Glossary
Common terminology is the first of the NIMS management characteristics for a reason. Agree these words before the incident.
| Term | Meaning |
|---|---|
| Incident Commander (IC) | The one person with overall authority for the incident |
| Unified command (UC) | Several parties with authority sharing command through one set of objectives and one plan |
| Command Staff | Public Information, Safety and Liaison Officers, plus advisors such as counsel, reporting to the IC |
| General Staff | The section chiefs: Operations, Planning, Logistics, Finance/Admin, and Intelligence/Investigations if separate |
| Section | A major functional area of the organization, led by a chief |
| Branch, division, group | Subdivisions of a section: branch by function or area, division by area, group by function |
| Task force | Mixed resources under one leader with shared communications |
| Strike team | Resources of the same kind and type under one leader |
| Operational period | The time set for carrying out one set of objectives, as written in the IAP |
| Incident Action Plan (IAP) | The written plan for one operational period |
| Objective | An outcome with a measure and a time |
| Span of control | The number of people one supervisor manages |
| Incident command post | Where command operates. In cyber, usually the war room or command bridge |
| Check-in | Recording that a person has joined the incident, with their assignment |
| Out of band | Communications that do not depend on systems the attacker may control |
| Contained | Agree the definition in advance. PIVTR-D uses: network, process and log channels all show attacker activity stopped |
| Demobilization | The orderly release of people and resources |
| Transfer of command | Handing command to another person by briefing, announced and logged |
| Three Cs | Coordinate, communicate, control: the aims Google's ICS-based system organizes around |
| Communications lead | Google's name for the role NIMS calls the Public Information Officer |
| Operations lead | Google's name for the role NIMS calls the Operations Section Chief |
| Incident management team (IMT) | A rostered group of ICS-qualified people who deploy to manage an incident |
| AAR/IP | After-action report and improvement plan, the review format of the Homeland Security Exercise and Evaluation Program |
| Emergency operations center (EOC) | Where staff coordinate support to incident command and manage wider consequences. In cyber, the crisis management team |
| Multiagency coordination group (MAC group) | Executives who set policy and priorities across incidents. In cyber, the executive decision group |
| Joint information system (JIS) | The processes that keep public information consistent across every organization involved |
| Joint information center (JIC) | Where communicators from each organization work together |
| Resource typing | Describing a resource by kind and by capability, so requests and offers match |
| Position task book | The tasks a person must show they can do to qualify for an incident position |
| Mutual aid | Sharing resources between organizations on terms agreed in advance |
| Common operating picture | One shared, timestamped view of the incident that every level works from |