March 2018 ICS Organizational Structure and Elements
EXTRACTED FROM - E/L/G 0300
Intermediate Incident Command System for Expanding Incidents,
ICS 300
10
• Brief agency administrative personnel on all incident-related financial issues
needing attention or followup.
• Provide input to the IAP.
Intelligence/Investigations Function
The collection, analysis, and sharing of incident-related information are important
activities for all incidents. Typically, staff in the Planning Section are responsible for
gathering and analyzing operational information and sharing situational awareness, and
staff in the Operations Section are responsible for executing tactical activities.
However, some incidents involve intensive intelligence gathering and investigative
activity, and for such incidents, the Incident Commander or Unified Command may opt
to reconfigure intelligence and investigations responsibilities to meet the needs of the
incident. This may occur when the incident involves a criminal or terrorist act and/or
other non-law-enforcement intelligence/investigations efforts such as epidemiological
investigations.
The purpose of the Intelligence/Investigations function is to ensure that intelligence and
investigative operations and activities are properly managed and coordinated to:
• Prevent and/or deter potential unlawful activity, incidents, and/or attacks;
• Collect, process, analyze, secure, and disseminate information, intelligence,
and situational awareness;
• Identify, document, process, collect, create a chain of custody for, safeguard,
examine and analyze, and store evidence or specimens;
• Conduct thorough and comprehensive investigations that lead to the
perpetrators’ identification and apprehension;
• Conduct missing persons and mass fatality/death investigations;
• Inform and support life safety operations, including the safety and security of
all response personnel, by helping to prevent future attacks or escalated
impacts;
• Determine the source or cause of an ongoing incident (e.g., disease outbreak,
fire, complex coordinated attack, or cyber incident) to control its impact and/or
help prevent the occurrence of similar incidents.
The Incident Commander or Unified Command makes the final determination regarding
the scope and placement of the Intelligence/Investigations function within the command
structure. The intelligence/investigations function can be incorporated as an element of
the Planning Section, in the Operations Section, within the Command Staff, as a
separate General Staff section, or in some combination of these locations.