Home > eICS > Incidents > Incident Elements

Incident Elements

Incidents are events, disasters or disruptions that require a planned, coordinated response to resolve them. In the Federal Emergency Management Agency (FEMA)  glossary, incidents are defined as "An occurrence, natural or human-caused, that requires a response to protect life or property." 

eICS provides powerful, yet flexible tools to help you plan for, respond to, and recover from incidents. In eICS, incidents are described in terms of the elements, such as Types, Objectives, Operational Periods, and Statuses, that comprise them.


There are several types of things that define incidents, including incident response guide (IRG), location, incident, and log entry types. Some of these types are specified in planning, while others relate exclusively to response.


Through Planning, in the Plan Summary, when you work with or create new IRGs, you must specify the IRG Type. In general, IRGs are designed to address a specific situation, which is indicated by the type. For example, you might have types such as Chemical Incident, Earthquake, Evacuation, or Mass Casualty Incident. The type of IRG you choose determines the icon that will represent the IRG, and it may affect other fields like the Incident Mission and Incident Objectives.


In the future, when you create incidents based on an IRG, the icon, name, and other basic information are determined by the IRG Type.


On the Home and Incidents pages, when you position your cursor over the icon in the Type column, a tooltip appears indicating the Type of Incident and the IRG Type.


There are three types of incidents, including Actual Incidents, Exercise/Drill, and System Test. When you create an incident, you specify that it is an Actual Incident or Exercise/Drill. When you create a test, the type is selected automatically.


Again, on the Home and Incidents pages, when you position your cursor over the icon in the Type column, a tooltip appears indicating the Type of Incident and the IRG Type. The Type of Incident is also reflected in the color of the icon, with three clear distinctions described below.

  • Yellow - Actual incident
  • Blue - Drill or exercise
  • Green - System test



In both the Planning and Response sections, when you add or edit locations on the map, you are required to select an icon. These icons indicate and define the type of location. For example, you can choose from a variety of location types that include general and specific types of buildings, incidents, landmarks, medical, people, vehicles, and weather.


Log Entry

On the Incident Dashboard, through the Event Log, some log entries are generated automatically, while others must be created manually. When you create log entries, you must categorize the entry by selecting its Type. 

Available options include:

  • Major Event

  • Decision Made

  • Notification

  • Other/Misc

  • Process Improvement

  • Safety Briefing

  • Situational Update

Entries in the log can be reviewed at any time, but in general, entries that are marked as Process Improvements should be assessed after the incident to determine subsequent tasks, including whether the associated IRG in the Plan Summary should be updated.


Initially created in the Plan Summary, within IRGs, objectives are tasks that provide guidance and direct actions to resolve an incident. By default, on the Objectives tab in both the Planning and Response sections of eICS, objectives appear in descending order based on rank (the order in which they were created). Newly created objectives are added to the bottom of the list. On the Objectives tab, in the list, objectives can be reordered manually, using a drag-and-drop operation with the order icon, to change the rank.


Manual changes to the rank of objectives on an IRG or incident are remembered, and objectives are displayed in that order going forward.

In addition to rank, there are other options that are important to specify when creating or editing objectives, including Assignment, Priority, Operational Period, and Status. During an incident, changes to objectives are documented in the Recent Events ticker located at the bottom of the Incident Dashboard.


When you create objectives, you must assign them to an ICS Chart position or the incident as a whole. By assigning objectives to positions, you identify the role that will be responsible for completing the task. Then, when an incident occurs, whoever assumes a position will also assume the associated objectives. Of course, objectives can be updated and reassigned as necessary.

To help you locate objectives, on the Objectives tab you can use the Assignment filter to only view objectives assigned to you, the current user, or to the incident, all positions, or a selected position.


Objectives are identified as High, Medium, or Low priority to indicate the relative importance or urgency of tasks. In this way, the priority helps you determine which objectives to work on first. On the Objectives tab, red, orange, and green arrows help you differentiate objective priorities at a glance.


Operational Period

The operational period of an objective is different than the operational period of an incident.

There are four operational periods that indicate the urgency or recommended timeframe for completing objectives. Operational periods are roughly defined in the table below, but can be adapted to meet the needs of your organization.




0 - 2 hours


2 - 12 hours


> 12 hours


When appropriate such as returning to normal operations

Operational periods reflect the forward flow of priorities throughout the duration of an incident. For example, the objective to "cordon off the site" may be designated as an Immediate period objective and the "maintain security of the perimeter of the site" might be assigned the Intermediate or Extended period option.

The operational period of objectives can be seen and edited through the Incident Dashboard, on the Objectives tab by clicking on an objective.


The status of an objective is different than the status of an incident.

Objective statuses indicate progress toward the completion of the task. At the start of an incident, all objectives have the Not Started status. As users start working on objectives, they are expected to update the status to one of the subsequent statuses, which include In Progress – Normal, In Progress – Exception, Completed, Not Applicable, or Other. When updating the status, users can simultaneously add comments to more fully describe the status change.

In the Objectives list on the Incident Dashboard, objective statuses are represented by icons that have specific colors and symbols associated with them. The default icons can be used or your administrator can customize the status icons through Settings > Objective Statuses.

Operational Periods

The operational period of an incident indicates the current, relative state of completion. By default, at the start of an incident, the operational period is Immediate. Located at the top of the Summary tab, on the Incident Dashboard, authorized users can change the incident's operational period to Intermediate, Extended, or Recovery to keep participants informed about progress in responding to and resolving the incident.

Incident Status

Incident statuses are automatically generated when you perform certain actions, like starting, ending, or closing an incident.




The incident is open and all or some of the ICS team is in place managing the incident. Users are interacting with the solution (mainly the Incident Dashboard) in real time.


The incident is no longer being worked on by an active ICS team. Inactive incidents provide more limited access to incident information. For example, the dashboards for these incidents to not contain the custom tabs. There are three types of inactive incidents, which include:

  • Ended - When a user ends an incident, it becomes part of the list of inactive incidents. By definition, the incident is over. ICS "stands down"--the team demobilizes and most responders are no longer interacting with the solution in real time. The incident remains available to users, allowing them to enter further information for the incident. Only Incident Command, Facility Administrators, and Domain Administrators can end an incident.
  • Closed - The incident is over. The Facility Administrator can enter and edit data in the incident. Other users can view it, but cannot enter or edit any data. Only Facility Administrators and Domain Administrators can close an incident.
  • Archived - The incident no longer requires any action. The Facility Administrator can enter and edit data in the incident. Other users can view it, but cannot enter or edit any data. Only Facility Administrators and Domain Administrators can close an incident.
Last modified



This page has no classifications.