Chapter 3 – Incident Command System


Steve Wright
Justice Institute of British Columbia (JIBC)

The Incident Command System (ICS) is a standardized on-site management system designed to enable effective, efficient incident management by integrating a combination of facilities, equipment, personnel, procedures, and communications operating within a common organizational structure. The ICS is used to manage an incident or a non-emergency event and can be used equally well for both small and large situations.

The ICS is a usable, adaptable and well-tested approach to emergency management, that is used by government, first responder agencies and industry.

The success of the ICS rests with its:

  • modular organization; (can be easily expanded or contracted as needed)
  • the use of common terminology;
  • unified command structure;
  • span-of-control; and
  • resource management

These features and positions of ICS are explained in more detail.

General Staff Functions

When an incident is too large or too complex for just one person to manage effectively, the Incident Commander may appoint General Staff Positions, called Section Chiefs, to oversee major components of the Operation.

These positions include:

  • Operations “the do-ers”
  • Planning “the thinkers”
  • Logistics “the getters”
  • Finance “the payers”

Operations (“The Do-ers”):

The Operations Section is responsible for all tactical operations at the incident. This section carries out tactical goals identified by the Incident Commander including fighting the fire, performing rescues, treating patients, and other tasks to deal with the emergency. All tactical positions and operations report through the Operations Section Chief. These include:

  • Branches
  • Groups & Divisions
  • Strike Teams & Task Forces
  • Single Resources

Note – Staging reports to Operations when established; if not, Staging will report to Command

Planning (“The Thinkers”)

The Planning Section is responsible for the collection, evaluation, dissemination, and use of information relevant to the incident. This Section reports directly to the Incident Commander. Units within the Planning Section include: Resources Unit, Situation Unit, Documentation Unit, Demobilization Unit and Technical Specialists

Logistics (“The Getters”)

The Logistics Section is responsible for providing facilities, services and materials for the incident. In a large scale event, the Logistics Section is typically divided into two branches: The Service Branch & The Support Branch

  • The Service Branch includes: Communication Unit, Medical Unit & Food Unit
  • The Support Branch includes: Supply Unit, Facilities Unit & Ground Support Unit

Finance/Administration (“The Payers”)

The Finance/Administration Section is responsible for the accounting and financial aspects of an incident, as well as any legal issues that may arise. Units within the Finance/Administration Section include: Time Unit, Procurement Unit, Compensation/Claims Unit and Cost Unit

Command Staff Functions

Command Staff Positions include Safety Officer, Liaison Officer & Information Officer. These functions are performed by the Incident Commander until the Span of Control or Incident Nature dictate they be delegated.

Safety Officer

By nature of the duties they perform, emergency responders are at risk of death, injury or illness. Incident safety should be a primary concern of all those who respond to the aid of the community or jurisdiction they serve. To help minimize the risk to responders, one of the ways the Incident Command System (ICS) provides for responder safety is by giving the Incident Commander (IC) the ability to appoint and use a Safety Officer. This position is a member of the ICS organization’s command staff. While the IC has the overall responsibility for the safety of the responders, the ISO has the direct responsibility to focus on the safety aspects of the incident.

The Safety Officer is an advisor to the incident commander but has the authority to stop or suspend operations when unsafe situations occur. This authority is clearly stated in national standards, including NFPA 1521 “Standard for Fire Dept Safety Officer Professional Qualifications.” General Safety Officer Duties Include:

Monitoring safety conditions and develops measures for ensuring the safety of all assigned personnel.

Corrects unsafe situations via the chain of command.

May stop activity if personnel are in imminent danger.

Prevent injury and loss of life through risk management and hazard reduction

Will continuously walking the scene, the Safety Officer will note and identify life safety hazards including but not limited to:

Swimming pools, open excavations, downed power lines, elevation changes, blocked egress points, significant changes in fire dynamics, traffic & indications of illicit and illegal activity or any other hazard to personnel.

At large scale & complex incidents, Assistant Safety Officers may be assigned to assist the ISO.

The Safety Officer should be qualified and knowledgeable in firefighting tactics, structural integrity and well versed with Department Guidelines, Policies & Procedures

The timing of Assigning a Safety Officer is dependant on a number of factors: including span of control, complexity and nature of the incident, and available personnel.

Typically a Safety Officer will come from the second alarm.

Safety Officer priority is given to incidents including high rise fires, incidents over water, commercial or industrial building fires, specialty incidents, aircraft incidents, weather extremes or Hazardous Materials incidents.

Liaison Officer

The command staff member who is responsible for the IC’s communication with outside agencies. This role buffers the Incident Commander from having to deal with a number of external agencies.

(Public) Information Officer

A Command Staff position that is responsible for gathering and releasing incident information to the news media and other appropriate agencies. This position reports directly to the Incident Commander.

This position can also be used to pass on information to on-scene crews.

Additional ICS Positions and Functions


A Branch is a Supervisory Level which is established in either Operations or Logistics to provide for appropriate Span of Control. Branches are supervised by a Branch Director in charge of a number of divisions or groups. This position reports to a Section Chief or the Incident Commander. Examples include Fire Branch, Police Branch, Special Operations Branch, EMS Branch and HAZMAT Branch.


A Division is a Supervisory Level to divide an incident into geographical areas of operations. Divisions are supervised by a Division Supervisor in charge of a geographical operation. Examples include Division 2 (operating on the second floor), Roof Division (operating on the roof) and Charlie Division (operating at the rear of the building).


A Group is a Supervisory Level established to divide the incident into functional areas of operation. Groups are responsible for performing an assignment. They can move throughout an event and can also be established with both functional and geographical designations (e.g., west wing Rescue group and east wing Rescue group). Groups are supervised by a Group Supervisor in charge of a functional operation at the tactical level. This position reports to a Branch Director, the Operations Section Chief or the Incident Commander. Examples include Search Group, Fire Attack Group and Ventilation Group.

Note – divisions and groups are at the same supervisory level and do not report to one another. It is the supervisors who are required to coordinate their actions and activities with each other.

Strike Teams

A Strike Team is a specific combination of the same kind and type of resources. Strike Teams are supervised by a Strike Team Leader in charge of a group of similar resources. For example, 5 Engines assembled which can be utilized to accomplish a common goal.

A Strike Team is 3-7 similar units assembled to accomplish a common goal.

Task Forces

A Task Force is a combination of mixed resources assembled for a tactical need. A Task Force is supervised by a Task Force Leader in charge of dis-similar resources. Examples include 1 Engine, 1 Rescue, 1 Ladder assigned to a single alarm building fire or 1 Engine, 1 Police Unit, 1 Ambulance assigned to mitigate a common goal.

A Task Force is 3-7 mixed units assembled to accomplish a common goal.

Single Resources

Single Resources are Companies and Crew available for tactical needs

Company is the apparatus and staff that operate it

Crew is only the staff, not including the apparatus

Single Resources are individual pieces of equipment and/or personnel available for tactical needs.


Staging is a standard procedure to manage uncommitted resources at the scene of an incident. This organization allows the incident commander to determine the most appropriate assignment for each. Without proper staging, an IC can quickly lose control of resources at a scene. There are two levels of staging:

Level 1 Staging
Level 1 staging is in total control of the Incident Commander and typically represents the first alarm assignment. Generally at the incident or close at hand for the IC to utilize during the initial tactical operations, down the street, nearest corner, secondary water supply etc. Level 1 staging allows the IC time to determine the best initial strategy and tactics and to minimize on scene congestion allowing for an organized positioning of apparatus and deployment of initial resources.

Level 2 Staging

This level of staging is generally used for greater alarm assignments and directs responding companies to a designated standby location (chosen by the IC) located a short distance away from the immediate scene location. All other support services can be directed to this location. This distance should be no closer than 300 feet from the incident but close enough for immediate deployment of resources when requested. Level 2 staging areas always have a staging manager and preferably at least 1 assistant, who reports directly to the IC when running the incident or to the Operations Section Chief if one has been established. Areas within level 2 staging can include on-deck or immediately available crews, and food, medical, rehab, fuel, etc.

Fire Ground Geography

Adam Lossing

For the purposes of firefighting operations, the exterior of the scene is generally divided into specific regions or designations based on geography. Building sides are designated as Alpha, Bravo, Charlie and Delta. The front, or “address side” is usually identified as the Alpha with Bravo, Charlie and Delta follow clockwise to the left of Alpha .

Although Alpha is the “normally” the address side, the Alpha side can be wherever the IC designates.



Hazard Control Zones

The concept of limiting access to the fire scene can be defined in a variety of ways. It seems appropriate to extend the lessons learned from hazardous materials responses regarding zones, as similar zones are possible at structure fires. Working areas for responders are generally defined as Hazard Control Zones, whereas a fire perimeter or fire zone is an exclusion area to keep unauthorized people away from the scene.

These areas and zones can include:

Fire Zone – a wide perimeter beyond the working zones usually staffed by police to keep unauthorized people away from a scene and out of danger.

Hot Zone – a working or operating zone considered safe for only responders wearing appropriate levels of protective clothing.

Warm Zone – a working zone established when different levels of protective clothing are needed for various areas. A Warm zone is not always necessary at a structure fire.

Cold Zone – a working zone considered safe for responders where protective clothing is not required. Areas commonly located in this zone can include the command post, medical treatment and rehabilitation areas, or other areas for staff and command functions. In most cases, there should be a cold zone established.

Securing the Scene

A fire officer who suspects that a crime has occurred should immediately request the response of a fire investigator or police. In these circumstances, the scene must be secured to protect any evidence that exists. Protecting the scene includes preventing unauthorized personnel from entering. The fire officer must ensure that fire department personnel maintain custody of the scene until it can be turned over to an investigator or police.

Responsibilities of Command

The Fire Officer is responsible for establishing command and completing three strategic priorities:

  • Life Safety
  • Incident Stabilization
  • Property Conservation & Environmental Protection

The first fire officer or fire department member to arrive at a scene is expected to assume command of the incident. Assuming command includes providing an initial radio report announcing:

  • Who is in command
  • What do I see
  • What am I doing
  • What do I need

Example: “Dispatch, Engine 1 is on scene at 123 Main Street. We have a 2-storey type V legacy construction 50’ x 100’ detached single-family house…with heavy black turbulent velocity smoke and flame self-venting from the second story alpha-bravo corner. Engine 1 is establishing Main Street Command and is located on the Alpha Side. We have secured a water supply and will be doing some confinement and this will be an offensive attack. Command is requesting a second alarm, Police x4, BC EHS x2, Hydro & Gas.”

Command Options

The IC has three options when arriving at an incident and assuming command.

Investigation Mode

Used when no obvious hazard is present and further investigation is required

Fast Attack Mode

Used when immediate intervention is required for life safety or incident stabilization. While the first Officer is in Command, this is designed for a short duration until the situation is stabilized. If the situation cannot be stabilized quickly, the Officer must withdrawal and transition to Command Mode. Fast Attack can also be used when a Company Officer is task involved, and command is transferred to the next arriving Company Officer.

Command Mode

Some events are so large, complex, or dangerous that they require an immediate establishment of Command

Duties of the Incident Commander

  1. Determining Strategy
  2. Selecting Incident Tactics
  3. Setting the Action Plan
  4. Developing the ICS Organization
  5. Managing Resources
  6. Coordinating Resource Activities
  7. Providing for Scene Safety
  8. Releasing Information about the Incident
  9. Coordinating with Outside Agencies

Levels of Command

The ICS includes three levels of command, with a set of responsibilities being assigned to each level.

Strategic Level

Strategic Goals: Prioritized strategic goals must be formulated prior to the development of tactical assignments. Strategic goals are broad-based objectives that commonly answer the question “what needs to be one?” Rescue is an example of a strategic goal. The commonly used acronym for determining strategic goals is RECEOVS

Tactical Level

Tactical Objectives: Tactics are more specific than strategies but are based on strategic goals. Tactics commonly answer the questions “how are we going to accomplish this goal?” For example, a “right-hand primary search” could be a tactic that would be chosen to support the strategic goal of rescue.

Task Level

Task Level Assignments: The task-level involves the “doing part” of the action plan. This is based primarily on training, Operational Guidelines and established practices. Task level assignments also answer the questions “who is going to do it and what will they need?” An example would be “Engine Four’s Company will conduct the primary search on the second floor with a charged hose line.”

One Company Officer may operate at any of these three levels simultaneously. For example: at an early stage of an incident as the Incident Action Plan develops. As the incident expands in scope and complexity and more resources arrive, the management responsibilities can be shared, delegated or subdivided in order to maintain span of control.

Transfer of Command

During a major incident, the first-in officer will usually transfer command to a higher ranking officer or chief officer upon their arrival. A “large incident” is department-specific, however, all departments have the ability to utilize the Incident Management System to ensure the situation is covered from all angles. The initial Company Officer will start the scene, start their own IAP and once relieved of command, will support the IC within the expanded system. Not all incidents fully develop the IMS; however all incidents will utilize several positions – and if the call gets out of control quickly, it can be expanded to give the Department the tools necessary to mitigate the problem

Command is transferred by:

  • Face to Face or radio communication by Acting IC and incoming IC with information about the call ie: Confirmation of tactical assignments, strategic mode and action plan
  • Verbal broadcast over the radio so all teams and dispatch are aware of who is now in Command

Sizing Up the Incident

Size-up is a systematic process of gathering and processing information to evaluate the situation and then translating that information into a plan to deal with that situation.

Size-up Phases

The National Fire Academy (NFA) has developed a size-up system that includes three phases:

  1. Pre Incident information
  2. Initial size-up
  3. Ongoing size-up

Phase One: Pre Incident Information

Phase one considers what you know before the incident occurs. Information about the building and occupancy, such as building layout and construction type, built-in fire protection systems, nature of the contents and construction type are all needed to perform an accurate size-up. Pre Incident information should also identify water supply sources including their: location, accessibility and capacity.

Phase Two: Initial Size-up

The second phase of the size-up begins with receipt of an alarm.

Three questions to be answered are:

  1. What do I have?
  2. Where is it going?
  3. How do I control it?

This phase often involves a 360 walk-around of the building to determine what the problems are? Problems assessed can include:

  • Fire and location
  • Room and contents fire vs structural involvement
  • Confirmed or possible occupants
  • Smoke conditions including colour, volume, density, colour and rate of change
  • Building construction type
  • Water supply and exposure concerns, or
  • Any other problems or concerns identified

S.L.I.C.E.R.S. is a common size-up acronym that stands for Size-Up = Locate the Fire, Isolate the Flow Path, Cool from a Safe Distance, Extinguish and then Rescue and Salvage are considered tactics of opportunity added in as necessary. While most agree that the latest research can improve firefighter safety, they struggle to translate the research into fireground tactics and implement that change in a successful model – SLICERS was developed to “operationalize” fire dynamics research. This acronym rethinks the tactics of old and incorporates the latest research into operations with a focus on fire flow path and rapid water for cooling, from outside if possible. The concept has been vetted with the lead researchers involved at UL and NIST and has their endorsements.

The SLICERS acronym is NOT designed to replace the well known RECEOVS method (discussed later) that has been widely adopted by the fire service over the years but instead is to be used by the first arriving company officer to assist with size-up. Where RECEOVS is more for the Battalion Chief/Incident Commander and their tactical priorities and remains an overall incident management tool.

Phase Three: Ongoing Size-up

The third phase addresses the need to continually size up the incident as it evolves. This phase includes ongoing analysis of the situation and the ongoing evaluation of the effectiveness of the plan being executed.

The ongoing size-up requires a constant flow of feedback. The Incident Commander needs to know when:

  • An assignment is completed
  • An assignment cannot be completed
  • Additional resources are needed
  • Resources can be released
  • Conditions have changed
  • Additional problems have been identified
  • Emergency conditions exist

Given the amount of information that an IC must assimilate, it is easy to lose track of how much time has passed on the fireground. NFPA 1500 now requires dispatch centers to notify command every 10 minutes until the fire is knocked down, the incident becomes static, or the IC cancels the notification. This notification helps the IC track elapsed time.

Note – it is critical that burn time takes into account the time the fire was burning prior to notification and while units were responding, not just the amount of time since they arrived on the fire scene.

Operational Mode

As part of a size-up, the incident commander should declare an operational mode. This lets everyone on the fireground, and those responding know what the rules of engagement will be. Generally, there are three operational modes:

Offensive Mode

An offensive strategic mode is appropriate in a fire’s early growth or when sprinklers are limiting the fire’s growth. This mode is chosen when firefighters are going to enter the building to fight the fire and/or rescue occupants. Offensive mode is often selected in a fire that involves room and contents only and has not progressed to include the structural components of the building. A suitable initial tactic when fire is showing from the exterior of a building is to pencil the fire in order to confine it and set the fire clock back. This tactic is often utilized by first arriving crews to stabilize the situation until additional resources arrive or water supply is established. Depending upon the success of this initial water application from the exterior an offensive operational mode can then be selected.

Structural conditions bear heavily on the offensive or defensive decision. Even with sufficient resources, an interior attack should not be conducted in an unsafe building.

Defensive Mode

A defensive mode is appropriate when initial attack efforts are not successful or when a fire has progressed to the point where the structural stability is questioned. A defensive mode is also appropriate when insufficient resources or water are available to fight a fire. It should be noted that once an operational mode is chosen it can be changed. For example, an offensive operational mode may initially be chosen to perform a rescue or to fight a fire, once complete the decision can be made to switch to defensive mode.

Transitional Mode

Used when initial crew(s) arrive one scene and are presented with smoke and flames showing from an exterior opening, usually a window. The initial tactic is to use a handline to action/confine the fire (straight stream, steep in the window and steady – no movement of the stream). The goal is to reset the fire clock, buying time for resources to arrive while at the same time making conditions inside the structure more enable for possible occupants and entering fire attack teams. Also with the fire knocked down, more aggressive ventilation can follow without the risk of inducing flashover.

NIST and UL studies showed that this offensive exterior attack – introducing water from the outside – reduced temperatures in other parts of the house at some distance from the fire but did not completely extinguish the fire. It slowed the growth of the fire by cooling huge quantities of very hot gaseous fuel and solid fuel below its ignition temperature. This offensive exterior attack is sometimes referred to as a blitz attack, a transitional attack or, by using a military metaphor, softening the target.

Non-intervention Mode
There are times when non-intervention is the most appropriate option, such as when hazardous materials are involved and the runoff would be environmentally worse than letting the fire burn or when it is simply too dangerous to fight a fire. It is important to emphasize that these decisions are often made following a risk vs. benefit analysis.

Developing an Incident Action Plan (IAP)

The first arriving officer at a fire incident assumes the role of the incident commander. The initial incident commanders responsibilities include conducting a size-up, developing an incident action plan to mitigate the situation, assigning resources to execute the plan, develop a command structure to manage the plan and ensuring the plan is executed safely.

After size-up, the incident commander develops an IAP based on incident priorities.

There are two major components to the IAP:


The determination of the appropriate strategy (strategic goals) to mitigate an incident.
Strategic Goals – prioritize strategic goals must be formulated prior to the development of tactical assignments. Strategic goals are broad-based objectives that commonly answer the question ”what needs to be done?” Rescue is an example of a strategic goal. The common acronym for determining a strategic goal is RECEOVS.


The development of tactics (tactical objectives) to execute the strategy.
Tactical Objectives – tactics are more specific than strategies but are based on strategic goals. Tactics commonly answer the question “How are we going to accomplish this goal?” For example, “a right-hand primary search” could be a tactic that would be chosen to support the strategic goal of rescue.

Incident Priorities

Life Safety

The life safety priority refers to all people who are at risk, this includes the general public and all responders. Life safety is firefighters’ highest priority. That said, there are a number of ways to protect life at a building fire and these Incident Priorities are not necessarily in order. An example is a first arriving engine company who is presented with a trapped occupant due to a fire. It may be beneficial to control the fire, initially, and create a safer atmosphere for occupants while waiting for more fire apparatus and resources.

Incident Stabilization

The incident stabilization priority is directed toward keeping the incident from getting any worse. If one structure is fully involved, protecting exposures is part of incident stabilization. In such a case, the burning structure cannot be saved, but firefighters can ensure that the fire will not spread beyond the initial building. At a fire incident, it is important to remember that the fire department was called for a fire. For example, in a room and contents fire that is self-venting from an exterior window is crucial to apply water early to stabilize the incident and prevent it from worsening. In doing so responders accomplish life safety, incident stabilization and property conservation.

Property Conservation

Property conservation is directed toward preventing any additional damage from occurring. Such measures could include minimizing water damage by covering building contents with salvage covers or to remove contents from harm’s way. Although property conservation is an important incident priority, many contents are now easily replaceable. As consumer goods have evolved to be more “throwaway” it is important to balance property conservation with firefighter safety and other incident priorities such as environmental protection.

Environmental Protection

Environmental protection has become increasingly important in the past years. Fire service organizations are being held to a higher standard in terms of protecting the environment. This is due to increased awareness and more strict environmental regulations. An example for the fire service may be to let a fire burn, given there are no immediate life-safety concerns, as a way to protect the environment from toxic runoff at a hazardous materials fire.

Tactical Priorities

When the first company officer arrives on scene there are a number of things that need to be accomplished. Identifying an incident’s tactical priorities will assist the officer in prioritizing the things needing to be done and in what order. The acronym RECEOVS+RIT can be applied to help provide guidance. The acronym stands for: Rescue, Exposures, Confinement, Extinguishment, Overhaul, Ventilation, Salvage and RIT or Rapid Intervention Team. The priorities are interchangeable based on the event and can be altered to ensure the highest hazards are dealt with first, and others when resources are available to do so.

For example, Rescue can be an operation that happens simultaneously with confinement. Further, if the occupants are not in immediate danger it may be safer to confine and extinguish prior to removing the occupant from the building.



Rescue is one of the highest incident priorities. Rescue involves, searching for and removing occupants them from the hazardous area. Search can depend on the availability of resources, the size and complexity of the building and the condition of occupants. The possibility of occupants varies based on

  • Occupancy
  • Season
  • Day of the week
  • Time of day
  • Hours of operation


Exposures are adjoining spaces, neighbouring buildings or property that has the likelihood of being negatively affected by the fire. The risk to exposures can also be limited by accomplishing other tactical priorities prior to.


Confinement is done to control the spread of a fire and limit the involved areas.

This can be accomplished by:

  • Pencilling the fire. Applying water from the exterior through openings into the fire compartment.
  • Positive Pressure Pressurization (PPP). Pressurizing a “box” in order to inhibit the spread of fire from an adjoining “box”. The theory is that fire will generally travel from a high-pressure area to an area of lower pressure.
  • Positive Pressure Attack (PPA) . Using positive pressure to direct fire flows from an opening to an exit/exhaust close to the fire compartment, creating a unidirectional flow.
  • Closing doors and Windows. Limiting the fresh air the fire will limit the amount of energy the fire is able to create. By reducing energy production, temperatures are reduced and fire spread is slowed.


Extinguishment is the mitigation of the hazard. It is the ceasing of energy production from the fire. NIST and UL research highlight the dramatic impact of initial water. As little as 30-60 seconds of water directed into a compartment will provide benefits like a dramatic reduction in energy production, and improved interior conditions benefiting both occupant and suppression firefighters.


Overhaul is seeking to ensure the fire is completely out. All six sides for the involved areas have been investigated to ensure there has not been any further extension. The six sides include the four walls, the floor, the ceiling and the last are any concealed or void spaces. During this process, ventilation can be used to increase visibility as well as using a thermal imager to detect any sources of energy production that may not be visible to the eye.


Ventilation as a tactic, when performed by firefighters, should be accomplished with clear communications and agreed-upon expectations and outcomes. Tactical ventilation is altering the natural flow paths of the fire event and changing them to enhance the abilities of firefighters to stabilize the incident. Methods performed in the confinement portion can also be applied in this area. Consideration should also be paid to environmental and hydraulic effects on ventilation:

Environmental: take into account wind direction and its effect on the direction of flow at openings. Crews should avoid working downwind of a fire. High winds can dramatically change the flow of openings and drastically change the flows through the interior of the structure.

Hydraulic ventilation can also be used to remove products of combustion and improve visibility.

Positive Pressure Ventilation (PPV): the use of a positive pressure by way of a high-velocity mechanical fan to push products of combustion out of the fire compartment improving visibility.


Salvage is the protection and removal of property to reduce the extent to which the fire event has affected them. This may include using salvage covers, hiding electronics under mattresses, or removing medications from the building.

Student Generated Content

Ryan Turner


Icon for the Creative Commons Attribution 4.0 International License

Emergency Scene Management I - FIRE-1114 by Justice Institute of British Columbia is licensed under a Creative Commons Attribution 4.0 International License, except where otherwise noted.

Share This Book