Incident Management | (2023)

When an emergency occurs or there is a disruption to the business, organized teams will respond in accordance with established plans. Public emergency services may be called to assist. Contractors may be engaged and other resources may be needed. Inquiries from the news media, the community, employees and their families and local officials may overwhelm telephone lines. How should a business manage all of these activities and resources? Businesses should have an incident management system (IMS). An IMS is “the combination of facilities, equipment, personnel, procedures and communications operating within a common organizational structure, designed to aid in the management of resources during incidents” [NFPA 1600].

The National Incident Management System (NIMS) was established by FEMA and includes the Incident Command System (ICS). NIMS is used as the standard for emergency management by all public agencies in the United States for both planned and emergency events. Businesses with organized emergency response teams that interface with public emergency services can benefit from using the ICS. ICS is also well suited for managing disruptions of business operations. Public information and crisis communications are an integral part of the ICS structure.

When an incident occurs, incident stabilization activities (e.g. firefighting, damage assessment, property conservation) may be underway at the scene of the incident. Others assigned to support incident stabilization, business continuity or crisis communications activities will report to an emergency operations center (EOC). The emergency operations center is a physical or virtual location from which coordination and support of incident management activities is directed.

The Incident Command System and the use of an Emergency Operations Center supports incident management.

(Video) #1 #ServiceNow #Incident Management | A Complete Tutorial for Admins and IT Users

Resources for Emergency Operations Centers

Incident Command System

Incident Management | (1)

Incident Command System Diagram - Text Version

The Incident Command System (ICS) is used by public agencies to manage emergencies. ICS can be used by businesses to work together with public agencies during emergencies. Private sector businesses should be familiar with the fundamental concepts of incident command and should coordinate planning with local public emergencies services. The use of ICS within a business depends upon the size and complexity of the business. Functions and roles may be assigned to multiple individuals or a few persons may be assigned multiple responsibilities.

Not all of the ICS positions need to be active in each incident. The ICS structure is meant to expand and contract as the scope of the incident requires. For small-scale incidents, only the incident commander may be assigned. Command of an incident would likely transfer to the senior on-scene officer of the responding public agency when emergency services arrive on the scene. Command transfers back to the business when the public agency departs.

An abbreviated summary of the roles and responsibilities of each ICS position are presented below.

(Video) Incident Management Process: A Step by Step guide

Incident Commander

  • In charge of the organization’s on-scene response
  • Maintain command until public agencies arrive and assume command or when relieved at start of next operational period
  • Assess the situation
  • Order warning of persons at risk or potentially at risk to take appropriate protective actions
  • Notify or verify internal teams, departments, public agencies, regulators, contractors and suppliers have been notified
  • Appoint others to incident command positions as needed
  • Brief staff on current organization and activities; assign tasks; schedule planning meeting
  • Determine the incident objectives and strategy; identify information needed or required by others; ensure planning/strategy meetings are held and attend as needed
  • Coordinate activities with the EOC; identify priorities and activities; provide impact assessment for business continuity, crisis communications and management
  • Review requests for resources; confirm who has authority to approve procurement; approve all requests for resources as required
  • Provide information to and coordinate with crisis communications or media relations team
  • Terminate the response and demobilize resources when the situation has been stabilized


  • Identify and assess hazardous situations; prevent accidents
  • Prepare safety plan; ensure messages are communicated
  • Stop unsafe acts; correct unsafe conditions


  • Point of contact with outside agencies and companies
  • Monitors operations to identify inter-organizational problems

Public Information

  • Notify spokespersons and Crisis Communications Team
  • Develop information for use in media briefings
  • Obtain IC’s and management approval for all news releases
  • Conduct periodic media briefings
  • Arrange for tours, interviews and or briefings
  • Monitor and forward useful information to the media


  • Manage all tactical operations during the incident
  • Assist in the development of the operations portion of the Incident Action Plan
  • Ensure safe tactical operations for all responders (in conjunction with any assigned Safety Officer)
  • Request additional resources to support tactical operations
  • Expedite appropriate changes in the operations portion of the Incident Action Plan
  • Maintain close communication with the Incident Commander


  • Conduct and facilitate planning meetings
  • Supervise preparation of the Incident Action Plan
  • Determine need for technical experts from within the company or outside as well as specialized resources to support the incident
  • Coordinate with business continuity and senior management teams
  • Assemble information on alternative strategies and plans
  • Assess current and potential impacts on people, property, environment
  • Compile and display incident status information


  • Provides resources to stabilize the incident and support personnel, systems and equipment:
    • Workspace or facilities for incident management staff
    • Media briefing center
    • Transportation
    • Communications equipment
    • Food, water, shelter and medical care
  • Ensures Incident Command Post and other facilities have been established as needed
  • Assesses communications needs and facilitates communications between teams/personnel/agencies
  • Attends planning meetings; provides input to Incident Action Plan
  • Provides updates on resources (availability, response time, deployment)
  • Estimates and procures resources for the next operational period


  • Manages all financial aspects of the incident
  • Provides financial and cost analysis information as requested
  • Create accounts for claims and costs; coordinates with Logistics
  • Tracks worker time and costs for materials and supplies
  • Documents claims for damage, liability and injuries
  • Notifies risk management/insurance to initiate claims reporting
  • Provides incurred and forecasted costs at planning meetings
  • Provides oversight of financial expenditures, new leases, contracts and assistance agreements to comply with corporate governance

Emergency Operations Center

An emergency operations center (EOC) is a physical (e.g., a conference room) or virtual (e.g., telephone conference call) location designed to support emergency response, business continuity and crisis communications activities. Staff meets at the EOC to manage preparations for an impending event or manage the response to an ongoing incident. By gathering the decision makers together and supplying them with the most current information, better decisions can be made. A primary EOC should be established at the main business facility and a secondary EOC should be available at another company facility, a temporary facility (such as a hotel) or through a teleconference bridge established to bring staff together virtually. The EOC supports the following incident management functions.

Activation-Bring knowledge and expertise together to deal with events that threaten the business

Situation Analysis-Gather information to determine what is happening and to identify potential impacts

Incident Briefing- Efficiently share information among team members

(Video) ServiceNow Incident Management, Service Desk/Help Desk Ticketing System, mini Crash Course

Incident Action Plan- Provide a single point for decision-making and decide on a course of action for the current situation

Resource Management- Provide a single point of contact to identify, procure and allocate resources

Incident Management-Monitor actions, capture event data and adjust strategies as needed

An EOC is not an on-scene incident command post (ICP) - where the focus is on tactics to deal with the immediate situation. An EOC is used to support on-scene activities through the prioritization of activities and the allocation of available resources. A major function within the EOC is communications between the emergency response team,business continuity team,crisis communications teamand company management.

(Video) ITIL Incident Management Explained

Emergency Operations Center

A large conference room can be used as an emergency operations center and primary team meeting location. It must be outfitted with furniture, telephone and internet access and be in close proximity to photocopiers, network printers, fax machines and other office equipment. The conference room or other space to be used as the EOC should be equipped with the following equipment and supplies:

  • Communications equipment including sufficient telephones (cell and landline with at least one speakerphone) to handle incoming and outgoing calls; incoming and outgoing fax machines; and access to any radio systems used by the business
  • Computers and printers with access to network resources (including electronic copies of emergency response, business continuity and crisis communications plans that can be printed on demand), electronic mail and the internet
  • Information gathering and display tools including access to broadcast radio and television (preferably with recording capability) or internet news sources; white boards, TV monitors, projection units or flipcharts with easel and markers to compile and display information
  • Hard copies of emergency response, business continuity and crisis communications plans, contact/telephone lists, resource inventory and diagrams of facilities and systems
  • Stationery, business and incident management forms, pens, pencils, markers and supplies
  • Food, water and dining supplies for EOC staff

The emergency operations center should be activated whenever there is a major incident that causes significant property damage, potential or actual business disruption or has the potential to cause a significant impact on the business.

(Video) Incident Management | ITIL V3 Foundation | ITIL Basics | Simplilearn


Can you take ICS 300 online? ›

Both ICS 300 and 400 are delivered in a classroom only. These courses are not suitable for online training since they both require a high level of interaction among participants and completion of complex classroom activities in order to meet the training objectives.

What is the difference between ICS and IMS? ›

The ICS model is used by jurisdictions and agencies, both public and private, to organize field-level incident-management operations. ICS is sometimes referred to as the Incident Management System (IMS); the terms are interchangeable.

What is the FEMA incident command system? ›

The Incident Command System (ICS) is a management system designed to enable effective and efficient domestic incident management by integrating a combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure.

What are the 5 major components of an incident management system? ›

NIMS 2008 defined five NIMS Components: Preparedness, Communications and Information Management, Resource Management, Command and Management, and Ongoing Management and Maintenance.

How long is ICS 300 course? ›

This 3-day course is designed for those emergency response personnel who would function in a Command or General Staff position during a large, complex incident or event, or personnel who are or would likely be part of a local or regional Incident Management Team during a major incident, whether single agency, ...

How many hours is the ICS 300 course? ›

Estimated completion time: 4 hours.

Why do I need an IMS? ›

Integrated Management Systems allows your organization to conduct integrated audits and assessments, as well as optimize processes and resources. When you can integrate these systems it can help reduce the time it takes to do certain activities, eliminate the amount of time interrupted and therefore reduce costs.

What is IMS in simple words? ›

An Integrated Management System (IMS) combines all aspects of an organisation's systems, processes and Standards into one smart system. This merger allows a business to streamline its management, save time and increase efficiency by addressing all elements of the management system as a whole.

Are ICS and NIMS the same? ›

Under NIMS, the State Operational Center (SOC) organizational structure reflects basic Incident Command System (ICS) functions. However, ICS is a field-based tactical communications system, whereas NIMS provides a system for managing the event at the local, operational area, region and state levels.

What are the 4 main elements of the Incident Command System? ›

Functional Structure
  • Command—provide on-scene management and control authority.
  • Operations—direct incident tactical operations.
  • Planning—prepare Incident Action Plan and maintain situation and resources status.
  • Logistics—provide services and support to the incident.

What are the 5 C's of incident command? ›

ICS divides an emergency response into five manageable functions essential for emergency response operations: Command, Operations, Planning, Logistics, and Finance and Administration. The basic structure of ICS is the same regardless of the type of emergency.

What are the 7 principles of the Incident Command System? ›

Incident personnel should adhere to principles of accountability, including check-in/check-out, incident action planning, unity of command, personal responsibility, span of control, and resource tracking.

What are 3 basic elements in an incident? ›

The Three Elements of Incident Response: Plan, Team, and Tools.

What are 6 stages in the incident management? ›

Many organisations use NIST's Computer Security Incident Handling Guide as the basis of their incident response plan. It contains six phases: preparation, identification, containment, eradication, recovery and lessons learned.

What are the 3 stages of an incident? ›

Detection engineer Julie Brown breaks down the three phases of incident response: visibility, containment, and response.

How many times can you take the ICS exam? ›

How many times can I take this exam? You may only take this exam once. Re-takes and exceptions are not granted. You can only take one exam per session.

Are ICS diplomas Recognised? ›

The qualification you receive will be exactly the same as if you'd studied in school, college or university, and will be recognised and respected by employers worldwide.

Do ICS courses expire? ›

Required Required Apply for re-certification every two years.

How much does it cost to take ICS 300? ›

ICS 200/300 COURSE COST: $3,500 per class (3-day), plus travel and lodging expenses*. Budget $25 per student for ICS manual.

Can you retake the ICS 100 test? ›

If you did not pass, you are allowed to take the exam as many times as needed to pass.

Does ICS 100 certification expire? ›

This course has a minimum student count of 20 and a maximum student count of 45. The certification achieved by taking this course will expire 0 months after taking the class.

What are the disadvantages of IMS? ›

Disadvantages of Integration:

Relevant specialists may continue to concentrate on the area of their core expertise and further specialist training may not be needed. Uncertainties regarding key terms already a problem in occupational health and safety would be exacerbated in an IMS.

Who is responsible for IMS? ›

The management representatives are jointly responsible for ensuring that the integrated management system is established, implemented and maintained to the requirements of ISO 9001 and ISO 14001, and have the necessary authority to act on behalf of the managing director and leadership team in all aspects of the system.

How do I know if I have IMS? ›

Check for These Signs of IMS Bearing Failure

Unfortunately, the only early warning sign of IMS bearing failure is the presence of metal shavings in your oil or oil filter. These can only be seen in your oil during oil changes. This is why your mechanic should pay the utmost attention to the oil while changing.

What are the three IMS? ›

As mention earlier, IMS is the integration of the systems that are focused on quality, environment, and occupational health and safety along with the process, practices and documentations. The integration consists of three main management systems: ISO 9001, ISO 14001 and OHSAS 18001.

What are examples of IMS? ›

Examples of global standards based on IMS are MMTel which is the basis for Voice over LTE (VoLTE), Wi-Fi Calling (VoWIFI), Video over LTE (ViLTE), SMS/MMS over WiFi and LTE, USSD over LTE, and Rich Communication Services (RCS), which is also known as joyn or Advanced Messaging, and now RCS is operator's implementation.

What is the difference between IMS and QMS? ›


A quality team is concerned with the QMS, often an EHS manager handles both Environmental and Health and Safety issues, or a SHEQ Manager handles Safety, Health, Environment and Quality, etc.

How many levels of ICS are there? ›

The Incident Command System comprises five major functional areas: Command, Operations, Planning, Logistics, and Finance/Administration.

What are the 3 major components of NIMS? ›

NIMS Components

Preparedness. Resource management. Communications and information management.

Does NIMS fall under FEMA? ›

It is situated in the Department of Homeland Security's Federal Emergency Management Agency (FEMA).

Does ICS College offer online classes? ›

Yes we offer distance learning. This is the same as online learning. Through our virtual branch, we have enrolled students who study online. These students may not be able to attend the classes at the school premises due to a number of reasons, thus choosing this mode of study.

What is ICS online? ›

ICS Learn (International Correspondence Schools) offers classes online only. This school offers training in 9 qualifications, with the most reviewed qualifications being AAT Level 2 in Accounting, Animal Science, and Associate's Degree in Management.

How long is ICS course? ›

Duration. The duration of the programme is two years.

Do you have to pay for ICS? ›

The ICS programme is funded by the UK Government and aims to ensure that youth from diverse backgrounds can access the programme. Therefore, as a matter of principle, no volunteer will be excluded from accessing the programme due to cost.

How many years is the ICS course? ›

ICS is for a duration of 2 years and is an alternative for FSC (Pre-Engineering). You can do a Bachelor's in Computer Science or opt for Engineering after this. Its curriculum is defined by the Punjab Textbook Board. The total marks for this program is 1100 with 550 marks comprising each part.


1. Incident Management in BMC Helix ITSM
2. Overview of Incident Management in ServiceNow
3. Incident Management System Training
(Ohio Department of Medicaid)
4. Jira Service Management: Incident Management Tour
5. Incident Management | BMC Remedy Incident Management | ITIL | Incident Process
6. Resolver's Powerful Incident Management Software: A Walk-through
Top Articles
Latest Posts
Article information

Author: Kimberely Baumbach CPA

Last Updated: 02/19/2023

Views: 6301

Rating: 4 / 5 (41 voted)

Reviews: 88% of readers found this page helpful

Author information

Name: Kimberely Baumbach CPA

Birthday: 1996-01-14

Address: 8381 Boyce Course, Imeldachester, ND 74681

Phone: +3571286597580

Job: Product Banking Analyst

Hobby: Cosplaying, Inline skating, Amateur radio, Baton twirling, Mountaineering, Flying, Archery

Introduction: My name is Kimberely Baumbach CPA, I am a gorgeous, bright, charming, encouraging, zealous, lively, good person who loves writing and wants to share my knowledge and understanding with you.