Institute of Emergency Services & Homeland Security

IS-200 - ICS for Single Resources and Initial Action Incidents

Lesson 4: Functional Areas & Positions

Lesson Overview

Woman standing next to a presentation board that has the word objectives written on it.

The Functional Areas & Positions lesson introduces you to ICS organizational components, command staff, expanding incidents, general staff, and ICS tools.

At the end of this lesson, you should be able to:

This lesson provides more indepth information on ICS organizational elements.

Incident Commander

The Incident Commander.

Upon arriving at an incident the higher ranking person will either assume command, maintain command as is, or reassign command to a third party.

The Incident Commander:

In some situations or agencies, a lower ranking but more qualified person may be designated as the Incident Commander.

The Incident Commander performs all major ICS Command and General Staff responsibilities unless these functions are activated.

Deputy Incident Commander

The Deputy Incident Commander.

The Incident Commander may have one or more Deputies. Deputies may be assigned at the Incident Command, Section, or Branch levels. The only ICS requirement regarding the use of a Deputy is that the Deputy must be fully qualified and equally capable to assume the position.

The three primary reasons to designate a Deputy Incident Commander are to:

Command Staff

The Command Staff.

The Command Staff is only activated in response to the needs of the incident. Command Staff includes the following positions:

Command Staff carry out staff functions needed to support the Incident Commander. These functions include interagency liaison, incident safety, and public information. The following Command Staff positions are established to assign responsibility for key activities not specifically identified in the General Staff functional elements.

Command Staff


Public Information Officer (PIO)

The PIO is responsible for interfacing with the public and media and/or with other agencies with incident-related information requirements. The PIO develops accurate and complete information on the incident's cause, size, and current situation; resources committed; and other matters of general interest for both internal and external consumption. The PIO may also perform a key public information-monitoring role.

Only one incident PIO should be designated. Assistants may be assigned from other agencies or departments involved. The Incident Commander must approve the release of all incident-related information.

Safety Officer (SO)

The SO monitors incident operations and advises the Incident Commander on all matters relating to operational safety, including the health and safety of emergency responder personnel. The ultimate responsibility for the safe conduct of incident management operations rests with the Incident Commander or Unified Command and supervisors at all levels of incident management. The SO is, in turn, responsible to the Incident Commander for the set of systems and procedures necessary to ensure ongoing assessment of hazardous environments, coordination of multiagency safety efforts, and implementation of measures to promote emergency responder safety, as well as the general safety of incident operations. The SO has emergency authority to stop and/or prevent unsafe acts during incident operations. In a Unified Command structure, a single SO should be designated, in spite of the fact that multiple jurisdictions and/or functional agencies may be involved. The SO must also ensure the coordination of safety management functions and issues across jurisdictions, across functional agencies, and with private-sector and nongovernmental organizations.

Liaison Officer (LNO)

The LNO is the point of contact for representatives of other governmental agencies, nongovernmental organizations, and/or private entities. In either a single or Unified Command structure, representatives from assisting or cooperating agencies and organizations coordinate through the LNO. Agency and/or organizational representatives assigned to an incident must have the authority to speak for their parent agencies and/or organizations on all matters, following appropriate consultations with their agency leadership. Assistants and personnel from other agencies or organizations (public or private) involved in incident management activities may be assigned to the LNO to facilitate coordination.

Source: National Incident Management System (NIMS)

Agency Representative

An Agency Representative helping at an incident.

An Agency Representative is an individual assigned to an incident from an assisting or cooperating agency. The Agency Representative is delegated authority to make decisions on matters affecting that agency's participation at the incident.

Assisting Agency

An Assisting Agency at an incident site.

An agency or jurisdiction will often send resources to assist at an incident. In ICS these are called Assisting Agencies.

An Assisting Agency is defined as an agency or organization providing personnel, services, or other resources to the agency with direct responsibility for incident management.

Cooperating Agency

A Cooperating Agency at an incident site.

A Cooperating Agency is an agency supplying assistance other than direct operational or support functions or resources to the incident management effort.

Don't get confused between an Assisting Agency and a Cooperating Agency! An Assisting Agency has direct responsibility for incident response, whereas a Cooperating Agency is simply offering assistance.


An Assistant.

In a large or complex incident, Command Staff members may need one or more Assistants to help manage their workloads. Each Command Staff member is responsible for organizing his or her Assistants for maximum efficiency. Assistants are subordinates of principle Command Staff positions.

As the title indicates, Assistants should have a level of technical capability, qualifications, and responsibility subordinate to the primary positions.

Assistants may also be assigned to Unit Leaders (e.g., at camps to supervise unit activities).

Expanding Incidents

An Incident Commander delegating authority to deal with an expanding incident.

An incident may start small and then expand. As the incident grows in scope and the number of resources needed increases, there may be a need to activate Teams, Divisions, Groups, Branches, or Sections to maintain an appropriate span of control.

The ability to delegate the supervision of resources not only frees up the Incident Commander to perform critical decisionmaking and evaluation duties, but also clearly defines the lines of communication to everyone involved in the incident.

Operations Section

Organizational chart highlighting the Operations Section, with subordinate Staging Area, Rescue Group, and Investigation Group.The Operations Section:

Operations Section Chief

Operations Section Chief.

The Operations Section Chief:

The Operations Section Chief may have one or more Deputies assigned. The assignment of Deputies from other agencies may be advantageous in the case of multijurisdictional incidents.

Operations Section: Staging Areas

A Staging Area.

Staging Areas are set up at the incident where resources can wait for a tactical assignment.

All resources in the Staging Area are assigned and ready for deployment. Out-of-service resources are NOT located at the Staging Area.

Staging Areas: Chain of Command

After a Staging Area has been designated and named, a Staging Area Manager will be assigned. The Staging Area Manager will report to the Operations Section Chief or to the Incident Commander if the Operations Section Chief has not been designated.

The Staging Area falls under the Operations Section. Click to enlarge.

Divisions and Groups

An assembled group.

Divisions are established to divide an incident into physical or geographical areas of operation.

Groups are established to divide the incident into functional areas of operation.

Divisions and Groups may be assigned across geographical areas when a functional activity crosses divisional lines.

For example, a specialized Canine Search Group would be used wherever required and moved as needed in an earthquake incident.

In any organization in which combined Divisions and Groups are used, it is important that the supervisors establish and maintain close communications and coordination. Each will have equal authority; neither supervisor will be subordinate to the other.


Branches may be used to serve several purposes, and may be functional or geographic in nature. Branches are established when the number of Divisions or Groups exceeds the recommended span of control of one supervisor to three to seven subordinates for the Operations Section Chief. Branches are identified by Roman numerals or functional name, and are managed by a Branch Director.

Air Operations Branch


Some incidents may require the use of aviation resources to provide tactical or logistical support. On smaller incidents, aviation resources will be limited in number and will report directly to the Incident Commander or to the Operations Section Chief.

On larger incidents, it may be desirable to activate a separate Air Operations organization to coordinate the use of aviation resources. The Air Operations organization will then be established at the Branch level, reporting directly to the Operations Section Chief.

The Air Operations Branch Director can establish two functional groups. The Air Tactical Group coordinates all airborne activity. The Air Support Group provides all incident ground-based support to aviation resources.

Planning Section

The Planning Section Chief at work.

The Planning Section has responsibility for:

  • Maintaining resource status.
  • Maintaining and displaying situation status.
  • Preparing the Incident Action Plan (IAP).
  • Developing alternative strategies
  • Providing documentation services.
  • Preparing the Demobilization Plan.
  • Providing a primary location for Technical Specialists assigned to an incident.

One of the most important functions of the Planning Section is to look beyond the current and next operational period and anticipate potential problems or events.

Information and Intelligence

The Planning Section is typically responsible for gathering and disseminating information and intelligence critical to the incident. Based on the incident needs, the Information and Intelligence function may be activated as a fifth General Staff section, as an element within the Operations or Planning Sections, or as part of the Command Staff.

The Information and Intelligence Branch as a fifth General Staff Section, as part of the Planning Section, as part of the Operations Section, and as part of the Command Staff.

The analysis and sharing of information and intelligence are important elements of ICS.

In this context, intelligence includes not only national security or other types of classified information but also other operational information, such as risk assessments, medical intelligence (i.e., surveillance), weather information, geospatial data, structural designs, toxic contaminant levels, and utilities and public works data, that may come from a variety of different sources.

Traditionally, information and intelligence functions are located in the Planning Section.

However, in exceptional situations, the Incident Commander may need to assign the information and intelligence functions to other parts of the ICS organization. In any case, information and intelligence must be appropriately analyzed and shared with personnel, designated by the Incident Commander, who have proper clearance and a "need-to-know" to ensure that they support decisionmaking.

The information and intelligence function may be organized in one of the following ways:

Regardless of how it is organized, the information and intelligence function is also responsible for developing, conducting, and managing information-related security plans and operations as directed by the Incident Action Plan.

These can include information security and operational security activities, as well as the complex task of ensuring that sensitive information of all types (e.g., classified information, sensitive law enforcement information, proprietary and personal information, or export-controlled information) is handled in a way that not only safeguards the information but also ensures that it gets to those who need access to it so that they can effectively and safely conduct their missions.

The information and intelligence function also has the responsibility for coordinating information- and operational-security matters with public awareness activities that fall under the responsibility of the Public Information Officer, particularly where such public awareness activities may affect information or operations security.

Planning Section Key Personnel

The Planning Section Chief at work.

The Planning Section will have a Planning Section Chief. The Planning Section Chief may have a Deputy.

Technical Specialists are advisors with special skills required at the incident. Technical Specialists will initially report to the Planning Section, work within that Section, or be reassigned to another part of the organization. Technical Specialists can be in any discipline required (e.g., aviation, environment, hazardous materials, training, human resources, etc.).

Planning Section Units

The Planning Section with its subordinates: Resources Unit, Situation Unit, Demobilization Unit, and Documentation Unit.The major responsibilities of Planning Units are:

  • Resources Unit: Responsible for all check-in activity and for maintaining the status on all personnel and equipment resources assigned to the incident.
  • Situation Unit: Collects and processes information on the current situation, prepares situation displays and situation summaries, develops maps and projections.
  • Documentation Unit: Prepares the Incident Action Plan, maintains all incident-related documentation, and provides duplication services.
  • Demobilization Unit: On large, complex incidents, the Demobilization Unit will assist in ensuring that an orderly, safe, and cost-effective movement of personnel is made when they are no longer required at the incident.

Logistics Section

The Logistics Section with subordinate Service Branch and Support Branch. Under the Service Branch are the Communications Unit, Medical Unit, and Food Unit. Under the Support Branch are the Supply Unit, Faciliites Unit, and Ground Support Unit. Early recognition of the need for a Logistics Section can reduce time and money spent on an incident. The Logistics Section is responsible for all support requirements, including:

  • Communications
  • Medical support to incident personnel
  • Food for incident personnel
  • Supplies, facilities, and ground support

It is important to remember that Logistics Unit functions, except for the Supply Unit, are geared to supporting personnel and resources directly assigned to the incident.

Logistics Section: Service Branch

Members of the Food Unit.

The Service Branch may be made up of the following units:

Logistics Section: Support Branch

A Supply Unit at an incident.

The Support Branch within the Logistics Section may include the following units:

Finance/Administration Section

A Finance/Administration Officer.

The Finance/Administration Section:

Not all incidents will require a separate Finance/Administration Section. If only one specific function is needed (e.g., cost analysis), a Technical Specialist assigned to the Planning Section could provide these services.

Finance/Administration Units

The Finance/Administration Section and its units: Time, Compensation/Claims, Procurement, and Cost.Finance/Administration Units include the following:

ICS Tools

ICS Forms, a Policies and Procedures Manual, and a map.

Some important tools you should have available at the incident include:

ICS Forms

Sample ICS Form.

When receiving ICS forms, some questions you should ask yourself about each form are:

ICS Form 201, Incident Briefing

Incident Briefing Form.

The Incident Briefing Form (ICS Form 201) is an eight-part form that provides an Incident Command/Unified Command with status information that can be used for briefing incoming resources, an incoming Incident Commander or team, or an immediate supervisor. The basic information includes:

  • Incident situation (map, significant events)
  • Incident objectives
  • Summary of current actions
  • Status of resources assigned or ordered for the incident or event

Occasionally, the ICS Form 201 serves as the initial Incident Action Plan (IAP) until a Planning Section has been established and generates, at the direction of the Incident Commander, an IAP.

The ICS Form 201 is also suitable for briefing individuals newly assigned to the Command and General Staff.

Completing the ICS Form 201

The following demonstrates how to complete the Incident Briefing ICS Form 201 for a hostage incident.

In Block 1, print a unique incident name. In Block 2, print the date the form was prepared in a month, day, year format. In Block 3, enter the time the form was prepared using a 24-hour clock.

Block 1:  Print a unique incident name. Block 2: Print the date the form was prepared in a month, day, year format. Block 3: Enter the time the form was prepared using 24-hour clock.

In Block 4 develop a map sketch that shows the incident perimeter and control lines, resource assignments, and incident facilities, along with other special information on a sketch map or attached to the topographic map.

Block 4 contains a map sketch of the incident.

In Block 5 is the current organizational chart. Enter the names of the individuals assigned to each position on the organization chart. The person preparing this page signs it at the bottom.

Block 5 has an organizational chart with the names of individuals next to their position titles.

In Block 6 enter information about the resources allocated to the incident.

Block 6 lists the resources ordered, a resource identification code (with a 3-letter code if available), the estimated time of arrival or an X if already in place, and the location where the resource will be assigned.

In Block 7 describe the current status of strategy/tactics, initial objectives, and history. The person preparing this page signs it at the bottom.

Block 7 shows the current status, objectives, and history, plus the preparer's signature.

Other Commonly Used ICS Forms

Form Number


Who Completes

Form 201

Incident Briefing

Section Chief

Form 202

Response Objectives

Section Chief

Form 203

Organization Assignment List

Resources Unit

Form 204

Assignment List

Section Chief, Staff

Form 205

Incident Radio Communications Plan

Communications Unit

Form 206

Medical Plan

Medical Unit

Form 208

Site Safety and Control Plan

Safety Officer, Staff

Form 209

Incident Status Summary

Resources Unit

Form 210

Status Change Card


Form 211

Check-In List


Form 213

General Message


Form 214

Unit Log


Form 215

Operational Planning Worksheet


Form 215a

Incident Action Plan Safety Analysis

Safety Officer, Staff

Form 220

Air Operations Summary Worksheet

Air Operations Unit

Form 221

Demobilization Checkout

Resources Unit

Quick Quiz

Before you can proceed to the next section, you must answer the following questions. Re-read the topics as indicated until you get 100%.