or piece of equipment. It can refer to a piece of equipment and operator, and less often to multiple people working together.


ICS uses a standard set of facility nomenclature. ICS facilities include: Pre-Designated Incident Facilities: Response operations can form a complex structure that must be held together by response personnel working at different and often widely separate incident facilities. These facilities can include:

Each facility has unique location, space, equipment, materials, and supplies requirements that are often difficult to address, particularly at the outset of response operations. For this reason, responders should identify, pre-designate and pre-plan the layout of these facilities, whenever possible.

On large or multi-level incidents, higher-level support facilities may be activated. These could include:


ICS uses a standard set of equipment nomenclature. ICS equipment include:

Type and kind[]

The "type" of resource describes the size or capability of a resource. For instance, a 50 kW (for a generator) or a 3-ton (for a truck). Types are designed to be categorized as "Type 1" through "Type 5" formally, but in live incidents more specific information may be used.

The "kind" of resource describes what the resource is. For instance, generator or a truck. The "type" of resource describes a performance capability for a kind of resource for instance,

In both type and kind, the objective must be included in the resource request. This is done to widen the potential resource response. As an example, a resource request for a small aircraft for aerial reconnaissance of a search and rescue scene may be satisfied by a National Guard OH-58 Kiowa helicopter (Type & Kind: Rotary-wing aircraft, Type II/III) or by a Civil Air Patrol Cessna 182 (Type & Kind: Fixed-wing aircraft, Type I). In this example, requesting only a fixed-wing or a rotary-wing, or requesting by type may prevent the other resource's availability from being known.

Command transfer[]

A role of responsibility can be transferred during an incident for several reasons: As the incident grows a more qualified person is required to take over as Incident Commander to handle the ever-growing needs of the incident, or in reverse where as an incident reduces in size command can be passed down to a less qualified person (but still qualified to run the now-smaller incident) to free up highly qualified resources for other tasks or incidents. Other reasons to transfer command include jurisdictional change if the incident moves locations or area of responsibility, or normal turnover of personnel due to extended incidents. The transfer of command process always includes a transfer of command briefing, which may be oral, written, or a combination of both.

See also[]


  1. ^ "Glossary: Simplified Guide to the Incident Command System for Transportation Professionals". Federal Highway Administration, Office of Operations. Retrieved 24 October 2018.
  2. ^ "Chapter 7: THE INCIDENT COMMAND SYSTEM (ICS)". Center for Excellence in Disaster Management & Humanitarian Assistance. Archived from the original on 23 April 2008. Retrieved 23 September 2009.
  3. ^ Bigley, Gregory; Roberts, Karlene (Dec 2001). "The Incident Command System: High-Reliability Organizing for Complex and Volatile Task Environments" (PDF). The Academy of Management Journal. Academy of Management. 44 (6): 1281–1299. Retrieved 2015-09-25.
  4. ^ Dara, Saqib; Ashton, Rendell; Farmer, Christopher; Carlton, Paul (Jan 2005). "Worldwide disaster medical response: An historical perspective". Critical Care Medicine. 33 (1): S2–S6. doi:10.1097/01.CCM.0000151062.00501.60. Retrieved 2015-09-25.
  5. ^ Werman, Howard A.; Karren, K; Mistovich, Joseph (2014). "National Incident Management System:Incident Command System". In Werman A. Howard; Mistovich J; Karren K. Prehospital Emergency Care, 10e. Pearson Education, Inc. p. 1217.
  6. ^ "Standardized Emergency Management System (SEMS) Guidelines". State of California, Office of Emergency Services. Retrieved 2009-07-16.
  7. ^ "Standardized Emergency Management System (SEMS): Introductory Course of Instruction, Student Reference Manual". County of Santa Clara, California. Retrieved 2009-07-16.
  8. ^ "EMSI: A Working History of the Incident Command System". Emergency Management Services International (EMSI). Retrieved 2016-01-13.
  9. ^ "Hazardous waste operations and emergency response". Occupational Safety and Health. Retrieved 2015-09-25.
  10. ^ Jamieson, Gil (May 2005). "NIMS AND THE INCIDENT COMMAND SYSTEM". 2005 (1): 291–294. doi:10.7901/2169-3358-2005-1-291. Retrieved 2015-09-25.
  11. ^ Alberta Health Services website on ICS
  12. ^ a b c d e Emergency management Institute. "IS-200: ICS for Single Resources and Initial Action Incidents". 29 November 2007 Archived 14 July 2007 at the Wayback Machine
  13. ^ Moynihan, Donald. "The Network Governance of Crisis Response: Case Studies of Incident Command Systems (2009)" (PDF). Journal of Public Administration Research and Theory 19: 895-915.
  14. ^ "40 CFR 1910.120(q)(1)".
  15. ^ "National Incident Management System (NIMS) Incident Command System (ICS) Forms Booklet" (PDF). Federal Emergency Management Agency. Sep 2010. Retrieved 2015-09-25.
  16. ^ National Incident Management System - December 2008 Page 51
  17. ^ Federal Emergency Management Agency "FEMA Taskbooks", FEMA, 28 October 2010, accessed 11 December 2010.
  18. ^ Federal Emergency Management Agency "FEMA Glossary", FEMA, 28 October 2010, accessed 11 December 2010.
  19. ^ Federal Emergency Management Agency "FEMA Glossary", FEMA, 28 October 2010, accessed 11 December 2010.
  20. ^ Decker, Russell (2011-10-01). "Acceptance and utilisation of the Incident Command System in first response and allied disciplines: An Ohio study". Journal of Business Continuity & Emergency Planning. Henry Stewart Publications. 5 (3): 224–230. Retrieved 2015-09-25.

External links[]