Incident Command, full guide

Incident Command

A NIMS-based guide to running incidents. Written for cybersecurity. Works for anything.

Written by Habib Tora · v1.0 · September 2026

Any organization large enough to have incidents will eventually have one that outgrows the team that found it. How that incident goes depends on three things: whether someone is clearly in charge, whether everyone hears the same facts, and whether the work is planned or improvised. The National Incident Management System answers all three, and emergency services in the United States have run on it for two decades.

This guide adapts NIMS to cybersecurity. The structure, vocabulary and paperwork carry over almost unchanged. What changes is who fills each seat and what each section does. It is laid out the way Google's SRE team presents its own ICS-based process, in three stages: prepare, respond and manage, learn. Nothing here depends on the incident being cyber.

Prepare

Most of what decides an incident is settled before it starts. The people for each seat are trained and have practised in it. The authority to isolate systems, suspend accounts and spend money is agreed. The channels, forms, contracts and playbooks are ready to use at two in the morning. Prepare lists what to have in place.

Respond and manage

The first qualified person takes command out loud. Three roles cover most incidents: an incident commander who coordinates, a communications lead who keeps every audience informed, and an operations lead who runs the technical work. When the incident outgrows one shift or one team, the rest of the ICS organization fills in around them: planning, logistics, finance, liaison, safety.

Each operational period gets written objectives and an Incident Action Plan. Command changes hands by briefing. Nobody joins the response without an assignment. Respond and manage covers the organization, sizing, the planning cycle, unified command, communications and handover.

Learn

The after-action review starts as soon as the incident closes, while memory is fresh. It is blameless: people acted on what they knew at the time, so findings go to systems, procedures and training. Every corrective action gets an owner and a date and is tracked to done. Across many incidents, recurring findings show where larger investment belongs. Learn has the review questions and the improvement plan.

NIMS in one picture

ICS is one part of NIMS. The rest adds a crisis team and an executive group above the incident, one joint voice to the public, and common ways to handle resources and information at every level.

NIMS at a glance walks through the three components and the four structures.

How it pairs with PIVTR-D

PIVTR-D covers the response lifecycle, the technical work from preparation to debrief. This guide covers the management around that work: who decides, how the team is organized, how the plan is written and handed over, and how the effort holds up past the first night.

When to stand it up

Use the structure when an incident needs more than one team, will run past one shift, or will draw in executives, counsel or outside parties. An analyst closing a phishing report needs none of it beyond knowing they are in command. An enterprise ransomware event needs most of it by the end of the first day. Sizing the response sets the thresholds.

Further reading

• National Incident Management System, Third Edition, FEMA, 2017
• Incident Management Guide, Google SRE
• Managing Incidents, Site Reliability Engineering, chapter 14
• Incident Response, The Site Reliability Workbook, chapter 9
• Postmortem Culture, Site Reliability Engineering, chapter 15
• PIVTR-D, the companion incident response field manual

Quick card

The first thirty minutes of command, and what to fill as it grows.

First thirty minutes

Positions by incident type

Each operational period

1. Objectives meeting
2. Tactics meeting
3. Planning meeting
4. IAP approved by the IC
5. Operations briefing, and the period starts
6. Execute and assess, with status to Planning
7. Executive updates at the times the IAP sets

Rules at every size

• One incident commander, named out loud.
• One boss per responder for the length of the incident.
• Three to seven people per supervisor. Split the work at seven.
• Written objectives before tactics.
• One voice to executives and the public, through the Public Information Officer.
• Every update answers: what is affected, how bad, what to do now, and when it will be fixed or the next update is due.
• Handover by briefing, announced to everyone, logged with the time.
• Nobody joins the response without an assignment.

NIMS at a glance

The National Incident Management System is FEMA's framework for how organizations work together on incidents of any kind and size. It was first issued in 2004. The current version is the Third Edition, published in October 2017.

The Incident Command System is its best-known part. NIMS also covers how resources are described, ordered and tracked, how information is shared, and three structures that sit above the incident for support, policy and public information.

Three components

Four command and coordination structures

Management characteristics

NIMS names fourteen management characteristics that hold every structure together, from common terminology to accountability. Principles lists all fourteen with their cyber meaning.

Training

FEMA's Emergency Management Institute teaches NIMS in free online courses. IS-700 introduces NIMS, IS-100 and IS-200 cover ICS, and IS-703 covers resource management. ICS-300 and ICS-400 are classroom courses for people who will command larger incidents.

Prepare

Incident command is mostly people and paperwork, and both have to exist before the incident does. The technical preparation lives in the PIVTR-D preparation playbook. This page covers what the incident organization needs in place before anyone stands it up.

People

Name at least two trained people for every seat you expect to fill, so the incident survives its first shift change. Training covers the role, the forms and the meetings. Weight it toward the incident commander, the one job nobody does day to day.

Practise in the seats. Google runs Wheel of Misfortune exercises, role-playing past incidents so less experienced on-callers build skill somewhere safe. Run tabletops the same way: replay real incidents, rotate who holds command, communications and operations, and time the first objectives and the first executive update.

Authority

Write down what the incident commander can do without asking: isolate systems, suspend accounts, take services offline, activate retainers, spend up to a set amount, engage law enforcement. Put the limits in business terms. Name who approves anything above them, and their backups.

Detection that reaches someone

The incident organization starts when someone is paged. Google's guide asks four things of an alert: it arrives in time, it covers what users depend on, it measures what users experience, and someone can act on it. For security, read that as detections that fire early enough to contain, cover the systems and identities that matter most, carry enough context to size the incident, and route to someone who can take command. The PIVTR-D identification playbook covers the detection side.

Tools that open the incident for you

Automate the first ten minutes so responders spend them thinking. One action should open the incident record from the ICS 201 template, create the command bridge and the out-of-band room, page the incident commander and on-call, start a timestamped activity log, and post the first internal notice. Google's guide points the same way: automate common tasks and the first read of impact so on-callers can work the problem.

Contracts and outside help

• Incident response retainer: how to activate it, response times, who can sign.
• Cyber insurance: notice deadline, panel vendors, what the insurer must approve.
• Counsel: who to call, and when counsel directs the investigation.
• Managed providers: which containment actions they take on their own authority.
• Law enforcement: named contacts, agreed before you need them.

Ready to run an incident

Respond and manage

Google's incident guide says it plainly: left unmanaged, a response turns chaotic. Treat it as a project in its own right, with someone planning it, someone deciding who is involved, and a record of what was done. ICS is the structure for that project.

ICS came out of the California wildfires of the 1970s, when agencies fighting the same fire used different terms, different radios and different plans. Cyber incidents break down in the same places: nobody sure who decides, three people briefing executives with three different numbers, responders on hour thirty with no relief, and a vendor, counsel and an insurer each running their own version of the response.

Coordinate, communicate, control

Google's incident management system, IMAG, is built on ICS and organizes around three Cs. Each maps onto NIMS positions.

Start with three roles

Most incidents need three seats filled. Google's guide names the same three.

Incident roles go to whoever knows the systems and the situation best. Day-job reporting lines pause until the incident closes.

The full organization

When the incident runs past one shift or one team, the rest of the structure fills in around those three.

Getting more help

NIMS describes Incident Management Teams: rostered groups of ICS-qualified people, typed by capability, who deploy to manage incidents that outgrow local capacity. Google keeps the same capability as Incident Response Teams it can activate for major incidents. In cyber, the equivalents are an internal major-incident team drawn from across the organization, the incident response firm on retainer, and an executive crisis team for decisions above the incident commander's authority. Decide in advance who activates each one, and how.

In this section

Principles

NIMS names fourteen management characteristics. Together they let people who do not normally work together run one response. The right-hand column is what each looks like in a cyber incident.

The organization

One commander at the top, a Command Staff beside them for the things only command should own, and a General Staff below who run the work. Positions are filled only when the incident needs them. An empty box on the chart is a job the IC still holds.

Command

Incident Commander

Owns. Objectives and priorities, approval of the Incident Action Plan, orders for resources beyond the sections' authority, what goes to executives and the public, transfer of command, and the call to demobilize.

First hour. Takes command out loud, sizes up, writes objectives, names an Operations lead, opens communications and sets the first briefing.

Stays off. The keyboard. An IC doing technical work leaves nobody watching the whole incident.

In cyber. The IC needs authority agreed in advance to isolate systems, suspend accounts, activate retainers and spend money. Write it into policy with business-impact and spending limits.

Deputy Incident Commander

Owns. The same qualification as the IC. Runs command while the IC rests, takes delegated work such as coordinating unified command members, and is the default relief at shift change.

Public Information Officer

Owns. Every message leaving the incident organization: executive updates, staff notices, customer and partner statements, media, status pages.

In cyber. Drafts from the incident status summary so every audience gets the same numbers. Clears wording with Legal. Routes attacker contact, extortion notes and leak-site posts to the IC and Legal, unanswered.

Safety Officer

Owns. Authority to stop any action that puts people at risk, and the plan that keeps responders fit to work.

In cyber. Watches three risks. Responder fatigue: shift lengths, rest, handover. Physical processes: where containment touches operational technology, isolating a controller or a segment can stop a process or disable a safety system, so engineering signs off first. Personal safety: staff named in extortion or doxxing get support and, where needed, protection.

Liaison Officer

Owns. The single point of contact for outside parties that are not in command.

In cyber. The outside response firm's engagement lead, the insurer and breach coach, law enforcement, regulators, the ISAC, managed service providers, suppliers, and key customers' security teams. Keeps a log of every commitment made to them.

Legal advisor

Owns. NIMS lets command add technical specialists as advisors. Counsel is the one every cyber incident needs: privilege, notification obligations and their clocks, law enforcement engagement, contracts with responders, and review of anything said outside the organization.

General Staff

Operations Section Chief

Owns. The response work, organized to meet the IAP's objectives. Builds groups, names their supervisors, keeps span of control inside three to seven.

In cyber. This is where the PIVTR-D response loop runs: investigation and scope, containment, eradication and recovery, with an OT group where plant systems are involved. Reports status to Planning on the cadence the IAP sets.

Planning Section Chief

Owns. The situation picture, the Incident Action Plan and the planning cycle, resource status, documentation, and the demobilization plan.

Units. Situation: scope, attack timeline, status summary. Resources: who is assigned, resting, and relieving whom. Documentation: activity logs, decision records, the evidence register index. Demobilization: release plan and check-out.

In cyber. Owns the attack timeline and the incident record, the two documents every later review depends on.

Logistics Section Chief

Owns. Everything responders need to do the work.

In cyber. Clean administrative workstations, break-glass accounts, access for outside responders, forensic licences and storage, spare hardware for rebuilds, the out-of-band channel, the war room, food, and places to rest.

Finance/Admin Section Chief

Owns. Time, cost, procurement, contracts and claims.

In cyber. Tracks every responder hour and outside invoice from the first hour, approves emergency purchases, activates retainers, and keeps the insurer's claim file. Read the cyber policy's notice deadline and panel-vendor terms before the incident, then track them during it.

Intelligence/Investigations

Where it sits. NIMS lets the intelligence and investigations function sit inside Planning, inside Operations, as its own General Staff section, or with the Command Staff.

In cyber. Forensic analysis, threat intelligence and evidence custody. Give it its own section when the investigation is the main effort, when law enforcement works alongside, or when counsel directs the investigation for privilege. Otherwise it stays as the investigation group in Operations.

Branches, groups and task forces

ICS gives the pieces under a section fixed names, so a request for a task force means the same thing to everyone.

Who usually fills each seat

Train two people for every seat you expect to fill. Incidents run longer than one person can.

Sizing the response

NIMS sorts incidents into five complexity types. Type 5 is the smallest. Type 1 is the most complex. The type tells you which positions to fill and whether the plan must be written down.

Example

If your organization already uses severity levels, map them once, in writing, and publish the mapping.

When to grow

• A supervisor has more than seven people reporting.
• The incident will run past the current operational period.
• An outside response firm, insurer, regulator or law enforcement agency is engaged.
• Customers, the public or the media will hear about it.
• Containment could affect a physical process or anyone's safety.
• Two parts of the organization claim authority over the same systems.
• Business operations are disrupted beyond the technology estate: activate the crisis team as well. See Above the incident.

Order of growth

Add positions in the order the workload usually arrives: an Operations lead, then a Public Information Officer, then Planning with documentation first, then Liaison, then Logistics, then Finance/Admin. Safety joins as soon as shifts run past twelve hours or containment touches a physical process.

When to shrink

Fold positions back as their workload drops, returning their duties to the person above them. The IC announces each change and updates the organization assignment list.

The planning cycle

An operational period is the time set for carrying out one set of objectives, as written in the Incident Action Plan. Each period gets its own objectives, assignments and briefing. The plan for the next period is written during the current one.

Setting the period length

Start with twelve-hour periods during active containment, so each shift has its own plan and briefing. Move to twenty-four hours once eradication and recovery are routine, and to longer periods for monitoring. The IC sets the length, and it goes in the IAP.

The meetings

A day in twelve-hour periods

Example

What goes in the IAP

• Objectives and command emphasis (ICS 202)
• Organization assignment list (ICS 203) or chart (ICS 207)
• Assignment lists, one per group or division (ICS 204)
• Communications plan (ICS 205)
• Safety and wellbeing message
• Current situation summary

For Type 4 and 5 incidents the incident briefing (ICS 201) is the plan.

Unified command

Unified command is how several parties with authority over the incident run one response. They agree one set of objectives and one plan. Each keeps authority over its own people and budget, and none acts outside the plan without telling the others.

Who sits in it

A party joins unified command when it holds authority or accountability for part of the response.

Rules

• One set of objectives and one IAP, approved by every member.
• One Operations Section Chief, whatever the number of members.
• One voice outside the incident, through the Public Information Officer.
• Members sit together, or on one bridge, during planning.
• A member who must act outside the plan says so first and the others hear it before it happens.

Counsel and privilege

If counsel directs the investigation to preserve privilege, record that in the IAP. Documentation, the forensic report and outside responders' deliverables then follow counsel's routing, and Planning keeps the record index to match.

Managed providers

A provider that can isolate hosts or disable accounts in your environment acts inside the plan. Agree in advance which actions it takes on its own authority and which need the Operations Section Chief, then write that list into the IAP so the night shift knows it too.

Insurers

An insurer may require notice within a set time and may direct which response firms and counsel you use. It works through Liaison and Finance/Admin, and its requirements go into the IAP as constraints.

Above the incident

Incident command runs the incident. When the incident reaches the whole organization, NIMS adds three structures above and around it. Each has its own job, and keeping the jobs separate leaves the incident commander free to run the response.

Emergency operations center: the crisis team

An EOC supports incident command and manages consequences away from the incident. In a cyber incident that is the crisis management team: business continuity, operations, finance, HR, facilities and customer operations, led by an executive who is not the incident commander. It runs manual workarounds while systems are down, keeps customers served, finds extra staff and money, and tells the incident commander what the business needs.

Activate it when business operations are disrupted beyond the technology estate, when the incident will run past a day, or when the response needs resources beyond the incident commander's authority.

Multiagency coordination group: the executive decision group

A MAC group is a small set of executives who set policy and priorities when demands exceed resources or several incidents compete. In cyber: the chief executive, general counsel, finance, operations, security and technology leadership, with the board kept informed. They decide what only they can decide: taking a line of business offline, which business unit restores first, public disclosure, any engagement with an extortionist with counsel advising on legal and sanctions exposure, and spending beyond set limits. They leave tactics to the incident commander.

Joint information system: one set of public facts

A JIS coordinates public information across every organization involved. A supplier breach that reaches your customers, or an incident with law enforcement, an insurer and a managed provider involved, puts several communications teams in front of the same audience. The JIS keeps their statements consistent: shared facts, agreed timing, each party speaking for its own part. A joint information center is where those communicators work together, in a room or on a bridge.

How they connect

Resources

NIMS resource management is how an incident gets the right people and equipment, and gives them back. It rests on three things: describing resources the same way everywhere, knowing who is qualified, and running every request through one process.

Typing

NIMS describes a resource by kind, what it is, and type, how capable it is. Typing lets a request say exactly what is needed and lets a supplier confirm it can deliver. Define your cyber resources the same way before the incident.

Example

Qualification and credentialing

NIMS separates qualifying a person for a position, certifying that they meet the standard, and credentialing them so other organizations can trust it. FEMA's qualification system uses position task books: the tasks a person must show they can do in a role. Write a one-page task book for each seat you fill, and sign it off after an exercise or a real incident.

The resource management process

NIMS runs every incident resource through six steps. Several resources can be at different steps at once.

Mutual aid

Mutual aid agreements let organizations lend each other resources on terms agreed in advance. For cyber, the sources are your sector's ISAC, peer organizations, technology partners, and government support, which varies by sector and state. Agree the terms before you need them: who can ask, what is provided, who pays, and how access and confidentiality work.

Communications and information

Google's guide treats keeping users, stakeholders and leaders informed as just as important as the technical mitigation. Consistent updates at the right level of detail build trust.

What every update answers

1. What is affected: systems, data, locations, people.
2. How bad it is: impact now, and whether it is growing.
3. What people should do: workarounds, password resets, channels to avoid.
4. When it will be mitigated and resolved, or when the next update comes if nobody knows yet.

The communications plan

The communications plan says which channel carries what, who is on it, and how anyone confirms who they are talking to. Planning writes it. Logistics stands it up. The IC approves it with the IAP.

Example

Out of band

Assume the attacker can read corporate email and chat until scoping shows otherwise. Run the response on accounts outside the affected identity provider, verify each member by voice before adding them, and keep the roster somewhere offline. Say out loud when the incident moves channels, and why.

Cadence

Executives get the status summary at fixed times set in the IAP. Every update ends with the time of the next one, including updates with nothing new. A fixed cadence cuts interruptions to responders more than any other single measure.

One voice

Everything leaving the incident goes through the Public Information Officer, drawn from the same status summary and cleared with counsel where it could create legal exposure. Responders asked by anyone outside the organization send them to Public Information or Liaison.

Common operating picture

NIMS calls it the common operating picture: one shared view of the incident that everyone works from. Planning's Situation unit owns it. In cyber it is the status summary, the attack timeline and the scope list, kept in one place, timestamped, and read by incident command, the crisis team and the executives alike. Anyone who needs a number takes it from there.

Writing it down

• Plain language. No acronyms outside the glossary.
• Every time with its timezone.
• Requests and decisions that must survive the incident go on a general message (ICS 213).
• Everyone in a role keeps an activity log (ICS 214).

Taking and handing over command

Taking command

The first qualified person to reach the incident takes command and says so on the channel responders are using: their name, the time, the incident name, and where the command bridge is. They open an activity log and start the incident briefing.

Seniority alone confers no command. A senior leader who arrives gets a briefing, then either takes command through a formal transfer or supports the IC in place.

Transferring command

Command transfers when a more qualified person arrives, when the incident outgrows the current IC, at shift change, or when the IC is too tired to continue.

1. Brief the incoming IC face to face or by voice, using the ICS 201 or the current IAP.
2. Walk the open decisions and every commitment made to outside parties.
3. Agree the effective time.
4. Announce the change to Command and General Staff, all responders, and outside parties who deal with the IC.
5. Log it, with both names and the time.

Shift handover

Fatigue

Set a maximum shift length before the incident, give the Safety Officer authority to enforce it, and roster relief from the first night. The people who stayed up to contain the incident are rarely the right people to make the eradication decisions the next afternoon.

Demobilization

Demobilization releases people and resources in order, with nothing left behind: no open access, no loose evidence, no unbilled hours. Planning writes the demobilization plan as soon as the end is in sight, and the IC approves it.

Release order

Release outside responders and borrowed staff as their objectives close. Keep core responders until eradication is verified. Keep monitoring capacity after that, at the level the recovery plan calls for.

Check-out, per person (after ICS 221)

Closing the incident organization

Learn

Google's guide makes learning from outages a core tenet and notes that outages left unchecked tend to come back and pile up. Its main tool is the blameless postmortem. NIMS reaches the same place through the after-action report and improvement plan, the AAR/IP format of the Homeland Security Exercise and Evaluation Program.

Start while it is fresh

Start the write-up as soon as the incident is resolved. Planning already holds the raw material: the activity logs, the timeline, the Incident Action Plans, the decision records and the status summaries. The review turns that record into an explanation.

Blameless

Everyone in the response acted in good faith on what they knew at the time. Findings go to systems, procedures and training. Record the decisions and the information behind them, and leave individual names out of the causes.

Review the management as well as the fix

The technical cause is examined in the PIVTR-D debrief. Review the incident management alongside it, area by area.

Improvement plan

Each corrective action gets one owner, a due date agreed with the people who will staff and fund it, and a way to confirm it is done. Actions go into the owning team's backlog and are tracked there until closed. Share the review widely inside the organization.

Across incidents

Once reviews are routine, keep their findings in one structured register. Findings that recur across incidents show where larger investment belongs: a detection gap that keeps adding hours, a handover that keeps dropping decisions, a supplier that keeps being the way in.

AFTER-ACTION REPORT AND IMPROVEMENT PLAN (after HSEEP AAR/IP)
Incident name and number:
Dates, first sign to close:
Incident type at peak:
Prepared by:                  Reviewed by:

1. Summary
   What happened, in five sentences or fewer.

2. Timeline
   First sign, command established, contained, eradicated, recovered, closed.

3. What worked
   Strength      Why it worked      How we keep it

4. What to improve
   Area      Observation      Cause      Recommendation

5. Improvement plan
   Action      Owner      Due      How we confirm it is done      Status

6. Hours and costs
   Responder hours:        Outside costs:        Insurance claim status:

7. Distribution
   Who receives this report:

Forms and templates

ICS forms exist so that anyone joining the incident can read its state in minutes. These are the ones a cyber incident uses most, cut down to plain text so they paste into a ticket, a chat room or a document. FEMA publishes the full set in its ICS forms booklet. The after-action report and improvement plan is on Learn.

INCIDENT BRIEFING (after ICS 201)
Incident name:                    Incident number:
Prepared by:                      Date, time, timezone:
Incident commander:

1. Situation
   What happened, what is affected, what is known, what is not.

2. Current objectives
   1.
   2.
   3.

3. Actions taken so far
   Time      Action      By

4. Current organization
   IC:
   Operations:
   Planning:
   Public Information:
   Liaison:
   Legal advisor:

5. Resources assigned and ordered
   Resource      Assigned to      Status

6. Safety and wellbeing
   Hours worked, physical process risks, personal safety concerns.

7. Next briefing:

INCIDENT OBJECTIVES (after ICS 202)
Incident name:
Operational period: from                    to
Objectives, each with an outcome, a measure and a time:
  1.
  2.
  3.
Command emphasis (priorities, constraints, risk tolerance):
Decisions made by command this period:
Safety and wellbeing message:
Attached: organization list, assignment lists, communications plan, situation summary
Approved by (IC or each unified command member):          Time:

ORGANIZATION ASSIGNMENT LIST (after ICS 203)
Operational period:
Command
  Incident commander:
  Deputy:
  Public Information Officer:
  Safety Officer:
  Liaison Officer:
  Legal advisor:
Operations Section Chief:
  Group, supervisor, members:
Planning Section Chief:
  Situation unit:
  Resources unit:
  Documentation unit:
Logistics Section Chief:
Finance/Admin Section Chief:
Intelligence/Investigations (if separate):
Unified command members (if used):

ASSIGNMENT LIST (after ICS 204)
Operational period:
Group or division:                Supervisor:
Members:
Work assignment, and the objective each task serves:
Special instructions (change windows, systems not to touch, evidence handling):
Status to Planning at:            via:
Channels: primary            backup
Prepared by (Planning):           Approved by (Operations):

COMMUNICATIONS PLAN (after ICS 205)
Treat corporate email, chat and identity as compromised until scoping shows otherwise.
Purpose              Primary             Backup              Owner
Command bridge
Operations
Executive updates
Legal, privileged
Outside parties
Roster kept at (offline):
How members verify each other:
Status cadence:

INCIDENT STATUS SUMMARY (after ICS 209)
As of (date, time, timezone):
Incident name and number:          Type:
Incident commander:
What is affected:
How bad it is (impact now, and whether it is growing):
What people should do now:
When it will be mitigated and resolved, if known:
Scope: systems affected          confirmed          suspected
Containment status:
Objectives this period, and progress on each:
Outside parties engaged:
Notifications made, and due:
Decisions needed from leadership:
Next update:

GENERAL MESSAGE (after ICS 213)
To:                    Position:
From:                  Position:
Subject:
Date, time, timezone:
Message:

Reply:

Replied by:            Date, time:

ACTIVITY LOG (after ICS 214)
Name:                  Position:              Operational period:
Time (with timezone)     Activity, decision or observation

TRANSFER OF COMMAND
Outgoing IC:                      Incoming IC:
Effective (date, time, timezone):
Briefed from: ICS 201 / current IAP
Covered:
  Situation and scope
  Objectives and progress
  Organization, and who is on shift
  Open decisions
  Commitments made to outside parties
  Safety and wellbeing
  Next meetings and updates
Announced to: command staff / general staff / all responders / outside parties
Logged by:

DEMOBILIZATION CHECK-OUT (after ICS 221)
Name:                  Position:              Released at:
Assignment handed to:
Activity log to Documentation:          yes / no
Evidence and notes handed over, custody recorded:          yes / no
Temporary access revoked:          yes / no
Hardware and licences returned:          yes / no
Hours to Finance/Admin:          yes / no
Rest before next duty:
Released by:

Glossary

Common terminology is the first of the NIMS management characteristics for a reason. Agree these words before the incident.

Sources and licence

This guide adapts the National Incident Management System, Third Edition, published by FEMA in October 2017, and the Incident Command System forms, to cybersecurity. Both are works of the United States government. The three components, the four command and coordination structures, the fourteen management characteristics and the resource management process are summarized from NIMS.

The adaptation, cyber mappings, examples and templates are by Habib Tora and are licensed under CC BY 4.0. Take it and change it for your organization.

The three-stage structure, the three Cs and the three core roles take their cue from Google's Incident Management Guide, written by Adam Crume, Alex Cepoi, Chelsea Granados, Roxana Loza, Steve McGhee, Svetlana Gites, Trevor Mattson-Hamilton and Vrai Stacey, and from the Managing Incidents chapter of Site Reliability Engineering. Both are summarized and credited here. No text from them is reproduced.

The after-action format follows the AAR/IP of the Homeland Security Exercise and Evaluation Program.

Not published by, endorsed by, or affiliated with FEMA, the Department of Homeland Security or Google.