The translation from FEMA terminology to engineering practice is direct. The table below maps each ICS role to its tech equivalent and gives concrete examples of what that person does during a real incident.
| FEMA ICS Role | Tech Incident Role | Concrete Responsibilities During an Outage |
|---|---|---|
| Incident Commander | Incident Commander (IC) | Makes the call to roll back vs. hotfix. Decides when to escalate to executive leadership. Declares the incident resolved. |
| Operations Section Chief | Tech Lead / Ops Lead | Assigns engineers to specific investigation threads. "You own the database layer. You own the CDN. Report back in 10 minutes." |
| Planning Section Chief | Scribe / Incident Tracker | Maintains the live incident doc. Tracks open action items and their owners. Posts timestamped updates every 15 minutes. |
| Logistics Section Chief | Tooling / Access Coordinator | Wakes up the on-call DBA to grant emergency access. Sets up the war room Zoom. Adds the vendor support engineer to the channel. |
| Public Information Officer | Comms Lead | Writes and publishes status page updates. Drafts the customer-facing email. Coordinates with Marketing on social media. |
| Liaison Officer | Vendor / Partner Liaison | Joins the AWS support bridge call. Relays information between your team and the vendor without creating two competing response tracks. |
| Finance/Admin Section | Executive Sponsor / Legal | Approves the emergency DR region spend. Tracks GDPR notification obligations. Authorizes the incident response retainer firm. |
The most important translation to internalize is the Operations vs. Planning split. During a high-stress outage, engineers naturally want to focus entirely on fixing the problem (Operations). Nobody wants to be the person writing things down. But without a dedicated Planning function, the team loses track of what has already been tried, who owns what, and what the current system state actually is. The Scribe role feels administrative — it is actually one of the highest-leverage positions in the incident.
A common SRE interview question is: "What makes a good Incident Commander?" Many candidates answer with technical skills. The correct answer emphasizes non-technical skills: the ability to delegate, resist the urge to personally fix things, maintain calm under pressure, and make decisions with incomplete information. The IC's job is to manage the response, not the system. An IC who starts debugging code has abandoned their post.