Incident Command, EOC & Incident Response

ASIS CPP Certified Protection Professional

Track your progress as you read

Finished sections get a check mark.

1 Introduction & CPP Exam Overview

CPP Exam Facts & Format Using the Seven Domains + ESRM Study Plan

2 Security Principles and Practices

1.1 Security Program Planning, Organization & Control 1.2 Enterprise Security Risk Management (ESRM) & Security Theory 1.3 Security Industry Standards & Continuous Improvement 1.4 The Security Risk Assessment Process Threats & Risk Analysis Fundamentals Risk Treatment — Strategies & Mitigation External Liaison & Public-Private Partnerships Security Awareness Programs

3 Business Principles and Practices

Security Budgeting & Financial Controls Policies, Procedures, Plans & Directives Measuring & Improving Productivity Security Staffing & Personnel Development Ethics, Governance & Vendor Contract Management

4 Investigations

Managing Investigative Operations Evidence, Surveillance & Specialized Investigations Investigative Interviews & Legal Proceedings

5 Personnel Security

Background Investigations & Screening Workplace Violence Protection Travel Security & Duty of Care Executive Protection Programs

6 Physical Security

Physical Security Surveys, Gap Analysis & PPS Design Perimeter Barriers, Protective Lighting & CPTED Locks, Key Control & Access Control Systems Intrusion Detection Systems & Video Surveillance Security Officers, PPS Integration & Program Management Testing, Auditing & Maintaining Physical Security Systems

7 Information Security

InfoSec Program Surveys & Risk Assessment InfoSec Management, Standards & Records Law Protecting Proprietary Information & Intellectual Property CIA Triad, Authentication, Encryption & Cyber Controls Managing an Integrated InfoSec Program & Awareness

8 Crisis Management

Threat Assessment, BIA & Business Continuity Standards Emergency Planning & Preparedness Crisis Communications, Notification & Exercises Incident Command, EOC & Incident Response Recovery, Resumption & Continuity of Operations

Incident Command, EOC & Incident Response

Key Takeaways Explain This Topic AI

The Incident Commander manages the incident itself, while the Emergency Operations Center manages the broader enterprise response and cross-incident resource allocation.

ICS Command Staff — the Public Information Officer, Safety Officer, and Liaison Officer — report directly to the Incident Commander, while Operations, Planning, Logistics, and Finance/Administration form the General Staff Sections.

The Safety Officer is the only ICS position with direct authority to stop or prevent unsafe operations during an incident.

ICS span of control is a ratio of 1:3 to 1:7, with 1:5 considered ideal, and the structure expands by adding organizational layers rather than exceeding that ratio.

Unified Command lets multiple agencies with different legal authorities jointly set objectives under a single Incident Action Plan while each retains its own individual accountability.

Last updated: July 2026

Incident Command, EOC & Incident Response

When a crisis moves from plan to reality, someone has to be in charge, resources have to flow to where they are needed, and field response has to connect to enterprise-level decision-making. Domain 7's fourth task area covers the two structures that make that possible: the Emergency Operations Center (EOC) , which manages the organization's overall response, and the Incident Command System (ICS) , which manages the incident itself.

Emergency Operations Center Concepts and Design

An EOC is a centralized location, physical or virtual, where an organization's leaders and coordinators gather to manage information, make strategic decisions, and coordinate resources during a crisis. The clearest way to remember the EOC/incident-command relationship on the exam: the Incident Commander manages the incident; the EOC manages the enterprise. A field incident commander focuses on tactical, on-scene objectives; the EOC focuses on strategic, organization-wide questions — allocating scarce resources across multiple incidents, managing external relationships with media, regulators, and corporate leadership, and keeping the rest of the business running while the incident is handled.

EOC design considerations include a defensible location with redundant power and communications, enough workspace to support multiple functional desks (situation/intelligence, operations, logistics, public information), technology for shared situational awareness such as status boards and GIS mapping, and — critically for continuity — an alternate or virtual EOC capability in case the primary location is itself affected by the event. EOCs are typically activated in tiers, with staffing and formality scaling to the size of the incident rather than fully activating for every event.

Incident Command System Roles

The Incident Command System (ICS) is the standardized, scalable management structure used to run the response at the incident level. Its structure splits into Command Staff, who report directly to the Incident Commander, and General Staff, who lead the incident's major functional Sections:

• Position Reports to Core Responsibility
• Incident Commander (IC) — Overall authority; sets incident objectives, strategy, and priorities
• Public Information Officer (PIO) IC (Command Staff) Develops and releases information to media and the public
• Safety Officer IC (Command Staff) Monitors for hazardous conditions; authority to halt unsafe operations
• Liaison Officer IC (Command Staff) Point of contact for assisting and cooperating agencies
• Operations Section IC (General Staff) Executes the tactical actions that directly address incident objectives

Planning Section IC (General Staff) Collects and evaluates information; develops the Incident Action Plan (IAP)

Logistics Section IC (General Staff) Provides facilities, supplies, equipment, transportation, and support services

Finance/Administration Section IC (General Staff) Tracks incident costs, procurement, compensation/claims, and time

Only the Incident Commander position is mandatory on every incident; every other position is activated only as the incident's size and complexity require it. On a small incident, one person may serve as IC and fill every General Staff role simultaneously; on a large or prolonged incident, each Section may itself expand into Branches, Divisions, Groups, and Units as the workload demands.

ICS is not reserved for catastrophic events. The same structure scales down to manage planned events, such as a facility's active-assailant drill or a VIP visit, which is part of why security professionals train on it long before any actual crisis occurs. And because delegating a Section to a Section Chief does not transfer ultimate accountability, the Incident Commander must still remain briefed on major decisions made within each Section throughout the incident.

Span of Control and Unified Command

ICS is built around a core management principle: span of control . Any one supervisor should directly oversee no more than a manageable number of subordinates — the ICS standard is a ratio of 1:3 to 1:7, with 1:5 considered ideal . When a Section's workload would push a supervisor beyond that range, ICS expands by adding another layer of organization, such as a new Branch, Division, or Unit, rather than simply loading more people under one manager. This is what allows the same basic structure to scale cleanly from a two-person incident to a response involving thousands.

When an incident crosses jurisdictional or agency lines — for example, a facility incident involving the organization, the fire department, and a state agency, each with its own legal authority — ICS uses Unified Command (UC) rather than a single Incident Commander. Under Unified Command, the affected agencies jointly determine incident objectives, strategies, and priorities and operate from a single Incident Action Plan, while each agency retains its own individual authority, responsibility, and accountability. Unified Command lets multiple legal authorities coordinate through one integrated command structure instead of running parallel, uncoordinated command structures side by side.

Resource Allocation

Resources — personnel, equipment, teams, and supplies — flow through a defined management cycle: identify the need, order, mobilize, track and report status, demobilize, and reimburse/restock . The Planning Section maintains continuous visibility into resource status (assigned, available, or out-of-service) each operational period, which is what allows the Incident Commander or Unified Command to make informed decisions about where scarce resources go next. Consistent resource typing — classifying resources by capability using a common standard, the same concept introduced for mutual aid in the emergency-planning section — ensures that a request made through the EOC or ICS structure is filled with a resource that can actually perform the needed task, not simply a resource with the right name.