ICS organizes every responder into one of five major functional areas. Think of it as a company org chart that gets assembled in minutes at the start of an incident and dissolved when the incident closes. The structure is intentionally simple so that people under stress can remember it and operate within it.
1. The Command Staff (The Leaders)
The Command Staff advises and supports the Incident Commander. They handle everything except the tactical response itself.
- Incident Commander (IC): The single point of authority. Every decision that cannot be resolved at a lower level escalates to the IC. The IC does not fix the problem directly — they direct the people who do. In a small incident, one person may hold this role alone. In a large incident, the IC focuses exclusively on strategy and delegation.
- Public Information Officer (PIO): The voice of the incident to the outside world. In tech, this role is often called the Comms Lead or Customer Comms. They write the status page updates, draft the customer email, and manage the company Twitter account during the outage. They do not guess at technical details — they get approved language from the IC and publish it.
- Safety Officer: Monitors for conditions that could harm responders. In tech, this translates to watching for responder burnout, ensuring engineers are not making dangerous changes while exhausted, and flagging when a proposed fix could make the outage worse.
- Liaison Officer: The diplomat. They communicate with external organizations — in tech, this means your cloud vendor's support team, a major enterprise customer's technical account manager, or a regulatory body. They keep external parties informed without letting them drive your internal response.
2. The General Staff (The Doers)
The General Staff runs the actual work of the incident. Each section is led by a Section Chief who reports directly to the IC.
- Operations Section: The hands. They execute the tactical response — diagnosing the root cause, applying fixes, running rollbacks, and verifying recovery. This is where your engineers live during an incident.
- Planning Section: The brain. They maintain situational awareness — tracking what has been tried, what is currently in progress, what the current system state is, and what the next decision point will be. They own the incident document and the timeline.
- Logistics Section: The support layer. They ensure responders have what they need — access credentials, elevated permissions, conference bridge links, additional on-call engineers, and yes, sometimes food and coffee during a long overnight incident.
- Finance/Admin Section: The wallet. They authorize emergency expenditures — spinning up a disaster recovery region, purchasing additional capacity, or approving contractor time. In most tech incidents this role is handled by an executive sponsor rather than a dedicated person.
Key architectural insight: In a small incident (two engineers, thirty minutes), the IC wears all of these hats simultaneously. ICS is designed for this — roles are activated only as needed. The structure scales up as the incident grows, not down. You never start with a full org chart and shrink it. You start minimal and expand when a section's workload exceeds one person's capacity.