ICS
2Respond and manage

Taking and handing over command

Taking command

The first qualified person to reach the incident takes command and says so on the channel responders are using: their name, the time, the incident name, and where the command bridge is. They open an activity log and start the incident briefing.

Seniority alone confers no command. A senior leader who arrives gets a briefing, then either takes command through a formal transfer or supports the IC in place.

Transferring command

Command transfers when a more qualified person arrives, when the incident outgrows the current IC, at shift change, or when the IC is too tired to continue.

  1. Brief the incoming IC face to face or by voice, using the ICS 201 or the current IAP.
  2. Walk the open decisions and every commitment made to outside parties.
  3. Agree the effective time.
  4. Announce the change to Command and General Staff, all responders, and outside parties who deal with the IC.
  5. Log it, with both names and the time.

Shift handover

#Item
1Current objectives and progress against each
2Status of every assignment, with who holds it now
3Open decisions and who is waiting on them
4Commitments made to executives, customers, regulators, insurers and law enforcement
5Safety and wellbeing concerns, including who has worked too long
6Known unknowns, and what would change the plan
7Times of the next meetings, briefings and executive updates
8Where the logs, timeline and evidence register are
9Thirty minutes of overlap between outgoing and incoming people

Fatigue

Set a maximum shift length before the incident, give the Safety Officer authority to enforce it, and roster relief from the first night. The people who stayed up to contain the incident are rarely the right people to make the eradication decisions the next afternoon.

Adapted from the National Incident Management System, Third Edition (FEMA, 2017). Cyber adaptation, examples and templates by Habib Tora, licensed under CC BY 4.0. Not published by, endorsed by, or affiliated with FEMA or the Department of Homeland Security. Structure after Google's SRE Incident Management Guide. Companion to PIVTR-D.