Home > eICS > Incidents > Incident Elements

Incident Elements

Incidents are events, disasters or disruptions, that prompt a planned, coordinated approach to resolve. In their glossary, the Federal Emergency Management Agency (FEMA) defines incident  as "An occurrence, natural or human-caused, that requires a response to protect life or property." The main purpose of eICS is to provide you with powerful, yet flexible tools to plan for, respond to, and recovery from incidents. To fully utilize eICS for incident management, we describe incidents in terms of elements including types, objectives, operational periods, and statuses.



When you create an incident, you must specify whether it is an Actual or Exercise/Drill incident.


Incidents are listed on the Home page and can be accessed through the Response menu by clicking Incidents. The color of the incident icon indicates the type of incident.

  • Yellow - Actual incident
  • Blue - Drill or exercise
  • Green - System test



When you create IRGs, you specify the IRG Type. The option you choose assigns a name and an appropriate icon to the IRG. Any incidents created from this IRG automatically show this icon.


When you point to the icon in any incident list, a tooltip opens indicating the type of incident and providing a brief description of the associated IRG.


Location / Map

When you add or edit a location, you can specify its type. The type determines the icon that appears on the map in the Incident Dashboard. You can choose from Hospital, Fire, Flooding, Ship, Summer Storm, and many other options.

Log Entry

A log entry can have one of the following types:

  • Major Event

  • Decision Made

  • Notification

  • Other/Misc

  • Process Improvement

You can set the type when you manually add or edit an entry to the log in the Event Log tab of the Incident Dashboard.

After an incident has ended, your after action group can review all entries in the log, and especially those that were marked as Process Improvements. These can be assessed to determine whether the IC plan or other elements need to be improved based on the information in that entry.


When you set up a new objective or edit an existing one, you can specify certain settings. You can change these settings at any time.


When you create an objective, you assign it to a particular position or the incident.


You can indicate the objective's priority, choosing from the following options.










You can indicate a status for an objective. During an incident, all Incident Dashboard users can tell from the status how much progress has been made on the objective. In the Objectives tab of the Incident Dashboard, each objective's status is represented by an icon, as listed in the following table:



Not started


In progress; normal


In progress; exception






Not applicable


Changing an objective's status is a manual task. It is not directly linked to the status of the incident.

All objective-related actions are recorded in eICS.

Operational Periods

The operational period applies to the overall incident and the objectives identified for and associated with that incident. The following options are available:




0 - 2 hours


2 - 12 hours


> 12 hours


When appropriate such as returning to normal operations

The incident's current operational period appears at the top of the Incident Dashboard. Authorized users can change the incident's operational period, which is then reflected in the dashboard header.

You cannot move an objective backward through this flow. That is, you cannot change the incident's operational period from Recovery to Intermediate.

Each objective's operational period reflects the flow of priorities through the duration of the incident. For example, the objective to "cordon off the site" may be an Immediate period objective and the "maintain security of the perimeter of the site" might be assigned the Intermediate or Extended period option.

Incident Status

Incidents have one of the following statuses:


The incident is open and all or some of the ICS team is in place managing the incident. Users are interacting with the system (mainly the Incident Dashboard) in real time.


The incident is no longer being worked on by an active ICS team. Inactive incidents provide more limited access to incident information. For example, the dashboards for these incidents to not contain the custom tabs. There are three types of inactive incidents, which include:

  • Ended - When a user ends an incident, it becomes part of the list of inactive incidents. By definition, the incident is over. ICS "stands down"--the team demobilizes and most responders are no longer interacting with the system in real time. The incident remains available to users, allowing them to enter further information for the incident. Only Incident Command, Facility Administrators, and Domain Administrators can end an incident.
  • Closed - The incident is over. The Facility Administrator can enter and edit data in the incident. Other users can view it, but cannot enter or edit any data. Only Facility Administrators and Domain Administrators can close an incident.
  • Archived - The incident no longer requires any action. The Facility Administrator can enter and edit data in the incident. Other users can view it, but cannot enter or edit any data. Only Facility Administrators and Domain Administrators can close an incident.
Last modified



This page has no classifications.