Incident Command System

Why the Incident Command System Matters

When an emergency strikes a workplace, whether it is a chemical release, a structural collapse, a fire, or a severe weather event, the difference between a controlled response and chaos is often determined by how the response is organized. The Incident Command System (ICS) is the standardized, all-hazards management framework that allows responders from different organizations, disciplines, and jurisdictions to work together under a common structure with a common language.

For the Associate Safety Professional (ASP), ICS is important for several reasons:

1. Regulatory requirement. OSHA's HAZWOPER standard (29 CFR 1910.120(q)) explicitly requires employers to establish an ICS for emergency response operations involving hazardous substances. The senior emergency response official on scene becomes the individual in charge of the site-specific ICS.
2. National standardization. ICS is a core component of the National Incident Management System (NIMS), mandated by Homeland Security Presidential Directive 5 (HSPD-5). Any organization that may interface with public responders needs to understand it.
3. Consensus standards. NFPA 1600 (Standard on Continuity, Emergency, and Crisis Management) and NFPA 1561 (Standard on Emergency Services Incident Management System and Command Safety) reference incident management systems.
4. Life safety. Historically, freelancing, poor communication, and unclear chains of command have contributed to responder injuries and fatalities. ICS was developed specifically to correct these failures.
5. Exam weight. ICS falls under the ASP blueprint domain covering Emergency Preparedness and Response, and questions on ICS structure, roles, and principles are common.

What the Incident Command System Is

ICS is a standardized, on-scene, all-hazards incident management approach that:

- Allows for the integration of facilities, equipment, personnel, procedures, and communications within a common organizational structure.
- Enables a coordinated response among various jurisdictions and functional agencies, both public and private.
- Establishes common processes for planning and managing resources.

Historical origin: ICS was developed in the 1970s in California following a series of devastating wildfires. An interagency effort called FIRESCOPE (Firefighting Resources of California Organized for Potential Emergencies) identified recurring problems: too many people reporting to one supervisor, different organizational structures, lack of reliable incident information, inadequate and incompatible communications, no common terminology, and unclear lines of authority. ICS was the solution. It was later adopted nationally and, after the September 11, 2001 attacks, formalized within NIMS by FEMA.

Key point: ICS is scalable and flexible. It can be used for a small spill handled by two people or a multi-state disaster involving thousands of responders. Only the functions that are needed are activated.

The Fourteen Management Characteristics of ICS

NIMS identifies fourteen management characteristics that make ICS effective. Exam questions frequently test these concepts, so know each one:

1. Common Terminology - Plain English, no radio codes or agency-specific jargon, so everyone understands organizational functions, resource descriptions, and facility names.
2. Modular Organization - The structure expands or contracts based on the size and complexity of the incident. Only needed positions are filled.
3. Management by Objectives - The Incident Commander establishes clear, measurable incident objectives, then strategies and tactics are developed to achieve them.
4. Incident Action Planning - An Incident Action Plan (IAP) documents objectives, strategies, tactics, and assignments for each operational period. It may be verbal for small incidents but should be written for complex or multi-period incidents.
5. Manageable Span of Control - Each supervisor should oversee between three and seven subordinates, with five considered optimal. If span of control exceeds seven, the organization should expand.
6. Incident Facilities and Locations - Standardized facilities such as the Incident Command Post (ICP), staging areas, bases, camps, and helibases.
7. Comprehensive Resource Management - Standard processes for categorizing, ordering, dispatching, tracking, and recovering resources.
8. Integrated Communications - A common communications plan with interoperable equipment, processes, and systems.
9. Establishment and Transfer of Command - Command is clearly established at the start of an incident, and when command transfers, a briefing is given that captures all essential information.
10. Unified Command - When multiple agencies or jurisdictions have authority, they share command and jointly establish objectives while maintaining a single Operations Section Chief.
11. Chain of Command and Unity of Command - Chain of command is the orderly line of authority. Unity of command means each individual reports to only one supervisor.
12. Accountability - Check-in, incident action planning, unity of command, personal responsibility, span of control, and resource tracking all support accountability.
13. Dispatch/Deployment - Personnel respond only when requested or dispatched by an appropriate authority. No self-dispatching or freelancing.
14. Information and Intelligence Management - A process for gathering, analyzing, sharing, and managing incident-related information and intelligence.

How the Incident Command System Works: Organizational Structure

The ICS organization is built around five major functional areas. Memorize these and their responsibilities.

1. Command
The Incident Commander (IC) has overall authority and responsibility for the incident. The IC sets objectives and priorities, approves the IAP, and is responsible for all activities until authority is delegated. The IC is the only position that is always filled. If no other positions are activated, the IC performs all functions.

The Command Staff reports directly to the IC and consists of three officers:
- Public Information Officer (PIO) - Interfaces with the media, the public, and other agencies with incident-related information needs. There is only one PIO per incident, even in Unified Command.
- Safety Officer (SO) - Monitors incident operations and advises the IC on all matters relating to operational safety, including the health and safety of responders. The Safety Officer has the authority to stop or alter unsafe acts immediately without first consulting the IC. This is the position most relevant to the safety professional and is heavily tested.
- Liaison Officer (LNO) - Serves as the point of contact for representatives of other governmental agencies, nongovernmental organizations, and private-sector entities (agency representatives).

Command Staff members are called Officers and may have Assistants.

2. Operations Section
Led by the Operations Section Chief. This section conducts the tactical operations to carry out the IAP. It is where the actual response work happens: firefighting, rescue, hazmat mitigation, medical treatment, evacuation. Operations is usually the first section to be established. Subdivisions include Branches (led by Directors), Divisions (geographic areas, led by Supervisors), Groups (functional assignments, led by Supervisors), and resources organized as Strike Teams (same kind and type), Task Forces (mixed resources), and Single Resources. Staging Areas are managed by Operations and hold resources available for assignment within three minutes.

3. Planning Section
Led by the Planning Section Chief. Collects, evaluates, and disseminates incident situation information; prepares the written IAP; maintains resource status; tracks the incident situation; and prepares demobilization plans. Standard units include Resources Unit, Situation Unit, Documentation Unit, and Demobilization Unit. Technical Specialists are typically assigned here.

4. Logistics Section
Led by the Logistics Section Chief. Provides all incident support needs: facilities, transportation, supplies, equipment maintenance and fueling, food service, communications, and medical services for responders (not victims; victim care is Operations). Divided into a Service Branch (Communications, Medical, Food Units) and Support Branch (Supply, Facilities, Ground Support Units).

5. Finance/Administration Section
Led by the Finance/Administration Section Chief. Tracks incident costs, personnel time, procurement contracts, and compensation and claims. Units include Time, Procurement, Compensation/Claims, and Cost. Often activated only on large or long-duration incidents.

Sixth function (sometimes): Intelligence/Investigations may be established as a separate General Staff section, within Planning, within Operations, or within Command Staff, depending on the incident.

The Section Chiefs collectively make up the General Staff. Section Chiefs may have Deputies.

ICS Titles at a Glance
- Incident Command: Incident Commander
- Command Staff: Officer
- General Staff (Sections): Chief
- Branch: Director
- Division/Group: Supervisor
- Unit: Leader
- Strike Team/Task Force: Leader
- Single Resource: Boss (or use of unit designation)

ICS Facilities
- Incident Command Post (ICP) - Location where the IC oversees the incident. One per incident; identified by a green light or flag in many jurisdictions.
- Staging Area - Temporary location for available resources awaiting tactical assignment (Operations).
- Base - Where primary logistics and administrative functions are coordinated. One per incident.
- Camp - Location where resources may be kept to support operations; may be multiple camps.
- Helibase / Helispot - Helicopter parking, fueling, and landing locations.
- Emergency Operations Center (EOC) - Note: The EOC is not an ICS facility. It is an off-site, multiagency coordination center that supports the on-scene IC with resources and policy direction but does not command tactical operations.

Unified Command vs. Single Command vs. Area Command
- Single Command - One IC has full authority. Used when one agency has jurisdiction.
- Unified Command - Multiple agencies with jurisdictional or functional responsibility share command. They develop a single set of objectives and one IAP, speak with one voice through a single PIO, and designate a single Operations Section Chief. Example: a hazmat release on a highway involving the fire department, state environmental agency, and the responsible facility.
- Area Command - Established to oversee the management of multiple incidents each being handled by a separate ICS organization, or a very large incident with multiple Incident Management Teams. Area Command sets priorities and allocates critical resources among incidents but does not have operational responsibilities.

The Planning P and Operational Periods
An operational period is the time scheduled for executing a given set of tactical actions as specified in the IAP, commonly 12 or 24 hours. The Planning P is a visual guide to the incident action planning cycle: initial response and assessment, incident briefing (ICS Form 201), initial IC/Unified Command meeting, objectives meeting, Command and General Staff meeting, tactics meeting, planning meeting, IAP preparation and approval, operations briefing, execution, and then repeat.

Key ICS forms to recognize:
- ICS 201 - Incident Briefing (initial response, transfer of command)
- ICS 202 - Incident Objectives
- ICS 203 - Organization Assignment List
- ICS 204 - Assignment List
- ICS 205 - Incident Radio Communications Plan
- ICS 206 - Medical Plan
- ICS 208 - Safety Message/Plan
- ICS 214 - Activity Log
- ICS 215A - Incident Action Plan Safety Analysis (prepared by the Safety Officer)

Transfer of Command
Command may transfer when a more qualified person arrives, when jurisdiction changes, when the incident complexity changes, or for responder rest and rotation. Transfer must include a face-to-face briefing when possible, covering incident history, priorities and objectives, current plan, resource assignments, incident organization, resources ordered, facilities, communications plan, prognosis, concerns, and safety issues. The transfer must be announced to all personnel.

Demobilization
Resources are released in an orderly, safe, and cost-effective manner as the incident winds down. The Planning Section's Demobilization Unit prepares the plan, and the IC approves it. Safety considerations, such as fatigue management for personnel driving home, are part of demobilization.

ICS and HAZWOPER (29 CFR 1910.120(q))
Because ASP candidates often encounter ICS in the context of hazardous materials emergencies, understand these OSHA-specific points:
- The senior emergency response official responding to an emergency becomes the individual in charge of a site-specific ICS.
- The individual in charge must identify all hazardous substances or conditions present, address site analysis, use of engineering controls, maximum exposure limits, hazardous substance handling procedures, and use of any new technologies.
- The individual in charge must implement appropriate emergency operations and ensure PPE is worn.
- Positive-pressure SCBA must be worn by employees engaged in emergency response until the individual in charge determines through air monitoring that a decreased level of respiratory protection will not result in hazardous exposures.
- The individual in charge must limit the number of emergency response personnel at the emergency site in areas of potential or actual exposure to those actively performing emergency operations.
- Operations in hazardous areas must be performed using the buddy system in groups of two or more.
- Backup personnel must be standing by with equipment ready to provide assistance or rescue, and advance first aid support personnel (minimum basic life support) must be standing by with medical equipment and transportation capability.
- The individual in charge must designate a Safety Officer who is knowledgeable in operations being implemented and who has specific responsibility to identify and evaluate hazards and provide direction regarding the safety of operations.
- When the Safety Officer judges activities to be an Immediately Dangerous to Life or Health (IDLH) condition or an imminent danger, the Safety Officer has the authority to alter, suspend, or terminate those activities and must immediately inform the individual in charge of any actions needed to be taken.
- Decontamination procedures must be implemented after emergency operations have terminated.

The Safety Officer Role in Depth
Because the safety professional is most likely to serve as or support the ICS Safety Officer, know these responsibilities:
- Identify hazardous situations associated with the incident.
- Participate in planning meetings and review the IAP for safety implications.
- Prepare the ICS 215A Incident Action Plan Safety Analysis and the ICS 208 Safety Message.
- Exercise emergency authority to stop and prevent unsafe acts.
- Investigate accidents that occur within the incident area.
- Assign Assistant Safety Officers as needed (for example, a Hazmat Assistant Safety Officer with specialized training).
- Review and approve the Medical Plan (ICS 206).
- Ensure responder rehabilitation (rehab), hydration, and work/rest cycles.
- Monitor site control zones (hot, warm, cold) and decontamination corridors in hazmat incidents.

Common Pitfalls ICS Is Designed to Prevent
- Freelancing - Responders acting independently outside the command structure.
- Self-dispatching - Arriving on scene without being requested, which overwhelms accountability systems.
- Excessive span of control - One supervisor trying to manage more than seven people.
- Using codes or jargon - Ten-codes and agency-specific terms cause confusion in multiagency responses.
- Multiple PIOs with conflicting messages - Undermines public trust and may endanger evacuees.
- Failing to establish command early - The first arriving responder should establish command and announce it.

Exam Tips: Answering Questions on Incident Command System

Tip 1: Know the five functional areas cold. Command, Operations, Planning, Logistics, and Finance/Administration. A classic mnemonic is C-O-P-L-F or the phrase Cops Only Plan Large Fires. If a question asks which section is responsible for a task, categorize the task: Is it tactical action (Operations)? Information gathering and documentation (Planning)? Supplies, communications, or responder medical care (Logistics)? Money and time tracking (Finance/Admin)?

Tip 2: Memorize the span of control numbers. The optimal span of control is 1 to 5, with an acceptable range of 1 to 3 through 1 to 7. If a question says a supervisor is managing nine people, the correct answer involves expanding the organization (adding a Division, Group, or Branch). Do not confuse span of control (how many report to you) with unity of command (you report to only one person).

Tip 3: Distinguish Command Staff from General Staff. Command Staff = Safety Officer, Public Information Officer, Liaison Officer (titles end in Officer). General Staff = the four Section Chiefs (titles end in Chief). Distractors often mix these up.

Tip 4: Know who can stop unsafe operations. The Safety Officer has the immediate authority to stop, alter, or suspend unsafe acts without prior IC approval, but must inform the IC afterward. If an answer choice says the Safety Officer must get approval from the IC before stopping an imminent danger, it is wrong.

Tip 5: Understand Unified Command correctly. Unified Command does not mean multiple IAPs, multiple PIOs, or multiple Operations Section Chiefs. It means multiple agencies jointly determine objectives and strategies but execute them through a single IAP, a single ICP, a single Operations Section Chief, and a single PIO.

Tip 6: Remember that the IC is the only mandatory position. On a small incident, the IC may perform every function personally. Positions are filled only when the IC delegates them. The exam may ask which position is always staffed; the answer is the Incident Commander.

Tip 7: Do not confuse the EOC with the ICP. The Incident Command Post is on scene and directs tactical operations. The Emergency Operations Center is typically off-site and provides coordination, policy, and resource support. The EOC does not command the incident.

Tip 8: Know ICS titles by organizational level. Chiefs lead Sections, Directors lead Branches, Supervisors lead Divisions and Groups, Leaders lead Units, Strike Teams, and Task Forces. Divisions are geographic; Groups are functional. Strike Teams have the same kind and type of resources; Task Forces are mixed.

Tip 9: Connect ICS to HAZWOPER when the question involves hazardous substances. If the scenario involves a chemical release, recall 1910.120(q) specifics: senior official becomes IC, buddy system, backup personnel, SCBA until air monitoring proves otherwise, limit personnel in the hazard zone, designate a Safety Officer, and decontaminate afterward.

Tip 10: Watch for keywords that signal ICS principles. Plain language points to Common Terminology. Expands and contracts points to Modular Organization. Report to only one supervisor is Unity of Command. Wait to be requested is Dispatch/Deployment. Measurable objectives for an operational period relates to Management by Objectives and the IAP.

Tip 11: Identify the first action of a first arriving responder. Exam scenarios may ask what the first person on scene should do. The answer is to establish command (assume the IC role, announce it, size up the situation, and begin an ICS 201 briefing), not to begin rescue or wait for a supervisor.

Tip 12: Use elimination with absolute language. Answer choices with words like always, never, all, only are frequently wrong unless they match a true absolute in ICS (for example, the IC is always staffed; each person reports to only one supervisor). Match absolutes against what you know to be truly fixed in the system.

Tip 13: Remember who prepares what. The Planning Section prepares the written IAP, but the IC approves it. The Safety Officer prepares the ICS 215A and the safety message. The Demobilization Unit (Planning) prepares the demob plan. Logistics provides the Medical Plan (ICS 206) for responders, which the Safety Officer reviews.

Tip 14: Review NIMS components beyond ICS. NIMS includes Resource Management, Command and Coordination (which contains ICS, EOCs, MAC Groups, and the Joint Information System), and Communications and Information Management. A question may ask what ICS is a component of; the answer is NIMS, not the other way around.

Practice Scenario
A chlorine release occurs at a water treatment plant. The plant emergency coordinator arrives first, followed by the municipal fire department and later the state environmental agency. Which command structure is most appropriate, and who is responsible for monitoring responder safety?

Analysis: Multiple agencies have jurisdictional and functional responsibility (the facility, fire department, and state environmental regulator), so Unified Command is the appropriate structure with a single IAP and a single Operations Section Chief. Per 1910.120(q), the individual in charge must designate a Safety Officer who is knowledgeable in the operations, who identifies and evaluates hazards, and who has the authority to alter, suspend, or terminate activities judged to be IDLH or imminent danger conditions. Responders in the release area must use the buddy system, wear positive-pressure SCBA until monitoring justifies otherwise, and have backup and medical personnel standing by.

Summary

The Incident Command System provides the organizational backbone for safe, coordinated emergency response. For the ASP exam, focus on the five functional areas, the Command Staff and General Staff distinctions, the fourteen NIMS management characteristics (especially span of control, unity of command, common terminology, and modular organization), the special authority of the Safety Officer, the differences among single, unified, and area command, ICS facilities, and the HAZWOPER requirements that tie ICS to OSHA compliance. Approach questions by categorizing the task or principle being described, eliminating answers that violate core ICS rules, and remembering that the system exists to ensure accountability, clear communication, and responder safety.