ICS

NIMS at a glance

The National Incident Management System is FEMA's framework for how organizations work together on incidents of any kind and size. It was first issued in 2004. The current version is the Third Edition, published in October 2017.

The Incident Command System is its best-known part. NIMS also covers how resources are described, ordered and tracked, how information is shared, and three structures that sit above the incident for support, policy and public information.

COMMAND AND COORDINATIONPOLICYMultiagency Coordination GroupCyber: the executive decision group. Priorities, policy, scarce resourcespriorities, decisions, resourcessituation, requestsSUPPORTEmergency Operations CenterCyber: the crisis management team. Business impact, continuity, resourcespriorities, decisions, resourcessituation, requestsTACTICALIncident Command SystemCyber: incident commander, Command and General Staff. Runs the responseJoint InformationSystemOne set of public factsacross every partyCyber: the comms leadsof your organization,suppliers, insurer andlaw enforcementRUNNING THROUGH EVERY LEVELResource managementtyping, qualification, ordering, tracking, mutual aidCommunications and information managementinteroperable channels, common terms, common operating picture
NIMS command and coordination, from the incident up to policy, with the two components that run through every level.

Three components

ComponentWhat NIMS coversIn a cyber incidentIn this guide
Resource managementTyping, qualifying, ordering, tracking and releasing people, teams, equipment and facilities, plus mutual aidWho can fill each seat, what the retainer firm provides, how extra analysts and rebuild hardware are requested and trackedResources
Command and coordinationICS at the incident, emergency operations centers, multiagency coordination groups, and the joint information systemIncident command for the response, a crisis team for business impact, executives for policy, one voice to the publicThe organization, Above the incident
Communications and information managementInteroperable communications, common terminology, and a common operating pictureOut-of-band channels, one glossary, one status summary and timeline everyone works fromCommunications and information

Four command and coordination structures

StructureLevelDoesCyber equivalent
Incident Command SystemTactical, at the incidentDirects the responseIncident commander, Command and General Staff
Emergency Operations CenterSupportSupports incident command with resources, information and decisions, and manages consequences away from the incidentCrisis management team, business continuity
Multiagency Coordination GroupPolicySets priorities and allocates scarce resources across incidents and organizationsExecutive decision group
Joint Information SystemAcross all levelsCoordinates public information across every organization involvedCommunications leads of every party, working from one set of facts

Management characteristics

NIMS names fourteen management characteristics that hold every structure together, from common terminology to accountability. Principles lists all fourteen with their cyber meaning.

Training

FEMA's Emergency Management Institute teaches NIMS in free online courses. IS-700 introduces NIMS, IS-100 and IS-200 cover ICS, and IS-703 covers resource management. ICS-300 and ICS-400 are classroom courses for people who will command larger incidents.

Adapted from the National Incident Management System, Third Edition (FEMA, 2017). Cyber adaptation, examples and templates by Habib Tora, licensed under CC BY 4.0. Not published by, endorsed by, or affiliated with FEMA or the Department of Homeland Security. Structure after Google's SRE Incident Management Guide. Companion to PIVTR-D.