example incident management plan
TRANSCRIPT
EXAMPLE
INCIDENT MANAGEMENT PLAN
November 16, 2006
CHANGE LOG
Date Person Responsible Change Description Section(s)
November 16, 2006
TABLE OF CONTENTS
1 PURPOSE.............................................................................................................................5
2 OBJECTIVES........................................................................................................................5
3 OVERVIEW COMPANY NAME CRISIS MANAGEMENT TEAM..........................................53.1 COMPANY NAME CRISIS MANAGEMENT TEAM..............................................................................5
3.2 CRITERIA FOR INCIDENT LEVELS.......................................................................................................6
4 OVERVIEW OF COMPANY NAME INCIDENT MANAGEMENT TEAM...............................64.1 COMPANY NAME CRISIS MANAGEMENT & INCIDENT MANAGEMENT ORGANIZATION......................11
5 COMPANY NAME INCIDENT MANAGEMENT PROCEDURES........................................125.1 EXECUTIVE SUMMARY....................................................................................................................12
5.1.1 Incident Occurs – Initiate Notification Procedure...................................................................125.1.2 Activate COMPANY NAME Emergency Operations Center (EOC)......................................125.1.3 Mobilize Incident Management Team and Crisis Management Team as Required..............125.1.4 Activate Incident Management Plan......................................................................................125.1.5 Conduct Assessment and “Disaster Declaration” to Activate Business Continuity Plans.....125.1.6 Initiate Business Continuity Procedures................................................................................125.1.7 Normalization.........................................................................................................................12
5.2 DETAILED INCIDENT MANAGEMENT PROCEDURES...........................................................................135.2.1 Incident Occurs: Initiate Evacuation & Notifications..............................................................13
5.2.1.1 Evacuation......................................................................................................................135.2.1.2 Notification Procedures..................................................................................................13
5.2.2 Activate Emergency Operations Center (EOC).....................................................................165.2.3 Mobilize Crisis Management Team/Incident Management Team to the EOC......................165.2.4 Incident Management Plan Activation...................................................................................16
5.2.4.1 Establishing Command and Control...............................................................................175.2.4.2 Maintaining Command and Control................................................................................18
5.2.5 Conduct Assessment.............................................................................................................20
5.3 “DISASTER DECLARATION” PROCESS..............................................................................................205.3.1 Initiate Business Continuity Procedures................................................................................21
5.3.1.1 Activate Continuity Teams..............................................................................................225.3.1.2 Address Relocation of Non-Recovery Personnel...........................................................23
5.4 NORMALIZATION.............................................................................................................................23
6 INITIAL RESPONSE CHECKLISTS FOR COMPANY NAME CRISIS MANAGEMENT TEAM........................................................................................................................................23
7 INCIDENT MANAGEMENT TEAM CHECKLISTS...............................................................24
8 APPENDICES: ICS FORMS................................................................................................398.1 APPENDIX A – INITIAL INCIDENT BRIEFING.......................................................................................40
8.2 APPENDIX B – SITUATION STATUS REPORT....................................................................................41
8.3 APPENDIX C – INCIDENT FACTS......................................................................................................42
8.4 APPENDIX D - OBJECTIVES.............................................................................................................43
8.5 APPENDIX E – OPERATIONAL PERIOD/SCHEDULE OF MEETINGS......................................................44
8.6 APPENDIX F – REQUESTS FOR ASSISTANCE/ACTION ITEMS.............................................................45
November 16, 2006
8.7 APPENDIX G – ASSESSMENT MEETING AGENDA.............................................................................46
8.8 APPENDIX H – COMPANY NAME CRISIS MANAGEMENT TEAM......................................................47
8.9 APPENDIX I – COMPANY NAME INCIDENT MANAGEMENT TEAM....................................................48
9 GLOSSARY OF ICS ACRONYMS......................................................................................49
November 16, 2006
1 PURPOSEThe COMPANY NAME Incident Management Plan establishes the organization, actions and procedures necessary to respond to incidents at the following company locations:
LOCATION
LOCATION
LOCATION
The plan addresses four key elements that directly impact the organization and management of incident response operations: During the initial hours of a response, the plan explains what should be done to get organized and
establish command and control over incident response operations. This period of time corresponds to when the Incident Management Team (IMT) is in a reactive mode of operations.
Once command and control are established, the plan recognizes specific actions which must be taken by the Incident Management Team to maintain command and control and to sustain ongoing incident response operations.
The plan assists the COMPANY NAME teams to engage in short-term planning, which results in the preparation of Incident Action Plans.
The plan also assists the COMPANY NAME teams to engage in long-term planning, which results in the preparation of a General Plan.
2 OBJECTIVES
COMPANY NAME objectives are to: Minimize the operational and financial impacts of an incident. Provide alert, notification and response procedures for emergency responders to follow when an
incident occurs, to allow prompt decision-making and provide a safe, effective response. Identify response team responsibilities and advance preparation required to effectively resume
business operations following an incident.
COMPANY NAME will ensure the Incident Management Plan is maintained with current information by a designated individual responsible for periodic updates.
3 OVERVIEW COMPANY NAME CRISIS MANAGEMENT TEAM
3.1 COMPANY NAME CRISIS MANAGEMENT TEAM
The COMPANY NAME Crisis Management Team (CMT) will provide strategic direction and support, via electronic paging and teleconferencing, to coordinate response efforts for the event. Designated Emergency Operations Center (EOC) locations may be activated, as needed, for a Level II incident.
When activated, the Crisis Management Team determines what, if anything, must be done to support Incident Management Team response efforts, and to identify, evaluate, and proactively address the crisis implications of the incident and incident response operations to COMPANY NAME. The mission of the Crisis Management Team is to avoid crisis situations whenever possible, and to mitigate crisis situations that cannot be avoided to the maximum extent possible.
The following criteria definitions explain how to determine that the CMT needs to be involved in a response effort at the EOC.
3.2 CRITERIA FOR INCIDENT LEVELS
Incidents can usually be categorized as Level I or Level II.
November 16, 2006
Level I incidents can be handled by the COMPANY NAME Incident Management Team (IMT). Examples include:1. Incidents that will NOT require moving personnel to an alternate facility2. Incidents that affect the area/region, but do not significantly impact overall COMPANY NAME
operations3. Minor life-safety incidents where, if there are injuries involved, none require hospitalization, and
there are no deaths4. Incidents which do not involve interaction with the media or law enforcement (other than police
assistance called to the scene by local management).5. Enactment of weather related (only) state of emergency for the area
Level II incidents require support from the Crisis Management Team (CMT). Examples include:1. Incidents requiring activation of an alternate recovery facility to continue operations, which may
include the business recovery facility (BRF) and / or the Recovery Site in x location(s)2. Incidents requiring activation of Corporate Communications for any interaction with the media3. Incidents requiring activation of the Legal Department4. Regional incidents that may significantly impact overall COMPANY NAME operations5. Any enactment of non-weather related state of emergency for the area
COMPANY NAME will initiate appropriate immediate actions to secure the location and begin activation of business continuity plans, if necessary, but must simultaneously notify the Incident Commander.
4 OVERVIEW OF COMPANY NAME INCIDENT MANAGEMENT TEAM
The COMPANY NAME Incident Management Team will be activated to assume overall incident command, via electronic paging and teleconferencing, and to support tactical response operations at the EOC, if needed.
The Incident Management Team is composed of five sections: Command, Operations, Planning, Logistics and Finance. The functional responsibilities of each section are as follows:
COMMAND SECTION: Overall responsibility for direction of recovery effort, led by the Incident Commander.
OPERATIONS SECTION: Manage tactical response operations based on type of incident. Execute action plans as appropriate.
PLANNING SECTION: Organize and manage the collection, evaluation, and display of information about an incident, and the status of equipment and personnel resources assigned to tactical response operations. Document response operations. Organize and manage demobilization operations.
LOGISTICS SECTION: Organize and manage acquisition of the equipment, personnel, materials and supplies needed to carry out response operations. Provide services necessary to support response resources.
FINANCE SECTION: Organize and manage the imposition of strict financial control procedures, and the provision of accounting services.
Specific Incident Management Team tasks include: Sizing up the incident and tactical response operations. Developing Strategic Objectives and response priorities. Securing the resources necessary to support tactical response operations. Developing Incident Action Plans for the next operational period. Securing the resources necessary to implement Incident Action Plans. Preparing a General Plan that scopes emergency response operations from initial notification to the
completion of demobilization operations. Instituting and enforcing appropriate financial controls.
November 16, 2006
Continuously assessing incident potential to determine an incident’s capacity to grow into a crisis situation.
4.1 COMPANY NAME CRISIS MANAGEMENT & INCIDENT MANAGEMENT ORGANIZATION
CRISIS MANAGEMENT TEAM CEO & Chairman of Company Name President & Chief Operating Officer Senior EVP / Chief Information Officer Senior VP, Technology Solutions SVP - Corporate Executive Office EVP - COMPANY NAME CFO VP - Legal Services
INCIDENT COMMAND TEAM VP of Quality Assurance / Disaster Recovery Disaster Recovery Manager (TBD) Director – Corporate Security VP – Human Resources VP - Corporate Communications Director - IPS Legal (Millennium), Property Manager – Equity Office (Hampden), Property Manager (Meridian), Property Manager Plus senior business managers for affected areas
OPERATIONS TEAM VP – Data Center Operations Manager – Scheduling / Help Desk / Media Services Manager - Operations IT (Voice) Director – Network Engineering / Telecommunications IT (Data) Director – Network Management Director – Human Resources Supervisor – Corporate Security Director - Facilities Property Manager – Equity Office Manager – Storage Management
November 16, 2006
LOGISTICS TEAM VP – Human Resources Director – Event Planning SVP – Technology Planning & Procurement VP – Corporate Procurement VP – HR Administration Director – Corporate Real Estate Manager – Scheduling / Help Desk / Media Services
FINANCE TEAM Director – HQ / IT Finance SVP - Finance VP – HQ / IT Finance Director – Tax & Fixed Assets VP/Controller
PLANNING TEAM VP of Quality Assurance / Disaster Recovery Disaster Recovery Manager (TBD) Disaster Recovery Continuity Planner (TBD) Data Center Operations Manager – Scheduling / Help Desk / Media Services Manager - Operations VP – Human Resources Director – Corporate Security Director - Facilities Property Manager – Equity Office Director – Corporate Real Estate
The structure of the COMPANY NAME response organization and reporting relationships is illustrated on the following page:
First DataDR/BCP Project
November 16, 2006
4.1 COMPANY NAME CRISIS MANAGEMENT & INCIDENT MANAGEMENT ORGANIZATION
1.1.7 OPERA 1.1.6 LO1.1.5 SECTION
1.1.4 PLA1.1.3 SECTION 1.1.2
1.1.1 FIN
November 16, 2006
5 COMPANY NAME INCIDENT MANAGEMENT PROCEDURES
5.1 EXECUTIVE SUMMARY
5.1.1 INCIDENT OCCURS – INITIATE NOTIFICATION PROCEDURE
Evacuation of COMPANY NAME building, if necessary Notification of COMPANY NAME senior management Incident Commander Notification of Crisis Management Team as required for Level II
5.1.2 ACTIVATE COMPANY NAME EMERGENCY OPERATIONS CENTER (EOC)
5.1.3 MOBILIZE INCIDENT MANAGEMENT TEAM AND CRISIS MANAGEMENT TEAM AS REQUIRED
5.1.4 ACTIVATE INCIDENT MANAGEMENT PLAN
5.1.5 CONDUCT ASSESSMENT AND “DISASTER DECLARATION” TO ACTIVATE BUSINESS CONTINUITY PLANS
Conduct Damage Assessment Determine if Disaster Declaration is necessary to activate business continuity plans If so, the Information Officer Alerts Business Recovery Team Leads
If the decision to activate the business continuity plan is necessary, the IMT is responsible for the following:
5.1.6 INITIATE BUSINESS CONTINUITY PROCEDURES
Business Unit Team Leader Notifications Business Unit Recovery Teams Mobilize Business Units Activate Business Continuity Plans as necessary Activate Recovery Site Activate and Mobilize to Business Recovery Facility (BRF) Notify External Contacts (Vendors/ Service Providers/ Regulatory and Local Agencies/ Insurance
Providers) Begin Salvage Operations at EOC Ensure that all Disaster Recovery files are at Recovery Site Resume operations at Recovery Site Resume Business Operations at BRF
5.1.7 NORMALIZATION
Demobilize Business Continuity Teams
Crisis Management Team and Incident Management Team Conduct De-Briefing
Demobilize Crisis Management and Incident Management Team
Implement Corporate Key Learnings and Continuous Improvement
5.2 DETAILED INCIDENT MANAGEMENT PROCEDURES
In the event of an incident at COMPANY NAME, the following procedures are to be used as a guideline for response and recovery:
April 12, 2023
5.2.1 INCIDENT OCCURS: INITIATE EVACUATION & NOTIFICATIONS
5.2.1.1 Evacuation
In the event of an incident affecting one of the City Campus buildings, rendering it unsafe to personnel, Security will initiate emergency evacuation procedures and function as On-Scene Commander until able to notify an Incident Commander of an incident impacting that building.
Take appropriate steps to ensure your safety and the safety of those around you.
In the event of an emergency situation, emergency response guidelines are contained in Life Safety Manuals, which are specific to the Millennium, Meridian and the Hampden facilities. If necessary, follow Evacuation Procedures for the specific building.
5.2.1.2 Notification Procedures
NOTE: For an emergency at the Millennium facility when the emergency alarms sound:
1. Security alerts the on-call engineer, who investigates immediately
2. Data Center supervisor calls the Security desk via the emergency phone line and monitors the status of the emergency
3. If the emergency requires that the Data Center be evacuated, then a special Data Center emergency team take their PC laptops and relocate to the Meridian I facility immediately. This Data Center team will occupy the x Training Room, location, and will set up a temporary Data Center Command Center to resume production scheduling and job control and await further instructions from the Incident Management Team.
Once the appropriate Incident Commander is notified by Security, initial response includes: The Incident Commander notifies other members of the Incident Management Team and instructs
them to proceed to the Emergency Operations Center or to participate in the Incident Management conference call, as directed .
Operations personnel who comprise the Damage Assessment and Facilities Team will proceed to the affected area to conduct a damage assessment.
The Incident Commander will notify the Crisis Management Team if the impact to COMPANY NAME qualifies as a Level II incident.
The Incident Commander will: Ensure that the Facilities Team has made contact with the appropriate civil authorities (fire, police, etc.) who are not already notified in order to alert them of the potential incident at the COMPANY NAME location. Ensure that a full evacuation has taken place, an Emergency Response (ER) designee has conducted a headcount, and that the care of any injured employee is handled as the highest priority.
The Incident Management Team will notify other required team members and place them on alert to stand-by.
The Information Officer will notify COMPANY NAME management to alert them to a possible “Disaster Declaration”. Recovery teams will be instructed to activate their Business Continuity Plans, if necessary.
Remember, in the Disaster Alert phase, people are only to be placed at readiness in order to execute the Business Continuity Plan.
April 12, 2023
COMPANY NAME Notification Procedure
April 12, 2023
After everyone has been contacted, the acting Incident Commander will discuss the issue with the Crisis Team. After which, a decision will be made to appoint a Crisis Manager to lead and manage the crisis. This should be the Crisis Management Team member that has responsibilities most affected by the crisis.
5.2.2 ACTIVATE EMERGENCY OPERATIONS CENTER (EOC)
An Emergency Operations Center (EOC) will be established during the activation of the Incident Management Plan. The Incident Management Team will report to the designated location if the situation qualifies as a Level II incident, or if a Level I incident requires the IMT to muster. The Crisis Management Team will remain in contact with all team members via the conference call set up for that purpose but may also report to the designated location if the situation qualifies as a Level II incident and warrants on site support.
COMPANY NAME Facility Accessible
If access is available at the COMPANY NAME facilities, Emergency Operations Centers will be established in the following locations: Location address, floor, room number, phone number Location address, floor, room number, phone number Location address, floor, room number, phone number
COMPANY NAME Facility Not Accessible
If access is unavailable to the COMPANY NAME facility, the Emergency Operations Center (EOC) will be established at the direction of the Incident/Crisis Management Team and may include a local hotel. A conference room with multiple phone lines and room accommodations will be established.
5.2.3 MOBILIZE CRISIS MANAGEMENT TEAM/INCIDENT MANAGEMENT TEAM TO THE EOC
The Damage Assessment Team will proceed to the affected area and assess the extent of the damage caused by the incident. After examining the damage to the affected location, the team will proceed to the designated Emergency Operations Center (EOC) to review and finalize their damage assessment report and evaluation of the operation's capability to continue critical business functions from the headquarters building.
The Facilities Team will continue coordination with local authorities in securing the building and controlling access to the immediate area.
If the situation is not serious enough to “declare a disaster”, then the Information Officer or designee will contact staff to notify them to stand down from the alert. During the next business day, a de-briefing will be held to review the situation and incorporate any recommendations, observations and lessons learned for continuous improvement.
5.2.4 INCIDENT MANAGEMENT PLAN ACTIVATION
The incident management plan will be activated in the event of any incident affecting the COMPANY NAME Millennium building for the purpose of establishing Command and Control.
5.2.4.1 Establishing Command and Control
Getting Organized
As Incident Management Team personnel assemble, their primary focus should be getting organized and gaining an understanding of the nature and status of, and addressing the needs of, response operations.
The Emergency Operations Center should be set up to facilitate communications, provide a status board, and create specific working spaces for Command, Operations, Planning, Logistics, and Finance.
April 12, 2023
In the process: Organization charts should be developed and forwarded to the Documentation Unit. A clear chain-of-command should be determined. Everyone should be made aware of the Command and General Staff structure. Gaps in the organization should be identified and addressed.
Colored vests or nameplates at the conference table can be used to help distinguish one team position from another.
To establish focus on the incident and tactical response operations, an initial briefing meeting should be conducted. The meeting should be chaired by the Incident Commander (IC) and should cover the following topics: Status of people impacted by and responding to the incident. Background information on the incident (i.e., what happened, when, and where). The strategy and tactics being implemented by tactical response personnel, and tasks underway. Incident potential (as known). Progress being made and problems being encountered. Assistance required.
Ideally, the information cited above should be provided by an individual who is reporting in from the incident scene. The individual should use an Initial Incident Briefing document [see Appendix A] to help organize the report. Based on the information provided, the Incident Commander should finish the meeting by reviewing Strategic Objectives and the initial actions that should be taken by Incident Management Team members to build upon ongoing tactical response operations. The Situation Status Report (see Appendix B) should be used for all subsequent status reporting.
Status Board
As information is gathered on the incident and tactical response operations, it should be displayed in a prominent location for use by Incident Management Team members in their efforts to establish command and control over emergency response operations. The place where the information is displayed is identified as the “Status Board”.
A Status Board should be viewed as the one place where anyone can go, at any time, to learn about the nature and status of an incident and emergency response operations. [see Appendices C through F for Status Board forms]
Incident Log
The administrative staff is responsible for recording all information gathered on the status of the incident in the online Incident Management Tool, which is part of the Strohl product. The Status Board will provide the primary immediate input of information for the permanent record. Reports can be generated, as needed,
from the Incident Management Tool.
Assessment Meetings
During the initial hours of emergency response operations, the Incident Commander and members of the Command Staff and General Staff need to meet periodically to discuss progress being made in addressing Strategic Objectives and establishing command and control over emergency response operations. Any meetings should be highly focused and short in duration. These meetings are termed “Assessment Meetings.” [see Appendix G as a recommended agenda for Assessment Meetings].
While the organization is in a reactive mode and working to establish command and control, the objectives of Assessment Meetings should be to: Keep Incident Management Team members focused on the problem. Keep Incident Management Team members informed about the nature and status of tactical
response operations. Keep Incident Management Team members focused on Strategic Objectives.
April 12, 2023
Identify problems that are impeding acceptable progress. Move operations forward as rapidly as possible.
These meetings should be held no more frequently than every hour and no less frequently than every four hours, and last no more than 15 to 30 minutes. Attendance at these meetings must include the Incident Commander and members of the Command Staff.
5.2.4.2 Maintaining Command and Control
Mechanisms for Maintaining Command and Control
Regardless of the duration of emergency response operations, once command and control are established, it must be maintained through the end of the operations. Maintaining command and control can be viewed as synonymous with continuing support for ongoing tactical response operations. Support for ongoing operations, in turn, should be viewed as the number-one priority for the Incident Management Team. The Incident Management Team does this by: Continuing to receive periodic status reports from the affected location Updating the Status Board Entering incident status in the Incident Management Tool (part of the Strohl Tool) Continuing to hold periodic Assessment Meetings Establishing an Incident Action Plan for each operational period
Incident Action Plan
An Incident Action Plan promotes objective-driven response, or a structured pattern of thought for personnel managing response operations. It stresses the importance of establishing and addressing objectives in the formulation and execution of plans of action.
The Incident Management Team should engage in a continuous assessment or “size-up” process designed to: (1) determine what must be done, if anything, to stabilize the incident, and to protect people, property, and the environment; and (2) evaluate the effectiveness of ongoing tactical response operations. The process should result in the formulation of an overall strategy that defines what tactical responders will be asked to achieve, and tactics that define how the strategy will be implemented.
An Incident Action Plan is generally prepared for a prospective period of time referred to as the next operational period (NOP), and should contain the following: Objectives for the next operational period An organizational assignment list for the next operational period Communications plan for the next operational period Appropriate supporting documentation
The actual contents of an Incident Action Plan vary depending upon the nature and demands of response operations. When two or more response organizations are responding to an incident, it is important that the organizations work together (i.e., through Unified Command if you are responding in conjunction with a government agency, and the integration of response personnel) to formulate one consolidated Incident Action Plan that fully addresses mutually agreed-upon objectives.
General Plan Development
Incidents that require emergency response operations for more than a few days tend to be complex, resource-intensive, and costly in nature. A lengthy response effort is viewed as a project requiring the preparation of a project plan referred to as the General Plan. Like an Incident Action Plan, a General Plan should be prepared to address objectives approved by (unified) command. These objectives are often expressed as milestones [i.e., (a) time frames for the completion of all and/or (a) portions of incident response operations]. A General Plan should identify the major tasks that are being, or will need to be, carried out through to the end of emergency response operations, the duration of the tasks, and the major equipment and personnel resources needed to accomplish the tasks within the specified durations.
April 12, 2023
5.2.5 CONDUCT ASSESSMENT
When the incident is under control, the Damage Assessment Team (DAT) will examine the facility or locations where the incident occurred.
The Damage Assessment Team provides a Damage Assessment Report to the Incident Commander. If the impact of the incident qualifies as a Level II, the Incident Commander will brief the Crisis Manager and Crisis Management Team on the status and accessibility of structure.
The Crisis Management Team and Incident Management Team will review the findings of the initial damage assessment report to determine whether or not to “declare a disaster” and to activate business continuity plans. The decision should be based on input from:
Initial damage assessment report and estimated time to recover as determined by the DAT. Local authorities recommendations (Police, Fire, Civil Emergency Staff, Etc.) Equipment vendor(s) assessment(s) Recovery time considerations
The damage will be categorized based on the following scale:
Time to repair and get operational
Major > 48 hours < 6 weeks
Severe > 24 hours < 48 hours
Significant > 12 hours < 24 hours
Moderate < 12 hours
Note 1: See individual Business Continuity Plans for units that need to resume functions within 24 hours.
5.3 “DISASTER DECLARATION” PROCESS
A “disaster declaration” is the term used when the nature of an incident requires that business operations be moved to an alternate facility.
Once the official Damage Assessment Report is reviewed, a critical determination will be made. If the Crisis Management Team decides the incident requires moving business operations to an alternate facility, then an official “Disaster Declaration” is made to activate an alternate facility and the Business Continuity Plans.
If a “Disaster Declaration” is made and the Business Continuity Plan is activated, then: The Information Officer will notify COMPANY NAME management of the Business Continuity Plan
activation and instruct them to activate their departmental plans. Operations will activate/notify alternate facilities.
The person responsible for coordinating MIS will contact their staff and activate their recovery operations. This may involve contacting vendors during non-business hours.
The Facilities Team will activate recovery and salvage operations for the affected building(s). Corporate Communications will brief all members of the CMT and IMT on COMPANY NAME
communication with the media. Additionally, Corporate Communications will provide all communication guidelines on interfacing with external organizations during the recovery operations.
NOTE: All staff must be instructed to carry their Employee Identification with them to gain access to the Alternate Facility(s).
April 12, 2023
AUTHORIZATION FOR “DISASTER DECLARATION” TO ACTIVATE BUSINESS CONTINUITY PLANS
The following individuals are authorized to “declare a disaster”:
NAME POSITION OFFICE CONTACT EMERGENCY
CONTACT
President/COO (see contact list)
CIO (see contact list)
VP – Technology
Solutions
(see contact list)
5.3.1 INITIATE BUSINESS CONTINUITY PROCEDURES
The Incident Management Team is responsible for managing the tactical efforts to support business continuity and will brief the Crisis Management Team at regular intervals on the status of the continuity effort.
The following procedures provide a guideline for conducting response and recovery operations:
Procedures for the Incident Commander are: Upon learning of the incident:
Notify the Crisis Management Team if the incident qualifies as a Level II Notify the Incident Management Team if the incident is a Level I or Level II requiring further assistance
For a business continuity incident, Operations (Facilities and Security) and Logistics (MIS) representatives will be instructed to meet at or in front of the Emergency Operations Center and assist in the damage assessment. Discuss the situation with the Incident Management Team to determine the impact of the incident. Review the assessment and provide input to the “Disaster Declaration” decision. Initiate and coordinate incident management and business continuity operations.
Procedures for Command Staff are: The Information Officer will notify appropriate management of the “Disaster Declaration” decision. The Information Officer will brief all members arriving at Emergency Operations Center (EOC) on
status of situation. Also, a Status Board should be established at the Emergency Operations Center by either the Information Officer or Planning.
The Incident Management Tool log must be kept updated.
Procedures for the Facilities Team are: Upon learning of the incident, immediately notify Facilities staff with instructions to conduct initial
notifications and proceed to Emergency Operations Center (EOC) and stand-by pending the outcome of the initial damage assessment.
Receive briefing from On-Scene Commander as to extent of damage/risk to affected facility. Review the assessment and provide input to the “Disaster Declaration” decision. Initiate and assist in Business Continuity operations for the COMPANY NAME facility. Place staff at affected area and coordinate the security of the building to prevent unauthorized
entry. If “Disaster Declaration” is made, coordinate activities of the local authorities regarding security. Begin notification of insurance provider (Finance) and selected vendors (Logistics) to prepare
alternate facility with equipment and services necessary to support the business operations as specified in this manual.
April 12, 2023
Procedures for Logistics are: Upon learning of the incident immediately notify the individual responsible for coordinating MIS, with
instructions to conduct initial notifications and stand by pending the outcome of the initial Damage Assessment Report.
Proceed to affected location and meet with the members of the Incident Management Team to observe the impact of the incident on the facility.
Review condition of all technology equipment and report the status and recommendation for restoration to the Incident Commander, who will notify the Crisis Management Team.
Review the assessment and provide input to the “Disaster Declaration” decision. Initiate and assist in business continuity operations for MIS. Begin notification of selected vendors to acquire the MIS equipment and services necessary to
support the business operations. Provide logistics support for set up of Emergency Operations Center (EOC). Once plan is activated, provide ongoing support to business continuity operations.
Procedures for the Corporate Communications/Legal are: Upon notification, be prepared to handle communications regarding the incident and instruct other
members of organization in their responses. Review the assessment and provide input to the “Disaster Declaration” decision. Implement Corporate Communications Guidelines and official procedures to ensure that proper
communication of the situation to all outside organizations and news media is followed.
Procedures for Employee Relations are: Provide support to recovery operations by monitoring personnel policies and guidelines. Review the assessment and provide input to the Disaster Declaration decision. Attend briefing of all members arriving at Emergency Operations Center (EOC) on status of
situation. Implement ER Guidelines and official procedures to ensure the well-being and safety of employees.
Procedures for the Crisis Management Team are: Review the assessment and make the “Disaster Declaration” decision. Attend on-going briefings with the IMT on status of response operations.
5.3.1.1 Activate Continuity Teams
Following notification, the Business Unit Leaders will Notify and mobilize Business Continuity Team personnel.
Make a note of the team personnel who you were unable to contact, inform the Incident Commander, and turn the list over to the Logistics in the Emergency Operations Center (EOC) for long term follow up.
NOTE: If critical support resources are unavailable, notify the Incident Commander immediately. Provide Continuity Team personnel with an initial briefing on the nature and status of the incident
and response operations. Provide activated Continuity Team personnel with initial instructions. Indicate a time for Continuity Team personnel to assemble in the Emergency Operations Center
(EOC) for an Initial Incident Briefing.
5.3.1.2 Address Relocation of Non-Recovery Personnel
Notify all staff and explain the current situation. As they are contacted, each individual should be given specific calling instructions for further information.
Send non-recovery personnel home until further notice. Advise all staff not to speak to personnel of the press concerning the incident event (in keeping with
the corporate communication policy). Instruct staff to remain on stand-by in the event that their help will be required.
April 12, 2023
NOTE: Initially, only Continuity Team personnel are considered essential to support Business Unit Continuity Plans. However, all staff could be called upon to provide support at any time.
5.4 NORMALIZATION
Once COMPANY NAME has completed response to an incident and instituted all recovery procedures to return to normal business operations, the following normalization procedures should be initiated by the Incident Commander: Demobilize Business Continuity Teams Crisis Management Team and Incident Management Team Conduct De-Brief Demobilize Crisis Management and Incident Management Team Implement Corporate Key Learnings and Continuous Improvement
6 INITIAL RESPONSE CHECKLISTS FOR COMPANY NAME CRISIS MANAGEMENT TEAM
COMPANY NAME Crisis Management Team provides Strategic Direction for Level II incidents affecting the COMPANY NAME Headquarters Building
The following checklist is a guideline for managing the incident and identifies responsibilities of each position:
CRISIS MANAGEMENT TEAMPosition Roles and Responsibilities
Crisis Manager Obtain information on the nature and status of the incident and provide direction
Obtain information on the nature and status of tactical response operations.
Crisis Management Team
Management staff that assists the Crisis Manager in making strategic determinations to direct and assist Incident Management Team tactical response efforts.
Direct Incident Management Team (IMT) efforts to analyze the implication of the incident and incident response operation on the COMPANY NAME Corporation’s viability, operability, and credibility.
Keep the Incident Management Team focused on the issues and concerns that must be addressed to avoid and/or mitigate crisis situations.
7 INCIDENT MANAGEMENT TEAM CHECKLISTS
The following checklists are to be utilized by Incident Management Team Members to ensure they have addressed all tactical response areas.
INCIDENT COMMANDER
ACTIVITY/DESCRIPTION CHECKLIST/COMMENTS
April 12, 2023
Receive briefing from the On-Scene responder
Obtain information on the nature and status of the incident.
Obtain information on the nature and status of tactical response operations.
Define the mechanisms that will be used to establish and maintain a clear line of communications between the Emergency Crisis Management Team and the IMT.
Activate appropriate Incident Management Team personnel
Determine what Incident Management Team Command Staff functions need to be activated to address the incident and provide the assistance requested by the COMPANY NAME location.
Determine if activation of the Emergency Operations Center (EOC) is necessary, if so, indicate a time for Incident Management Team personnel to assemble in the EOC for the Initial Incident Briefing.
Mobilize appropriate Incident Management Team Command Staff personnel.
Provide mobilized Incident Management Team Command Staff personnel with an initial briefing on the nature and status of the incident and tactical response operations.
Provide activated Incident Management Team Command Staff personnel with initial instructions.
Ensure that appropriate actions are being taken to protect the health and safety of response personnel
Work with appropriate authorities and Facilities Team to determine that the following activities are taking place:
Appropriate site characterizations are being conducted, and chemical and physical hazards have been/are being identified.
Appropriate hazard control zones are being identified and secured.
Empower Security to exercise emergency authority to prevent or stop unsafe acts.
Ensure that accidents and near misses are investigated and that appropriate Safety Bulletins are issued to prevent their recurrence.
Ensure that required notifications are made in a timely fashion
Check on status of contacts with appropriate federal, state, and local government officials.
Establish contact with COMPANY NAME Crisis Management Team
Ensure that Planning forwards the Initial Incident Briefing Document to the Crisis Management Team within two hours of an incident.
Establish a direct line of communications with the Crisis Manager.
Determine Crisis Management Team information needs and establish a schedule for the provision of Situation Status Summary Reports to the Crisis Management Team.
If necessary, designate a liaison person to maintain contact with the Crisis Management Team.
Receive and respond to information requests and directives from the Crisis Management Team, and ensure that appropriate Incident Management Team members address those directives.
April 12, 2023
Conduct/attend Incident Management Team meetings
Develop a schedule for meetings and ensure that the schedule is posted in the Information Center.
Ensure that meeting agendas are known and followed by meeting attendees.
Assign work to be performed on Action Items identified during meetings.
Ensure that all meetings are documented. Review and approve Incident Action Plans (Incident Action Plans)
Coordinate the preparation of Incident Action Plan Ensure that Incident Action Plans contain all
appropriate support information.
Review and approve General Plan Coordinate the preparation of the General Plan with the other members of the Unified Command.
Authorize the establishment of a General Plan Development Team.
Establish objectives and milestones to be addressed by the General Plan.
Ensure that the General Plan addresses the objectives and milestones.
Ensure that the approved General Plan is updated on a daily basis, is implemented through the Incident Action Plans, and is consistent with the Plan's contents.
Ensure that appropriate financial controls are instituted and followed by Incident Management Team personnel
Authorize the activation, deactivation, and demobilization of all response resources (i.e., either directly or through the approval of Incident Action Plans).
Ensure that equipment and personnel check-in/check-out procedures are in place and being followed.
Ensure that Planning and Finance are tracking resource status.
Ensure that all expenditures are substantiated and supported by necessary documentation.
Ensure that appropriate contracts are in place for all contracted response resources.
The COMPANY NAME Incident Command Team may also be activated to assist the ECMT in responding to a COMPANY NAME incident. The following checklist is a guideline for managing the incident and identifies responsibilities of each position:
COMMAND STAFF Incident Commander Provide direction to the COMPANY NAME location requesting
assistance Keep ECMT informed of status of incident and implement ECMT
strategic direction Provide direction to IMT staff responding to the COMPANY
NAME incident
April 12, 2023
Information Officer Receive situation status from Operations and disseminate to the Incident Commander and Command Staff.
Set-up Status Board in the Emergency Operations Center. Document all Emergency Operations Center activities. Use log/directory to track current contact information for key
personnel. Coordinate information flow from authorities. Notify appropriate COMPANY NAME management of potential
business continuity impacts and place them on alert for possible disaster declaration.
ER Advisor Provides information to employee emergency contacts. Maintains emergency contact list. Develop and update COMPANY NAME employee hotline
messages, if appropriate. Deploys required ER Support Teams. Brief and communicate approved information and instructions to
ER Support Teams. Corporate Communications Advisor
Serves as sole spokesperson to the media. Notifies and interfaces with government agencies. Addresses reputational issues with media, community and
stakeholders. Environmental Affairs Coordinate cleanup assessment operations with the EPA, DEC,
other federal and state trustee agencies, and, where appropriate, affected property owners.
Identify most effective, environmentally sound cleanup strategies and tactics.
Prepare recommendations for review and approval by Command, and implementation by Operations.
Monitor cleanup operations for consistency with recommendations.
Legal Advisor Responsible for ascertaining any legal ramifications of the incident.
Provides consultation and direction on all potential and actual legal issues.
April 12, 2023
IN THE EVENT OF AN INCIDENT REQUIRING BUSINESS CONTINUITY PROCEDURES, THE OPERATIONS FUNCTION INCORPORATES THE ACTIVITIES OF THE:
DAMAGE ASSESSMENT TEAM FACILITIES TEAM
AND IS RESPONSIBLE FOR THE FOLLOWING:
OPERATIONS TEAM ACTIVITIES
ACTIVITY/DESCRIPTION CHECKLIST/COMMENTS
Receive Briefing from the Incident Commander
Obtain information on the nature and status of the incident.
Obtain information on the nature and status of tactical response operations.
Obtain a summary of resources dispatched to incident scene.
Obtain initial instructions for personnel. Activate Appropriate Operations Personnel
Notify Damage Assessment Team and Facilities Team.
Provide Operations personnel with background information on the nature and status of the incident and tactical response operations.
Provide Operations personnel with initial instructions and assignments.
FACILITIES TEAMEnsure the Health and Safety of all Operations -Personnel
Receive a briefing on the results of site characterizations.
Know the chemical and physical hazards associated with the incident and response operations, or know the appropriate government agency contact for information.
Know the appropriate level of personal protective equipment to be worn by response personnel.
Ensure that secure perimeters have been established around hazard control zones.
Institute check-in/check-out procedures to ensure that only properly trained and equipped personnel have access to hazard control zones.
Coordinate with Damage Assessment Team to determine impact to facility.
Initiate Site Restoration Procedures based on formal Damage Assessment Report.
Ensure that tactical response personnel are properly briefed before they initiate response operations.
DAMAGE ASSESSMENT TEAMOrganize and Support Damage Assessment Operations
Assess the situation and determine that all appropriate tactical response actions are being done to protect people, property, and the environment.
Assist in the establishment of strategic objectives. Assist in obtaining the personnel and equipment
necessary to carry out tasks. Coordinate with local authorities and utilities to
determine damage to, and accessibility of, the affected facility or site.
April 12, 2023
Monitor Tactical Response Operations
Provide regular situation status reports on: Resource utilization, status and organization. Progress being made. Problems being encountered. Support required. Ensure that requests for support are forwarded to
appropriate Incident Management Team members, and that requested support is provided in a timely fashion.
Monitor Tactical Response Operations (CONT’D)
If necessary, work with the On-Scene Commander to make adjustments to improve the safety, effectiveness, or efficiency of tactical response operations.
Provide Incident Commander with report on activities, events and actions.
Identify resources not needed for operations so they can be demobilized.
Provide Planning with Information for the Status Board
Assist in the preparation and maintenance of a Situation Map that depicts the location of:
The source of the incident. Any potentially hazardous materials. Team efforts.
Assist in the preparation and maintenance of status boards that are descriptive of tactical response operations.
Assist in the maintenance of a system to track the status of any response equipment.
Assist in the preparation and Implementation of Incident Action Plans
Assist the Incident Commander in the identification of Strategic Objectives and response priorities for the NEXT OPERATIONAL PERIOD.
Provide Planning with Operations organizational assignments for NEXT OPERATIONAL PERIOD.
Assist Logistics in the preparation of Communications, and Operations Plans for NEXT OPERATIONAL PERIOD, as appropriate.
Brief personnel and other Incident Management Team members on NEXT OPERATIONAL PERIOD.
Assist in the Preparation and implementation of the General Plan
Assign a representative of Operations to assist in the preparation of the General Plan.
Provide the small team working on the General Plan with information and answer the team's questions on ongoing and planned tactical response operations.
Attend IMS meetings held to review and approve the General Plan.
Brief personnel on the contents of the General Plan. Assist Planning in the preparation for General Plan
updates.
April 12, 2023
PLANNING
ACTIVITY/DESCRIPTION CHECKLIST/COMMENTS
Receive Briefing from the Incident Commander
Obtain information on the nature and status of the incident.
Obtain information on the nature and status of tactical response operations.
Obtain a summary of resources checked in at the incident scene.
Obtain initial instructions for personnel. Activate Appropriate Planning Personnel
Notify team members. Provide Planning personnel with background
information on the nature and status of the incident and tactical response operations.
Provide Planning personnel with initial instructions. The Situation Unit will Prepare Documents Descriptive of Incident and Response Operations
Initial Incident Briefing Document. Situation Status Summary Report.
Work with the Information Officer to Establish Status Board
Establish contact with the affected COMPANY NAME location.
Gather information on the nature and status of the incident and response operations.
Post status boards and Situation Maps. Fill in/maintain status boards and Situation Maps.
Establish Planning Cycle to Support Preparation of Incident Action Plan (IAP)
Define next operational period (NEXT OPERATIONAL PERIOD).
Project situation through to end of NEXT OPERATIONAL PERIOD.
Coordinate preparation of objectives and priorities for NEXT OPERATIONAL PERIOD.
Ensure that Logistics reviews assignments Coordinate preparation of necessary documentation. Assemble Incident Action Plan. Obtain Command approval of Incident Action Plan.
Prepare General Plan Scope the General Plan in terms of activities and resources to be covered by plan.
Perform a detailed incident assessment. Prepare activity time-lines and resource projections. Compile General Plan. Present General Plan to Command for review and
approval. Oversee implementation of General Plan through the
preparation of Incident Action Plans. Update General Plan on a daily basis.
Ensure that Issues and Problems are Addressed by Appropriate Incident Management Team Personnel
Receive and distribute orders issued by Incident Commander.
Follow up on the status of work on Action Items identified at IMS meetings.
Establish a procedure for the circulation of General Messages between Incident Management Team personnel.
April 12, 2023
Documentation Unit will Document Response Operations
Establish/institute Documentation Guidelines. Ensure that Incident Management Team personnel
are complying with Documentation Guidelines. Establish a secure filing system for all documentation. Ensure that all IMS meetings are documented. Obtain and file copies of all documents, including
Information Center status boards, produced during response operations.
Restrict access to documentation files to authorized personnel.
INCIDENT MANAGEMENT SYSTEM: LOGISTICS ACTIVITIESACTIVITY/DESCRIPTION CHECKLIST/COMMENTSReceive Briefing from the Incident Commander
Obtain information on the nature and status of the incident.
Obtain information on the nature and status of tactical response operations.
Obtain (initial) instructions for personnel. Activate Appropriate Logistics Personnel
Provide Logistics personnel with background information on the nature and status of the incident and tactical response operations.
Alert major service contractors and activate as necessary to support Incident Management Team needs; coordinate with Finance
Ensure that Logistics personnel have the equipment, materials, and supplies necessary to carry out their roles and responsibilities.
Provide Logistics personnel with (initial) instructions. Assign work locations and preliminary work tasks for
personnel. Hold periodic meetings. Ensure the safety of Logistics personnel.
Provide Planning with Information for the Status Board
Identify service and support requirements for ongoing planned operations.
Prepare and maintain an organization chart that depicts the current status of Logistics personnel working on response operations.
Provide information on the nature and location of incident facilities for incorporation into the Situation Map.
Provide information on the status of resources. Attend Assessment Meetings to discuss the status of
response operations depicted in the Information Center.
Address Resource Requirements Identified by Members of the Incident Management Team
Institute a resource ordering system. Receive and process Resource Orders. Ensure cost-effective operations. Arrange for the transportation of personnel and
equipment resources to appropriate destinations.
April 12, 2023
Order personnel and equipment resources not available in inventory.
Ensure that ordered personnel and equipment resources are properly received and are accompanied by appropriate documentation.
Keep appropriate Incident Management Team members appraised of the disposition of requested personnel and equipment resources.
Arrange for the transport of ordered personnel and equipment resources from their reception point to an appropriate destination point.
Forward documentation (i.e., purchase orders, receiving documents, and invoices) to Finance.
Provide and Maintain Communication Equipment
Determine and address the communications equipment needs (i.e., telephone, fax, computers, radio, etc.) of all incident facilities.
Determine and address the communications equipment needs of response personnel.
Organize communications equipment into Crisis, Command, Operations/Tactical, and Supply/Support Networks.
Institute a system for documenting the distribution of communications equipment.
Provide necessary instructions on the use of communications equipment.
Maintain communications equipment. MIS will Establish (a) Communications Center(s) at
appropriate incident facilities.Provide Services Necessary to Maintain the Operability of Response Personnel
Arrange for any necessary food, facilities or supply items.
Participate in Planning Cycle to Support Preparation of Incident Action Plans (IAPs)
Determine the duration of the next operational period (NEXT OPERATIONAL PERIOD).
Review the projection of the situation for the NEXT OPERATIONAL PERIOD prepared by Planning.
Estimate future service and support requirements for the NEXT OPERATIONAL PERIOD in conjunction with the Incident Commander, Planning and Operations.
Attend and represent Logistics concerns at meetings. Determine personnel, equipment, materials, and
supply requirements for the NEXT OPERATIONAL PERIOD.
Work with Planning to assign available resources. Arrange for the reassignment of resources, as
necessary. Order resources not in inventory and determine
whether they can be delivered within the NEXT OPERATIONAL PERIOD.
April 12, 2023
Prepare Documents for Inclusion in Incident Action Plans
Provide Planning with information on Logistics organizational assignments for the NEXT OPERATIONAL PERIOD.
Prepare/update Communications System Plan.Participate in the Preparation of the General Plan
As requested, assign a representative of Logistics to assist with preparing the General Plan.
Provide the small team preparing the General Plan with information and answer the team's questions on the availability of resources required to support ongoing and planned tactical response operations.
Attend assessment meetings held to review and approve the General Plan.
Brief Logistics personnel on the contents of the General Plan.
Use the General Plan to project and address equipment and personnel response resource requirements.
Assist Planning in the preparation of General Plan updates.
April 12, 2023
INCIDENT MANAGEMENT SYSTEM: FINANCE ACTIVITIES
ACTIVITY/DESCRIPTION CHECKLIST/COMMENTSReceive Briefing from the Incident Commander
Obtain information on the nature and status of the incident.
Obtain information on the nature and status of tactical response operations.
Obtain (initial) instructions for Finance personnel.Activate Appropriate Finance Personnel
Notify Unit Leaders. Provide Finance personnel with background
information on the nature and status of the incident and tactical response operations.
Ensure that Finance personnel have the equipment, materials, and supplies necessary for them to carry out their roles and responsibilities.
Provide Finance personnel with (initial) instructions. Hold periodic meetings. Ensure the safety of Finance personnel.
Utilize Information Posted in the Information Center to Initiate Cost Monitoring Operations
Meet with Command and General Staff personnel to obtain overall strategy.
Compile information on resources committed to tactical response operations.
Work with Logistics to determine the source of personnel, equipment, materials, and supplies.
Review contracts with/contact suppliers to confirm/negotiate terms and conditions for their resources.
Implement Applicable Financial Guidelines and Policies
Develop operating plan for Finance function of response.
Prepare and circulate a Procurement Plan. Establish (an) account code(s) for response-related
charges. Ensure that requisitions are being used to order
response resources. Obtain copies of requisitions, purchase orders,
receiving documents, and invoices. Reconcile purchase orders and invoices.
Provide Accounting Functions
Handle all bank transactions, including: deposits, withdrawals, and balancing of accounts.
Track income and expenses. Reconcile and process invoices for accounts payable. Prepare invoices for accounts receivable.
April 12, 2023
INCIDENT MANAGEMENT SYSTEM: FINANCE ACTIVITIES
ACTIVITY/DESCRIPTION CHECKLIST/COMMENTSProvide Accounting Functions (CONT’D)
Breakdown hours and rates for: Response personnel Subcontractor personnel Consultants
Develop and administer a cash account.Execute/Negotiate Contracts
Maintain a contract file. Review existing contracts to determine the terms and
conditions for contracted services, and verify that contracts initiated during the response are properly prepared.
Negotiate/re-negotiate contracts to obtain terms and conditions that are acceptable to the RP and its insurers.
Coordinate contract negotiations. Audit response operations to ensure compliance with
the terms and conditions of contracts. Compile Documentation Required under Applicable Insurance Policies
Determine the applicability of insurance policies. Review insurance policies to determine the type of
documentation that must be compiled to substantiate requests for reimbursement.
Ensure that appropriate documentation is being compiled.
Coordinate activities with or scene representatives of insurers.
Receive and Process Third Party Claims
Institute claims processing procedures. Publish a phone number for the receipt of third party
claims. Determine the need for and, if necessary, establish
claims reception centers at locations convenient to claimants.
Negotiate settlements with claimants. Coordinate claims processing operations with Legal
Officer. Keep the Incident Commander informed about the
nature and volume of claims received, and the status of negotiations with claimants.
Provide Financial Advice
Ensure that response operations are being carried out in a manner consistent with all financial requirements.
Advise the Incident Commander on all financial matters associated with response operations.
April 12, 2023
INCIDENT MANAGEMENT SYSTEM: FINANCE ACTIVITIES
ACTIVITY/DESCRIPTION CHECKLIST/COMMENTSProvide Financial Advice (CONT’D)
Participate in incident investigations and the assessment of damages.
Participate in Planning Cycle to Support Preparation of Incident Action Plans (IAPs)
Determine the duration of the next operational period (NOP).
Review the projection of the situation for the NEXT OPERATIONAL PERIOD prepared by Planning.
Provide input in all planning sessions on Finance matters.
Obtain information on personnel, equipment, materials and supply requirements for the NEXT OPERATIONAL PERIOD.
Provide cost analysis data on control operations as required.
Provide financial summary on labor, materials, and services.
Prepare Documents for Inclusion in Incident Action Plans
Provide Planning with information on Finance for incorporation of organizational assignments for the NEXT OPERATIONAL PERIOD.
Participate in the Preparation of the General Plan
Attend Incident Management Team meetings held to review and approve the General Plan.
Brief Finance personnel on the contents of the General Plan.
Use the General Plan to project long-term costs.
April 12, 2023
On-Scene Command Guidelines for affected COMPANY NAME location
ON-SCENE COMMANDERACTIVITY/DESCRIPTION CHECKLIST/COMMENTSIncident Size-Up The individual who reports the incident to local
COMPANY NAME Incident Management Team. Gather all information possible on the emergency. Incident priorities will always be life safety, incident
stabilization, and property protection. If appropriate, establish an Incident Command Post
(ICP) located near, but a safe distance from, the incident scene; ensure that the location of the Incident Command Post is communicated to all personnel.
Size up the situation and determine what tasks must be undertaken to ensure the safety of personnel, stabilize and/or control the source, and protect people and property.
Verify that a head count has been taken and that all facility/personnel have been accounted for.
Site Management and Control
Establish an isolation perimeter and deny entry. Ensure that resource check-in procedures are
established; and produce regular status reports on checked-in resources.
Initiate personnel protective actions (evacuate / shelter-in-place, as necessary).
Identify the Problem Identify, confirm and verify the nature of the problem. Determine all aspects/ elements involved. Determine the type and nature of exposures to
COMPANY NAME.Information Management and Resource Coordination
Ensure that the Incident Briefing Document is completed and transmitted to the COMPANY NAME Emergency Operations Center within two hours of the incident.
Determine whether there is a need to request specific Incident Management Team resources to support response operations.
Provide regular and timely status reports to the Incident Commander and the Incident Management Team. Updates should include:
Tactical response objectives (what are you doing). Performance (how are you doing).
Document the Emergency Response Operations
Account for all personnel before leaving the scene of an emergency.
Conduct an incident debriefing session for all emergency response personnel.
Maintain and submit all documentation, records and logs to the Documentation Unit after the incident has been terminated.
Conduct an incident critique in accordance with COMPANY NAME policies.
April 12, 2023
8 APPENDICESStatus Reporting Forms
A. Initial Incident BriefingB. Situation Status Report
Status Board FormsC. Incident FactsD. ObjectivesE. Operational Period/Schedule of MeetingsF. Requests for Assistance/Action Items
Meeting AgendasG. Assessment Meeting Agenda
Contact ListsH. COMPANY NAME Crisis Management TeamI. COMPANY NAME Incident Management Team
Glossary of Terms
April 12, 2023
8.1 APPENDIX A – INITIAL INCIDENT BRIEFING
Complete and Provide to COMPANY NAME Emergency Operations Center
INITIAL INCIDENT BRIEFINGSUMMARY OF INCIDENT AND CURRENT ACTIONS
Incident Location: Date: Time Occurred:
DESCRIPTION OF INCIDENT
What Happened: Fire Systems Power Outage Flood Corporate Communications
HAZMAT
Extent of Involvement:
SOURCE Name/Type:
INCIDENT POTENTIAL Incident currently not under control, but can be handled with available resources.
Incident Under Control Incident will require additional COMPANY NAME resources .
Incident will likely generate significant public affairs/community relations issues.
SAFETY CONSIDERATIONS Injuries: Fatalities: Unaccounted:
Chemical Hazards:
Physical Hazards:
RESPONSE OBJECTIVES
IMPACTS People Property Environment Operations Community
Sensitive Areas Impacted or Threatened: Yes No
Location of Areas:
AGENCY NOTIFICATIONS DFD DPD MOD Utilities OSHA
HELP REQUESTED Technical PR HR
Legal Environmental
Safety Medical
Other
Prepared By: Position:
April 12, 2023
8.2 APPENDIX B – SITUATION STATUS REPORT
Provide Situation Status Report to Operations
SITUATION STATUS REPORT
Situation Room Date Prepared: Report No.: Attachments:
Team Leader: Time Prepared:
STATUS OF NOTIFICATIONS
STATUS OF INCIDENT IMPACTS
ACTION ITEMS/ISSUES FOR FOLLOW-UP
CRITICAL RESOURCE NEEDS/LOGISTICS REQUESTS
OTHER COMMENTS
PREPARED BY: APPROVED BY:
MAKE COPIES PRIOR TO USING FOR SUBSEQUENT STATUS REPORTING
April 12, 2023
8.3 APPENDIX C – INCIDENT FACTS
INCIDENT FACTSSTATUS BOARD
DATE OF INCIDENT: TIME OF INCIDENT:
LOCATION: ____________________________________________________
BUSINESS LINE: ____________________________________________________
FACILITY(IES) INVOLVED:
DESCRIPTION OF INCIDENT:
LEVEL OF RISK:
STATUS OF INCIDENT: Controlled: Continuing: Other:
STATUS OF PERSONNEL: Casualties: Injuries: Other:
OTHER INFORMATION:
April 12, 2023
8.4 APPENDIX D - OBJECTIVES
OBJECTIVESSTATUS BOARD
INCIDENT:
MOST RECENT UPDATE: (DATE) (TIME)
OPERATIONAL PERIOD:
OBJECTIVES FOR CURRENT OPERATIONAL PERIOD
OBJECTIVES FOR NEXT OPERATIONAL PERIOD
April 12, 2023
8.5 APPENDIX E – OPERATIONAL PERIOD/SCHEDULE OF MEETINGS
OPERATIONAL PERIOD / SCHEDULE OF MEETINGSSTATUS BOARD
CURRENT OPERATIONAL PERIOD
STARTING DATE:
ENDING DATE:
STARTING TIME:
ENDING TIME:
MEETINGS FOR CURRENT OPERATIONAL PERIOD
TIME:
TIME:
TIME:
TIME:
TIME:
TIME:
MEETING:
MEETING:
MEETING:
MEETING:
MEETING:
MEETING:
NEXT OPERATIONAL PERIOD
STARTING DATE:
ENDING DATE:
STARTING TIME:
ENDING TIME:
MEETINGS FOR NEXT OPERATIONAL PERIOD
TIME:
TIME:
TIME:
TIME:
TIME:
MEETING:
MEETING:
MEETING:
MEETING:
MEETING:
8.6 APPENDIX F – REQUESTS FOR ASSISTANCE/ACTION ITEMS
REQUESTS FOR ASSISTANCESTATUS BOARD
April 12, 2023
DATE/TIME OF REQUEST
REQUEST RESPONSIBLE TEAM/PERSON
STATUS
April 12, 2023
8.7 APPENDIX G – ASSESSMENT MEETING AGENDA
AGENDA: ASSESSMENT MEETINGSCHAIRED BY: DATE: TIME: LOCATION:
AGENDA ITEMSAGENDA ITEMS
RESPONSIBLE PERSON(S)
Review of Action Items from previous meeting Incident Commander
Review of Strategic Objectives Incident Commander
Operations status report Status of impacts Location of damage Progress on addressing objectives Problems
Damage Assessment Team Lead
Site Restoration Team Lead
Safety status report Safety Officer/Security
Planning status report Progress on addressing objectives Problems
Situation Unit Leader
Logistics status report Progress on addressing objectives Problems
Logistics Officer
Finance status report Progress on addressing objectives Problems
Finance Officer
Media status report Corporate Communications Officer
Unified Command issues/concerns Federal On-scene Coordinator, State On-scene Coordinator, Local On-scene Coordinator
Summary of Priorities Incident Commander
Time of next meeting Incident Commander
April 12, 2023
April 12, 2023
8.8 APPENDIX I – COMPANY NAME INCIDENT MANAGEMENT TEAM
INCIDENT MANAGEMENT TEAM MANAGER PRIMARY CONTACT LIST
April 12, 2023
9 GLOSSARY OF ICS ACRONYMS
CC COMMAND CENTER
Located at COMPANY NAME major offices for each business line/location, this center will be activated and utilized by that site’s Incident Management Team.
CM CRISIS MANAGER
CMT CRISIS MANAGEMENT TEAM
COP CURRENT OPERATIONAL PERIOD
EOC EMERGENCY OPERATIONS CENTER
Located at COMPANY NAME, this center will be activated to provide strategic direction for COMPANY NAME incidents worldwide.
EMS EMERGENCY MEDICAL SERVICES
FOSC FEDERAL ON-SCENE COORDINATOR (Government Agency Representative)
HAZCOM HAZARD COMMUNICATIONS
HAZMAT HAZARDOUS MATERIALS
HAZWOPER HAZARDOUS WASTE OPERATIONS AND EMERGENCY RESPONSE (OSHA 1910.120)
IAP INCIDENT ACTION PLAN
IC INCIDENT COMMANDER
ICP INCIDENT COMMAND POST
ICS INCIDENT COMMAND SYSTEM
IDLH IMMEDIATELY DANGEROUS TO LIFE AND HEALTH
IMS INCIDENT MANAGEMENT SYSTEM
IMT INCIDENT MANAGEMENT TEAM
IO INFORMATION OFFICER
IRO INCIDENT RESPONSE ORGANIZATION
JIC JOINT INFORMATION CENTER
Established with government agency
LGL LEGAL OFFICER
LOSC LOCAL ON-SCENE COORDINATOR (Government Agency Representative)
NOP NEXT OPERATIONAL PERIOD
OC OC
OSHA OCCUPATIONAL SAFETY AND HEALTH ADMINISTRATION
PPE PERSONAL PROTECTIVE EQUIPMENT
PRO CORPORATE COMMUNICATIONS OFFICER
SAM STAGING AREA MANAGER
April 12, 2023
SO SAFETY OFFICER (INCIDENT MANAGEMENT TEAM)
SOSC STATE ON-SCENE COORDINATOR (Government Agency Representative)
TRT TACTICAL RESPONSE TEAM
UC UNIFIED COMMAND
Working in conjunction with government agency representatives