Forms and templates

INCIDENT BRIEFING (after ICS 201)
Incident name:                    Incident number:
Prepared by:                      Date, time, timezone:
Incident commander:

1. Situation
   What happened, what is affected, what is known, what is not.

2. Current objectives
   1.
   2.
   3.

3. Actions taken so far
   Time      Action      By

4. Current organization
   IC:
   Operations:
   Planning:
   Public Information:
   Liaison:
   Legal advisor:

5. Resources assigned and ordered
   Resource      Assigned to      Status

6. Safety and wellbeing
   Hours worked, physical process risks, personal safety concerns.

7. Next briefing:

INCIDENT OBJECTIVES (after ICS 202)
Incident name:
Operational period: from                    to
Objectives, each with an outcome, a measure and a time:
  1.
  2.
  3.
Command emphasis (priorities, constraints, risk tolerance):
Decisions made by command this period:
Safety and wellbeing message:
Attached: organization list, assignment lists, communications plan, situation summary
Approved by (IC or each unified command member):          Time:

ORGANIZATION ASSIGNMENT LIST (after ICS 203)
Operational period:
Command
  Incident commander:
  Deputy:
  Public Information Officer:
  Safety Officer:
  Liaison Officer:
  Legal advisor:
Operations Section Chief:
  Group, supervisor, members:
Planning Section Chief:
  Situation unit:
  Resources unit:
  Documentation unit:
Logistics Section Chief:
Finance/Admin Section Chief:
Intelligence/Investigations (if separate):
Unified command members (if used):

ASSIGNMENT LIST (after ICS 204)
Operational period:
Group or division:                Supervisor:
Members:
Work assignment, and the objective each task serves:
Special instructions (change windows, systems not to touch, evidence handling):
Status to Planning at:            via:
Channels: primary            backup
Prepared by (Planning):           Approved by (Operations):

COMMUNICATIONS PLAN (after ICS 205)
Treat corporate email, chat and identity as compromised until scoping shows otherwise.
Purpose              Primary             Backup              Owner
Command bridge
Operations
Executive updates
Legal, privileged
Outside parties
Roster kept at (offline):
How members verify each other:
Status cadence:

INCIDENT STATUS SUMMARY (after ICS 209)
As of (date, time, timezone):
Incident name and number:          Type:
Incident commander:
What is affected:
How bad it is (impact now, and whether it is growing):
What people should do now:
When it will be mitigated and resolved, if known:
Scope: systems affected          confirmed          suspected
Containment status:
Objectives this period, and progress on each:
Outside parties engaged:
Notifications made, and due:
Decisions needed from leadership:
Next update:

GENERAL MESSAGE (after ICS 213)
To:                    Position:
From:                  Position:
Subject:
Date, time, timezone:
Message:

Reply:

Replied by:            Date, time:

ACTIVITY LOG (after ICS 214)
Name:                  Position:              Operational period:
Time (with timezone)     Activity, decision or observation

TRANSFER OF COMMAND
Outgoing IC:                      Incoming IC:
Effective (date, time, timezone):
Briefed from: ICS 201 / current IAP
Covered:
  Situation and scope
  Objectives and progress
  Organization, and who is on shift
  Open decisions
  Commitments made to outside parties
  Safety and wellbeing
  Next meetings and updates
Announced to: command staff / general staff / all responders / outside parties
Logged by:

DEMOBILIZATION CHECK-OUT (after ICS 221)
Name:                  Position:              Released at:
Assignment handed to:
Activity log to Documentation:          yes / no
Evidence and notes handed over, custody recorded:          yes / no
Temporary access revoked:          yes / no
Hardware and licences returned:          yes / no
Hours to Finance/Admin:          yes / no
Rest before next duty:
Released by: