2. The Evacuation Phase is initiated at the time the decision to implement an evacuation is finalized. Tasks identified under this phase are implemented throughout the evacuation process until the evacuation is completed.
3. The Re-entry Phase begins immediately following the completion of an evacuation. Tasks identified in this phase will be implemented as hazardous conditions abate and continue until the re-entry process is determined by the EOC to be complete.
11.1 Decision Phase
The EOC Manager will coordinate with the Unified Command leadership, as well as potential risk areas to determine whether an event impacting or threatening the City could necessitate an evacuation. Upon receiving a recommendation from the Unified Command that a regional evacuation may be necessary, the following actions will be implemented:
The EOC will coordinate with potential risk and host area EOCs regarding identified vulnerable areas, populations at risk, available evacuation routes, and possible host sheltering destinations;
CEMP Part IV
Evacuation Annex December 2025
Part IV - 29
EOC staff will coordinate with local agencies regarding evacuation and sheltering resource needs;
The EOC and will continually monitor the event for changes that may affect the in movement of evacuees and potential impacts to evacuation and sheltering resources;
The EOC and will coordinate the release of emergency public information through the EOC Public Information Officer and conference calls; Field units will identify and communicate to the EOC any issues that may impact the implementation of an evacuation or sheltering operation (holidays, high tourism season, roadway construction, etc.);
The EOC will notify the Alameda County OA of the potential need for an evacuation and ensure that a Local Emergency and all necessary emergency ordinances and resolutions are in effect;
The EOC and will activate emergency information telephone lines, if necessary, to respond to inquiries from the affected population;
The EOC will notify the OA of potentially impacted risk and host areas;
11.2 Evacuation Phase
Upon reaching a decision by the Unified Command and threatened areas that an evacuation and sheltering operation must be initiated, the following actions will be implemented:
The EOC will instruct agencies to begin pre-positioning personnel, equipment and supply resources to support local operations (this may occur during the Decision Phase if events warrant);
All affected agencies and organizations will coordinate and finalize designation of risk and host areas involved in the evacuation;
The EOC will make estimations regarding initiation time for the evacuation and notify all affected agencies and organizations accordingly; The EOC will mobilize all necessary resources, direct the use of resources in nonthreatened areas (if necessary), and coordinate deployment of available mutual aid resources to support the implementation of the evacuation and sheltering operation;
The EOC Public Information Officer will continue to coordinate the release of emergency public information through public information conference calls; the EOC will support local efforts to provide emergency information to vulnerable residents by all available means;
Risk and host areas will be identified by the EOC, and when the evacuation is completed for that area; the EOC will relay this information to all affected agencies and organizations;
CEMP Part IV
Evacuation Annex December 2025
Part IV - 30
The EOC will support local law enforcement agencies with security for evacuated areas. All non- emergency access to evacuated areas will be denied during this phase.
11.3 Re-entry Phase
Following an evacuation, the EOC and the Unified Command leadership will coordinate regarding the suitability and feasibility of allowing re-entry into evacuated areas. The decision to allow re-entry into impacted areas following an evacuation will be made jointly by the EOC, City Manager, Law Enforcement and the Unified Command. Re-entry traffic control will be directed by law enforcement, with support and coordination provided through the EOC. Re- entry will not be allowed until the Unified Command agrees that conditions within evacuated areas are favorable for residents to return.
Upon completion of initial impact assessments, appropriate agencies will initiate the actions listed below to develop and implement a re-entry plan:
The EOC will facilitate re-entry coordination conference calls with all affected risk areas, host areas, and the Unified Command and identify which, if any, evacuated areas are in a condition to permit re-entry;
The EOC, as well as other relevant City agencies, will provide to Director information on the condition and accessibility of designated evacuation routes; The EOC will coordinate with appropriate county and state agencies to map the regional routes available for re-entry into evacuated areas, identify traffic control resource needs, and prepare a re-entry traffic management plan; The EOC will coordinate with the OA EOC to identify the impact in areas throughout the planning process and support agency and organization planning efforts for re-entry traffic control within its jurisdiction; The EOC will finalize the re-entry plan as needed and initiate traffic control resource mobilization based on agency and organization input; The EOC will coordinate re-entry times into each risk and host area and arrange for publicly announced re-entry;
The EOC PIO will prepare and release consistent, appropriate public information regarding the time re-entry is to be allowed, the areas opened, and the routes to be used by returning residents; and
The EOC in conjunction with local law enforcement will monitor re-entry traffic on a city-wide basis, identify any needed adjustments in the re-entry plan, and take corrective action.
12.0 EVACUATION METHODOLOGY
CEMP Part IV
Evacuation Annex December 2025
Part IV - 31
Generally, an event that may require evacuation would be fairly isolated and would require only a portion of the population to be moved. However, there is always the possibility that a catastrophic event (e.g. a major earthquake and resulting fires/damage, a large chemical or hazardous materials release, etc.) could occur that would involve a large-scale evacuation of one half or more of the population. In any case, a mass movement of a concentrated, large number of people will severely stress roadways in and around the City.
The City will respond to each situation requiring evacuation on an individual basis using the protocols listed in this Annex.
CEMP Part IV
Cybersecurity Annex December 2025
CYBERSECURITY ANNEX
Attached on the following page is the Bay Area UASI template for a Cyber Incident Response Plan. The City created and maintains an Information Technology Incident Response Plan that uses the core principles contained in the Cybersecurity Annex and utilized this template to create, review, and update the Information Technology Incident Response Plan prior to and following the 2023 incident described in Section 2.8.3 of this EMP. Due to security, the Information Technology Incident Response Plan maintained by the City cannot be shared publicly as it contains sensitive security information.
However, the template contained in the Cybersecurity Annex provides examples of common data, processes, and actions that are contained within an Information Technology Incident Response Plan.
CYBER INCIDENT RESPONSE PLAN
Cyber Incident Response Plan
[Add Organization Name]
[Add Draft/Publication Date]
[Add Street Address]
[Add City, State Zip Code]
CYBER INCIDENT RESPONSE PLAN
Table of Contents FOR OFFICIAL USE ONLY ii
This page intentionally left blank
CYBER INCIDENT RESPONSE PLAN
iii
PREFACE
Plan Overview
Preparation and vigilance are vital to ensuring that an organization is able to respond quickly and effectively to a cyber incident. When a cyber incident occurs, having a plan in place that describes the specific actions and procedures the organization should perform can make a big difference. A wellmanaged incident may have little to no impacts, while undetected or ineffectively handled incidents may cause severe damage that prevents the organization from performing its mission. This Cyber Incident Response Plan (CIRP) template will provide the guidance and structure needed to develop a clear and actionable plan to implement during a cyber incident. This will help minimize damage, reduce disaster response times, and mitigate breach-related expenses.
Template Guidance
This template can be used as a guide to develop a CIRP for your organization. To aid in development, this template includes a variety of guidance language throughout. This guidance language falls into three categories: development guidance, best practices, and additional resources Throughout the template, this guidance language is included in tables with the icons depicted below in Table 1. Table 1: Overview of Template Guidance
Icon Usage
Development Guidance: Development guidance is included throughout the document to indicate specific instructions to complete the plan. It offers supplemental information that may help organizations fill in placeholders.
Best Practice: The template will identify best practices for developing the plan (or conducting the assessments that inform the plan). In some cases, following these best practices is not required for plan completion; however, they will help enhance the plan’s quality and usefulness.
Additional Resource: In some cases, this template may reference external resources that provide useful context that will help organizations better understand a concept, collect information as part of plan development, or address other aspects of cyber planning.
This template also includes placeholders that prompt the inclusion of organization-specific information within the existing plan content. These placeholders are included in brackets, with bold blue text and a description of the prompt: [Review Placeholder Example]. Filling in each placeholder will allow you to customize the template to reflect your organization’s specific requirements, capabilities, priorities, and procedures. In some cases, placeholders are for discrete data points such names, positions, and contact information. In other cases, they are used to indicate areas to build-out a more detailed concept or procedure based on your specific organization’s priorities, resources, and concepts of operation. Where placeholders are not relevant to your organization, or you would prefer to exclude them for any reason, simply remove the prompt and customize the plan to your preferences.
To help guide development, there are example entries included in the tables throughout this template.
These examples can help indicate the type of information that your organization may want to include
CYBER INCIDENT RESPONSE PLAN
iv
and the associated format. Those examples entries should be removed as your organization’s information is inserted into the tables.
Lastly, you will remove this “Preface” section from the final plan, given that it includes development assistance rather than plan content. When finalized, the plan should begin with the “Record of Changes” section.
CYBER INCIDENT RESPONSE PLAN
v
RECORD OF CHANGES
Table 2: Record of Changes
Change Number Section Date of Change Individual Making
Change
Description of
Change
– Best Practice: Tracking all changes to the plan will help ensure that all individuals implementing or referencing the plan are using the most current version and fully understand where updates have been made since previous iterations.
CYBER INCIDENT RESPONSE PLAN
vi
This page intentionally left blank
CYBER INCIDENT RESPONSE PLAN
vii
TABLE OF CONTENTS
Preface ......................................................................................................................................................... iii Record of Changes ....................................................................................................................................... v Table of Contents ....................................................................................................................................... vii Plan Approvals ............................................................................................................................................. ix Introduction .................................................................................................................................................. 1 Incident Response Team ............................................................................................................................. 6 Preparation ................................................................................................................................................ 10 Detection ................................................................................................................................................... 13 Analysis ...................................................................................................................................................... 17 Containment .............................................................................................................................................. 23 Eradication ................................................................................................................................................ 26 Recovery .................................................................................................................................................... 29 Post-Incident Activity ................................................................................................................................. 30 Plan and Development Maintenance ...................................................................................................... 33 Annex A: Glossary and Acronyms ............................................................................................................. 34 Annex B: Memorandum of Agreement ..................................................................................................... 38 Annex C: Incident Analysis Worksheet ..................................................................................................... 40 Annex D: Incident Response Checklist .................................................................................................... 43
CYBER INCIDENT RESPONSE PLAN
viii
This page intentionally left blank
CYBER INCIDENT RESPONSE PLAN
ix
PLAN APPROVALS
By their signatures below, the following senior-level officials certify that they approve this Cyber Incident Response Plan (CIRP) and fully understand the incident response procedures that are to be followed in the event of an incident.
Approved: _______________________________ Date ____________ [Name/Title]
Approved: _______________________________ Date ____________ [Name/Title]
Approved: _______________________________ Date ____________ [Name/Title]
Approved: _______________________________ Date ____________ [Name/Title]
– Best Practice: Examples of senior-level officials that might approve a CIRP include, but are not limited to, City Managers, Chief Information Officers (CIO), Chief Technology Officers (CTO), and Chief Information Security Officers (CISO).
CYBER INCIDENT RESPONSE PLAN
x
This page intentionally left blank
CYBER INCIDENT RESPONSE PLAN
1 INTRODUCTION
Overview of Cyber Incidents
A cyber incident is an event occurring on, or conducted through, a computer or network that jeopardizes the confidentiality, integrity, or availability of computers; information or communications systems and networks; physical or virtual infrastructure controlled by computers or information systems; or information housed on a network. More specifically, types of activity that are commonly recognized as breaches of a typical security policy include:
Attempts to gain unauthorized access to a system and/or to data; The unauthorized use of systems for the processing or storing of data; Changes to a systems firmware, software, or hardware without the system owner’s consent; and Malicious or accidental disruption and/or denial of service. [Add any other background information on cyber incidents that you feel is necessary to contextualize the plan for your staff]
Cyber Incident Response Lines of Effort
Today’s cyber dependent environment necessitates that the public and private sectors vigilantly manage, respond to, and investigate cyber incidents, and share lessons learned so that others can minimize the potential damage to their information systems and data. Ensuring unity of effort during incident response requires a shared understanding of roles and responsibilities for all participating organizations throughout the cyber incident lifecycle.
There are four lines of effort that drive cyber incident response: Threat Response, Asset Response, Intelligence Support, and Affected Entity Response. These concurrent lines of effort provide the
– Best Practice: The amount of additional information that you should include in this section will depend on the amount of experience your personnel have with cybersecurity and incident response. If your organization is well-versed in cybersecurity, more information may not be required. Alternatively, more basic information on what comprises a cyber incident and why they are dangerous may be useful for organizations with less experience in managing cyber incidents.
– In addition, if your organization’s mission makes it particularly prone or vulnerable to a particular type of cyber incident, you may want to highlight that here. If your organization has experienced any significant cyber incidents in the past, you may also want to use this section to describe what occurred. This will emphasize the importance of cyber response and underscore that cyber incidents can impact all organizations.
– Additional Resource: The cyber incident response lines of effort below are identified in Presidential Policy Directive (PPD)-41: United States Cyber Incident Coordination.
CYBER INCIDENT RESPONSE PLAN
2 foundation required to synchronize various response objectives before, during and after a cyber incident. Table 3 describes each cyber incident response line of effort. Table 3: Cyber Incident Response Lines of Effort
Lines of Effort Description
Threat Response
Threat response activities include the appropriate law enforcement investigative activities for:
Collecting evidence and gathering intelligence to provide attribution; Linking related incidents and identifying additional possible affected entities; Identifying threat pursuit and disruption opportunities; and Developing and executing courses of action to mitigate the immediate threat and facilitating information sharing and coordination with asset response efforts.
Asset Response
Asset response activities include furnishing technical assistance to affected entities to protect their assets, mitigate vulnerabilities, and reduce impacts of cyber incidents by:
Identifying other entities possibly at risk and assessing their risk to the same or similar vulnerabilities;
Assessing potential risks to the sector or region, including potential cascading effects, and developing courses of action to mitigate these risks; Facilitating information sharing and operational coordination with threat response; and
Providing guidance on how best to utilize resources and capabilities in a timely, effective manner to speed recovery.
Intelligence
Intelligence support facilitates the building of situational threat awareness and sharing of related intelligence to:
Create an integrated analysis of threat tactics, techniques, and procedures; Identify and assist with the mitigation of knowledge gaps; and Suggest methods to degrade or mitigate adversary threat capabilities. Share indicators of compromise with other potential victims to increase their defense posture
Affected Entity
Response
An affected entity is highly encouraged to share information surrounding the event with other cybersecurity specialists to assist with cyber incident response. The affected entity is the data owner and retains responsibility to ensure appropriate actions and safeguards are in place to remediate threats and secure their information.
Table 4 lists the entities, including public and private sector organizations and agencies, involved in each of the four cyber incident response lines of effort. Table 4: Entities Associate with the Cyber Incident Response Lines of Effort Lines of Effort Associated Entities
Threat Response [Add the names of additional relevant organizations, including third-party cybersecurity resources]
Asset Response [Add the names of additional relevant organizations, including third-party cybersecurity resources]
CYBER INCIDENT RESPONSE PLAN
3 Lines of Effort Associated Entities
Intelligence
[Add the names of additional relevant organizations, including third-party cybersecurity resources]
Affected Entity
Response
[Add the names of additional relevant organizations, including third-party cybersecurity resources]
Incident Response Lifecycle
This plan describes the actions and procedures that the organization should perform as a part of cyber incident response. Those actions and procedures fall into seven general stages:
Preparation
Detection
Analysis
Containment
Eradication
Recovery
Post-Incident Activity
Each of the seven phases of cyber incident response have a chapter dedicated to it within this plan.
Those phase-specific chapters will describe what the actions that comprise each phase and identify the personnel responsible for completing each action.
Please see the Annex D: Incident Response Checklist for an overall sequential list of tasks that [Add Organization Name] will perform during each step of incident response.
Relevant Cyber Entities
Resources are available at the state, regional, and federal levels, and through non-governmental organizations, that can assist agencies and organizations to improve their cyber preparedness and response capabilities (see Table 5). This resource is intended to serve as a high-level reference for relevant cyber entities that may be helpful to contact during incident response. For a specific
– Best Practice: The Incident Response Lifecycle below is based on the System Administration, Audit, Network, and Security (SANS) framework. However, it is also acceptable to use the National Institute of Standards and Technology (NIST) Framework (Identify, Protect, Detect, Respond, Recover) instead. Both the NIST and SANS incident response steps are considered industry standards.
– If you choose to use the NIST framework or any other, be sure to update the plan’s chapter headings accordingly.
CYBER INCIDENT RESPONSE PLAN
4 breakdown of the services external resources provide, and the contact information for the agency/organization point of contacts, refer to the Preparation chapter. Table 5: Relevant Cyber Entities
Cyber Entity Description of Services Performed
Relevant Cyber Departments and Agencies Contact Form
Table 6 can be used to identify points of contact at relevant organizations that [Add Organization Name] may need to notify or communicate with in the event of a cyber incident. Table 6: Cyber Departments and Agencies Contact Form
Organization Point of Contact Email Address Phone Number Organization A Jane Doe [email protected] 123-555-5555 [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number] [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number] [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number] [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number] [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number] [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number]
CYBER INCIDENT RESPONSE PLAN
5 Organization Point of Contact Email Address Phone Number
CYBER INCIDENT RESPONSE PLAN
6 INCIDENT RESPONSE TEAM
It is important to pre-identify the necessary roles for the purpose of incident response. Individuals with the required knowledge and skill sets should be available at all times to respond to an incident. A single individual may perform several roles concurrently and members of an incident response group may or may not participate in a similarly labeled group in their day to day work. Specific incident responses will dictate which roles are necessary and activated.
Please see the Annex D: Incident Response ChecklistError! Reference source not found. for an overall sequential list of tasks that [Add Organization Name] will perform during the seven steps of incident response.
– Development Guidance: An Incident Response Team is a group of experts that assesses, documents, and responds to a cyber incident so that a network can not only recover quickly, but also avoid future incidents.
– Development Guidance: For many organizations, the full list of roles will not be necessary or may not be feasible due to limited resources and staff availability. As you identify the personnel that comprise each role, remove the positions and groups that are not relevant to your organization. Smaller organizations may not require as many teams or positions, and in some cases, the same individual may perform more than one role.
– Development Guidance: An incident response team should be available for anyone who discovers or suspects that an incident involving the organization has occurred. One or more team members, depending on the magnitude of the incident and availability of personnel, will then handle the incident. The incident handlers analyze the incident data, determine the impact of the incident, and act appropriately to limit the damage and restore normal services.
The incident response team’s success depends on the participation and cooperation of individuals throughout the organization.
– Incident response teams can be comprised entirely of internal employees, be fully outsourced, or consist of both internal and external personnel. – NIST identifies possible structures for an incident response team include the following:
– • Central Incident Response Team
– • Distributed Incident Response Team
– • Coordinating Team
– For more information, refer to the NIST Computer Security Incident Handling Guide.
CYBER INCIDENT RESPONSE PLAN
7 Command Staff
Table 7 lists the roles that comprise [Add Organization Name]’s Command Staff. Table 7: Incident Response Team (Command Staff)
Role Description Individual(s)
Currently in Role
Incident Commander
Management level person(s) with the authority to make
high-level decisions and approve actions to be taken by the Incident Response Team.
[Add Name(s)]
Information Officer Disseminates public and non-sensitive information to interested parties. [Add Name(s)]
External Liaisons Serves as the point of contact for other governmental and non-governmental agencies and organizations. [Add Name(s)] Safety Officer Monitors incident operations and advises on matters related to operational safety. [Add Name(s)]
Legal Advisor Advises incident command on legal matters. [Add Name(s)] [Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
General Staff
General Staff – Management
The General Staff is responsible for the functional aspects of the incident command structure. Table 8 lists the roles that comprise the management of the General Staff. Table 8: General Staff Management
Role Description Individual(s)
Currently in Role
Operations Chief (and
Deputies) Directly manages all incident tactical activities. [Add Name(s)] Lead Investigator
Gathers and analyzes technical evidence, determines the cause of the attack, and directs other analysts and IT
components to implement system and service recovery.
[Add Name(s)]
[Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
General Staff – Network Group
Table 9 lists the roles that comprise the organization’s Network Group, which is the incident response team responsible for functional aspects of network management. Table 9: General Staff – Network Group
Role Description Individual(s)
Currently in Role
Network Group Supervisor Oversees Network Group team members. [Add Name(s)] Network Subject-Matter
Experts (SMEs)
Persons with experience and authorization necessary to
manage affected local area networks and firewalls [Add Name(s)]
CYBER INCIDENT RESPONSE PLAN
8 Role Description Individual(s)
Currently in Role
Firewall Engineers Designs, builds, and manages the security infrastructure of IT systems [Add Name(s)]
[Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
General Staff – Database Group
Table 10 lists the roles that comprise the organization’s Database Group, which is the incident response team responsible for functional aspects of database systems. Table 10: General Staff – Database Group
Role Description Individual(s)
Currently in Role
Database Group
Supervisor Oversees Database Group team members. [Add Name(s)] Database SMEs
Person(s) with experience and authorization necessary to manage affected database systems, including:
[Add to list of database systems based on those used
by your organization]
[Add Name(s)]
[Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
General Staff – Platform Group
Table 11 lists the roles that comprise the organization’s Platform Group, which is the incident response team responsible for functional aspects of server and workstation platforms. Table 11: General Staff – Platform Group
Role Description Individual(s)
Currently in Role
Platform Group Supervisor Oversees Platform Group team members. [Add Name(s)] Server Platform SMEs
Person(s) with experience and authorization necessary to manage affected server platforms, including:
Windows
Linux
[Update list of platforms based on those used by your organization]
[Add Name(s)]
Workstation Platform
SMEs
Person(s) with experience and authorization necessary to manage affected workstation platforms, including:
Windows
[Update list of platforms based on those used by your organization]
[Add Name(s)]
CYBER INCIDENT RESPONSE PLAN
9 Role Description Individual(s)
Currently in Role
[Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
General Staff – Application Group
Table 12 lists the roles that comprise the organization’s Application Group, which is the incident response team responsible for functional aspects of server and client applications. Table 12: General Staff – Application Group
Role Description Individual(s)
Currently in Role
Application Group
Supervisor Oversees Application Group team members. [Add Name(s)] Web Application SMEs Person(s) with experience and authorization necessary to manage affected web server applications. [Add Name(s)]
Management Application
SMEs
Person(s) with experience and authorization necessary to manage affected management information systems,
including:
Antivirus
Patch management
Email
Other incident affected applications
[Update list of systems based on those used by your
organization]
[Add Name(s)]
Desktop Application SMEs Person(s) with experience and authorization necessary to manage affected workstation-based applications. [Add Name(s)] [Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
CYBER INCIDENT RESPONSE PLAN
10 PREPARATION
Plans and Policy
Planning begins with the development of the CIRP (and other plans) and training an IRT or identifying outside resources for a third-party IRT. When outsourcing an IRT, the third-party organization will be pre-identified and contracted. Ideally, the contract will be in place before a cyber incident occurs. The third-party organization will perform a review of the customer organization’s IT infrastructure, review and test the CIRP, and clearly establish a Service Level Agreement (SLA) between all parties.
Table 13 identifies other organizational plans and policies that are relevant to cybersecurity or cyber incident response.
Table 13: Other Relevant Plans and Policies
Plan/Policy Description of Plan’s Relationship to CIRP Last Update Organization COOP Plan
As both COOP plans and a CIRP address steps for
critical operations to continue during a range of
emergencies, it is vital to ensure synergy between
both documents.
1/1/2020
[Add Plan/Policy Name] [Add Description] [Add Date]
[Add Plan/Policy Name] [Add Description] [Add Date]
[Add Plan/Policy Name] [Add Description] [Add Date]
[Add Plan/Policy Name] [Add Description] [Add Date]
[Add Plan/Policy Name] [Add Description] [Add Date]
[Add any desired information about your organization’s existing plans and policies that may impact this plan.]
The Preparation phase also includes training for operational employees as well as supervisors and managers. They must be trained to identify suspicious behavior, whether it is a computer or other device’s behavior or an interaction with another person, such as a phone call that may be an attempt at social engineering. Employees will also understand the appropriate use for information systems and know the steps necessary will they observe another employee or contractor’s behavior inconsistent with the [Add Organization Name]’s Acceptable Use Policy. Consider that insider threats are still a common source of cybersecurity incidents, including data breaches, theft of intellectual property and sensitive information, damage to networked systems, as well as accidental exposure due to misconfiguration.
Table 14 identifies the existing training courses relevant to cyber incident response and notes the percentage of the personnel that have successfully completed each course (among the personnel that are required to complete it, not the entire organization staff).
– Best Practice: The goal of the Preparation stage is to ensure that your organization has the ability to comprehensively respond to an incident at a moment’s notice.
CYBER INCIDENT RESPONSE PLAN
11 Table 14: Relevant Training Courses
Training Course Description of Course Date Course
Last Updated
Course Completion
Percentage (Among
Relevant Staff)
Data Breach Training
This training explores best practices for
employees to prevent data breaches
during the normal course of work.
1/1/2020 80%
[Add Course Name] [Add Description] [Add Date] [Add Percentage] [Add Course Name] [Add Description] [Add Date] [Add Percentage] [Add Course Name] [Add Description] [Add Date] [Add Percentage] [Add Course Name] [Add Description] [Add Date] [Add Percentage] [Add Course Name] [Add Description] [Add Date] [Add Percentage] [Add Course Name] [Add Description] [Add Date] [Add Percentage] External Resources
External resources are often just as important as internal resources. Maintaining a comprehensive list of all partner agencies to ensure regular communication is key to establishing and managing effective partnerships to foster open information sharing. [Add Organization Name]’s partners are listed in Table 15 along with a description of the services they provide and the contact information for the agency/organization point of contact.
Table 15: External Resources
Partner Organization/Agency Service Provided POC Email POC Phone Number
Federal
[Add Description] [Add Email] [Add Number]
[Add Description] [Add Email] [Add Number]
[Add any additional relevant
agencies/organizations] [Add Description] [Add Email] [Add Number] State
[Add Description] [Add Email] [Add Number]
[Add Description] [Add Email] [Add Number]
[Add any additional relevant
agencies/organizations]
[Add Description] [Add Email] [Add Number]
Regional
[Add Description] [Add Email] [Add Number]
[Add any additional relevant
agencies/organizations]
[Add Description] [Add Email] [Add Number]
Non-Governmental Organizations/Private Sector
[Add Description] [Add Email] [Add Number]
[Add any additional relevant
agencies/organizations]
[Add Description] [Add Email] [Add Number]
Local
Police [Add Description] [Add Email] [Add Number]
Utility Provider [Add Description] [Add Email] [Add Number] Cellular/Network Provider [Add Description] [Add Email] [Add Number] Web Service Hosting [Add Description] [Add Email] [Add Number] [Add any additional relevant
agencies/organizations]
[Add Description] [Add Email] [Add Number]
CYBER INCIDENT RESPONSE PLAN
12 Personnel
It is critical that all members of the IRT can be quickly contacted in the case of a cyber incident or suspected cyber incident. The “Incident Response Team” chapter lists the IRT positions and describes the role(s) played by each. Table 16 lists the members of [Add Organization Name]’s IRT and includes each person’s email address and phone number. As some members of the IRT may be contracted out to third-party vendors, the table is organized by internal staff and third-party organizations. Table 16: Incident Response Team
Name Position Email Address Phone Number
Internal Staff
Jane Doe IT Services Manager [email protected] 123-555-5555 [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] Third-Party Vendors
[Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number]
CYBER INCIDENT RESPONSE PLAN
13 DETECTION
Indicators of a Cyber Incident
The existence of a cyber incident can be derived from various types of sources, both systematic and from monitored open-source information. Table 17 lists the likely sources and who is responsible for monitoring for an incident or receiving notification from an external agency/organization. Table 17: Cyber Incident Indicators
Indicator Potential Sources Responsibility for Monitoring and/or Receiving Notification
Alerts from
Monitoring and
Detection
Systems
Intrusion Detection and Prevention Systems
(IDS/IPS)
Security Information and Event Management
(SIEM) and antivirus software and third-party
monitoring system or service
Vulnerability assessment platforms
[Add any additional sources]
[Add Position(s)]
Logs
Operating Systems (OS)
Applications
Web Servers
Network devices network monitoring system
[Add any additional sources]
[Add Position(s)]
Users
Internal or external users, including non-IT or
security-related staff
Customers can report possible incidents to the IRT
directly
[Add any additional sources]
[Add Position(s)]
Internal Teams
IT Departments
IT Help Desks
IRTs
Staff that may detect anomalies during their daily
work
[Add any additional sources]
[Add Position(s)]
Managed Service
Providers
Internet Service Providers (ISP)
Telecommunication Service Providers
Suppliers
[Add any additional sources]
[Add Position(s)]
Mass Media Newspapers [Add Position(s)]
– Best Practice: This phase involves detecting deviations from normal operations in the organization and understanding if a deviation represents a security incident. Early steps taken to detect and verify an incident are important to developing an effective containment and eradication strategy. Once an incident has been detected, resources can be assigned to investigate the scope and impacts.
CYBER INCIDENT RESPONSE PLAN
14 Indicator Potential Sources Responsibility for Monitoring and/or Receiving Notification
Television
[Add any additional sources]
Website
Public security information websites
Websites by security researchers
Defacement archive websites
[Add any additional sources]
[Add Position(s)]
[Add any
additional
indicators that
your organization
relies upon]
[Add Sources] [Add Position(s)]
Determining how to triage a potential incident depends on the characteristics of the incident and/or events in question. There are many contributing characteristics which may demand different exploratory methods and levels of escalation. Table 18 describes different incident characteristics, the exploratory methods required to determine whether a cyber incident has occurred, and the member(s) of the IRT responsible for the assessment.
Table 18: Cyber Incident Characteristics
Characteristic Description Exploratory Method Responsibility Authentication
Unusual or unauthorized
logon attempts, logon
activities after hours,
remote session attempts,
unauthorized privilege
escalation, etc.
The system administrator could review
the SIEM logs to understand the account
in question and reason for error and
advise the ISO.
[Add Position(s)]
Data Handling
Abnormal ad-hoc requests,
unauthorized access or
attempted access,
inappropriate disclosure,
inappropriate destruction of
sensitive data, etc.
The administrator can review SIEM and
Active Directory logs to understand the
nature of the requests – this could
simply be the case of user rights
management issues or it could lead to
an investigation.
[Add Position(s)]
Data
Exfiltration
Large amounts of data
leaving the network by an
authorized (or
unauthorized) user.
The system administrator may
immediately cease all applicable
activities related to the incident in
question, secure their workstation or
area and contact the appropriate ISO or
their representative to begin preserving
the information or evidence of
questionable activities. Do not turn off
power to the device in order to allow
cybersecurity personnel to conduct
forensics.
[Add Position(s)]
System
Availability
Web defacements, denial of
services, hacking activities,
modification of software or
The administrator may review SIEM logs
to understand the activity in question
and prepare to restore services from a
backup and actively review firewall logs.
[Add Position(s)]
CYBER INCIDENT RESPONSE PLAN
15 Characteristic Description Exploratory Method Responsibility systems, suspicious
activities
Physical
Power outages, physical
damage, sabotage, physical
loss or theft of information
or systems
Coordinate with the ISO and the facility
infrastructure team to understand the
nature of the event and understand how
to implement secondary power and
possibly provide security personnel to
protect the physical perimeter and
sensitive areas.
[Add Position(s)]
Other
Social engineering, Trojan
or virus infections,
harassment, elevated data
disclosure, improper
disposal of documents.
Disable the user account, take a
screenshot and turn in, unplug the
computer from the network, actively log
authentication and access actions, etc.
[Add Position(s)]
[Add any
additional
characteristics
relevant to
your
organization]
[Add any additional
characteristics that are
relevant to your
organization]
[Add any additional relevant information] [Add Position(s)] Incident Response Team Roles and Responsibilities
Table 19 lists the actions required by the IRT during the Detection phase of cyber incident response, including the position(s) responsible for performing the action. The list suggests a recommended order.
In an actual disaster, some tasks may be performed before this list suggests they be performed. Table 19: Detection Roles and Responsibilities
Step Action Responsibility
1 Report signs of a security incident to the CISO Database Group Supervisor
2 Performs an initial assessment to determine source of cyber threat Lead Investigator
– Best Practice: SANS describes key components of Detection—which you may want to incorporate into the roles and responsibilities table below—as follows:
– • Setting up monitoring for all sensitive IT systems and infrastructure. – • Analyzing events from multiple sources including log files, error messages, and alerts from security tools.
– • Identifying an incident by correlating data from multiple sources and reporting it as soon as possible.
– • Notifying IRT members and establishing communication with a designated command center (e.g., senior management, IT operations).
– • Documenting all information that you collect during the process of detection. – • Threat prevention and detection capabilities across all main attack vectors.
CYBER INCIDENT RESPONSE PLAN
16 Step Action Responsibility
3 [Add Detection Action] [Add Position]
4 [Add Detection Action] [Add Position]
5 [Add Detection Action] [Add Position]
6 [Add Detection Action] [Add Position]
7 [Add Detection Action] [Add Position]
8 [Add Detection Action] [Add Position]
9 [Add Detection Action] [Add Position]
10 [Add Detection Action] [Add Position]
CYBER INCIDENT RESPONSE PLAN
17 ANALYSIS
Impact Analysis
During the Analysis phase of cyber incident response, the IRT will conduct an investigation of the incident, including threat and impact analysis, to categorize the impact of the event on the [Add Organization Name]. Once the incident’s impact level is understood it may be appropriate to escalate the incident response and contact other entities.
[Add Position Name] will lead the analysis, which should begin immediately upon the determining that a cyber incident has occurred. An Impact Analysis Worksheet can be found in Annex C: Incident Analysis Worksheet, which can be used to conduct the analyses described below.
2.0 Functional Impact
Incidents may affect the confidentiality, integrity, and availability of the organization’s information.
Table 20 lists the categories used to classify an incident’s functional impact. Table 20: Functional Impact Categories
Category Definition
None No effect to the organization’s ability to provide all services to all users.
Low Minimal effect; the organization can still provide all critical services to all users but has lost efficiency.
Medium Organization has lost the ability to provide a critical service to a subset of system users.
High Organization is no longer able to provide more than one critical service to any users.
– Development Guidance: During this phase, it is vital for resources to be assigned to investigate the incident. Assessments are conducted to determine the incident’s scope, such as which networks, systems, or applications are affected; who or what originated the incident; and how the incident is occurring (e.g., what tools or attack methods are being used, what vulnerabilities are being exploited).
– Development Guidance: Often, the CISO will be responsible for leading the analysis of a cyber incident.
– Development Guidance: Your organization may use a different scale to categorize cyber incident functional impacts. If so, replace the categories in the table below with those used by your organization.
CYBER INCIDENT RESPONSE PLAN
18 Information Impact
Incidents may affect the confidentiality, integrity, and availability of [Add Organization Name]’s information. Table 21 lists the categories used to classify an incident’s information impact. Table 21: Information Impact Categories
Category Definition
None
No information was exfiltrated/leaked, disclosed, changed, deleted, accessed, or disclosed by or for unauthorized persons or purposes, or otherwise compromised.
Privacy Breach
Sensitive PII of taxpayers, employees, beneficiaries, etc., was accessed or exfiltrated/leaked, or Protected Health Information (PHI) of individuals was used or disclosed by or for unauthorized persons or purposes, or otherwise compromised.
Proprietary Breach
Unclassified proprietary information, such as Protected Critical Infrastructure Information (PCII), was accessed, exfiltrated/leaked, or used or disclosed by or for unauthorized persons or purposes.
Integrity Loss Sensitive or proprietary information was changed or deleted accidentally or intentionally.
Recoverability
The size of the incident and the type of resources it affects will determine the amount of time and resources that must be spent on recovering from that incident. Table 22 lists the categories [Add Organization Name] uses to classify an incident’s recoverability impact.
Table 22: Recoverability Categories
Category Definition
Regular Time to recovery is predictable with existing resources.
Supplemented Time to recovery is predictable with additional resources.
Extended Time to recovery is unpredictable; additional resources and outside help are needed.
– Development Guidance: Your organization may use a different scale to categorize cyber incident information impacts. If so, replace the categories in the table below with those used by your organization.
– Development Guidance: Your organization may use a different scale to categorize cyber incident recoverability. If so, replace the categories in the table below with those used by your organization.
– Additional Resource: The NIST approach to analyzing impacts and recoverability can be found in the Guide for Cybersecurity Event Recovery. Your organization can use a different approach to analysis, if desired.
CYBER INCIDENT RESPONSE PLAN
19 Not Recoverable Recovery from the incident is not possible (e.g., sensitive data exfiltrated/leaked and posted publicly); launch investigation.
Overall Incident Severity
Once the analyses described above are complete, [Add Position Responsible] can prioritize the incident according to its severity level. The appropriate response to an incident is dependent on the severity rating of the incident. Table 23 describes the four levels of severity and identifies the timelines for initial action for incidents at each severity level. Refer to the Annex C: Incident Analysis Worksheet to assess an incident’s severity score.
Table 23: Incident Severity
Priority Guideline Score Initial Action
Severe:
Extreme impact on enterprise 13-15 Immediately
High:
Loss of a major service 11-12 Immediately
Medium:
Some impact some portion of enterprise 8-10 Within 4 hours Low:
Minor impact on a small portion of enterprise 5-7 Within 24 hours Cyber Incident Types
A cyber incident can be defined as any security related event that has an actual or potential adverse effect on any computing resource or the data contained therein, or the violation of an explicit or implied security policy. All incidents are classified according to the criteria listed in Table 24. An incident may fit into more than one defined type.
Table 24: Incident Types
Incident Type Description
Denial of Service
An incident by which authorized access to systems or data is prevented or impaired.
Usually a denial of service (DoS) incident is a security event if the DoS is due to malicious intent. Not all events that prevent or hinder authorized access to systems or
– Development Guidance: The initial action timelines listed in the table above are examples of how an organization might assign those values. Update the timelines based on your organization’s preferences and capabilities.
– Development Guidance: Although references to many other incident types can be found in documentation, they all fall in one of the three categories noted above. For example, malicious code such as a virus or trojan will be first recognized as a denial of service, unauthorized access, or inappropriate usage, depending on the payload of the malicious code. Similarly, a phishing attach leading to account compromise will first be recognized as unauthorized access. Using these three incident types, responses can be developed to cover any incident that might affect the enterprise. If your organization prefers to break categorize the incident types more granularly, simply update the table accordingly.
CYBER INCIDENT RESPONSE PLAN
20 Incident Type Description
data are security incidents. The mechanical, electrical, or administrative failure of a system or access mechanism may not be a security incident.
Unauthorized
Access
An incident where unauthorized access is attempted or gained to systems or data, such as a phising attack. This access can be logical or physical in nature. Unauthorized access is any access for which permission has not been granted. Such permissions would include connect, authenticate, read, write, create, delete, modify, etc. This unauthorized access can be by an individual or another system.
Inappropriate
Usage
An incident by which acceptable use policies are violated. Acceptable use policies may include what types of data may be accessed or transmitted, how information may be accessed or transmitted, and where information may be received from or transmitted to.
[Add additional
incident types, as
desired]
[Add Desription]
Physical Considerations
Any incident involving or affecting physical systems or critical infrastructure mandates the participation of the applicable Critical Infrastructure Protection (CIP) team(s). Incidents involving physical infrastructure have additional considerations in addition to typical cyber-attacks. CIP-centric organizations have to consider more than simply network protection principles; they must also take into consideration the acquisition and replacement of systems on the network.
Table 25 lists the members of the CIP team, including the positions that comprise the team and each member’s email address and phone number.
Table 25: Critical Infrastructure Protection Team
Name Position Email Address Phone Number
Jane Doe Transit and Port Security
Liaison [email protected] 123-555-555
[Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number]
– Development Guidance: If your organization does not have a CIP team, you may delete the table below.
CYBER INCIDENT RESPONSE PLAN
21 Additional FERC Physical Considerations
FERC supplies the following list of physical conditions in Table 26, in order for [Add Organization Name] to ensure compliance.
Table 26: FERC Physical Considerations
# Definition
3.3.2.1 Physical considerations extend beyond the immediate physical and boundary of the computing center; even beyond the facility walls. Physical considerations encompass any and all physical and / or mechanical features directly or indirectly required to support business operations. Some example areas of concern that may require addition consideration.
3.3.2.2 Environmental Control Systems (ECS) are required to maintain an environment conducive to static free temperature and humidity-controlled environment. These controllers are more often than not enabled with an Internet or network connection which inherently creates additional vulnerabilities and risk to the environment.
3.3.2.3 Bulk Electrical Systems (BES) require additional considerations during the Post-Incident or Recovery phase of an incident in addition to the “typical” cyber related business recovery actions.
BES systems inherently have additional physical recovery considerations to ensure the proper restoration to protect the confidentiality, integrity and the availability of public and private critical physical infrastructure.
3.3.2.4 FERC Order 829 mandated additional controls addressing cyber security post-incident recovery for Industrial Control Systems (ICS) hardware, software and computing services associated with BES systems. NERC created implementation guidance CIP-009-6, as part of the overall CIP-009 recovery plan, to provide guidance with national, state and local CIP recovery strategies. More information is available directly from the NERC website at http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx
3.3.2.5 Security of the facility and applicable supporting infrastructure is another vital area concern.
Recovery efforts must include ensuring the physical and / or logical boundaries are “sound” and free of “evidence of tamper”. The organization may no longer have the resources necessary to secure the environment, and therefore may look into other options such as contracted support.
This type of action may require support by contracting, financial, logistics and management personnel.
Incident Response Team Roles and Responsibilities
Table 27 lists the actions required by the IRT during the Analysis phase of cyber incident response, including the position(s) responsible for performing the action. The list suggests a recommended order.
In an actual disaster, some tasks may be performed before this list suggests they be performed. Table 27: Analysis Roles and Responsibilities
Step Action Responsibility
1 Begin steps for evidence preservation and containment Lead Investigator 2 Perform detailed impact analysis to properly prioritize additional response activities that may be required
Network SubjectMatter Experts
(SMEs)
3 [Add Analysis Action] [Add Position]
4 [Add Analysis Action] [Add Position]
5 [Add Analysis Action] [Add Position]
6 [Add Analysis Action] [Add Position]
CYBER INCIDENT RESPONSE PLAN
22 Step Action Responsibility
7 [Add Analysis Action] [Add Position]
8 [Add Analysis Action] [Add Position]
9 [Add Analysis Action] [Add Position]
10 [Add Analysis Action] [Add Position]
CYBER INCIDENT RESPONSE PLAN
23 CONTAINMENT
Once an incident is detected and analyzed, [Add Organization Name] will contain the incident in order to minimize continued impact and/or disruption of services and reduce the possibility of continued contamination to other services. Tactics supporting the immediate local isolation and containment are vital to slowing, and hopefully stopping the proliferation of the attack.
A risk management strategy will address the risk at every level, starting with the infected computing device all the way to examining the viability of the network. The affected computing devices may require immediate isolation or removal from the network in order to support the required efforts. Some commonly employed network tactics involve disconnecting or isolating network segments, creating additional firewall rules, employing active IDS/IPS rules or simply disconnecting the infected workstation or server from the company and/or public networks.
The type of cyber incident will inform the actions required to contain the incident. Table 28 identifies different actions that may be required for each of the three cyber incident types. Table 28: Containment Activities by Incident Type
Incident Type Description
Denial of Service [Add containment actions your organization can perform] Unauthorized
Access [Add containment actions your organization can perform] Inappropriate
Usage [Add containment actions your organization can perform] [Add additional
incident types, as
desired]
[Add containment actions your organization can perform]
– Development Guidance: Containment procedures attempt to actively limit the scope and magnitude of the attack. A vulnerability in a particular computer architecture can be exploited quickly. Containment involves acquiring, preserving, securing, and documenting all evidence.
Ultimately, Containment has two goals: preventing data from leaving the network and preventing an attacker from causing further damage to your organization’s information technology assets.
– Development Guidance: If you updated or added to the list of incident types in the Analysis chapter, make sure to update the table above accordingly. – In the description column in the table above, list the different activities that may be required to contain incidents based on the incident type. While the specifics of the incident will ultimately determine which is most appropriate, including the various option in the CIRP can help responders identify options more quickly when an incident occurs. Examples of activities might include: Disconnecting the suspected subnet; terminating the operation;
CYBER INCIDENT RESPONSE PLAN
24 [Add Organization Name] identifies goals for containment timelines based on the incident severity, as assessed in the Analysis chapter of this plan. In cases where multiple incidents are occurring simultaneously or in close succession, containment of those incidents that will cause the most serious impacts to mission performance will be prioritized over less severe incidents. Table 29 lists the containment goals for incidents at each level of severity. Refer to Annex C for the Incident Analysis Worksheet which can be used to determine an incident’s severity score. Table 29: Containment Goals by Incident Severity
Priority Guideline Score Containment Goal
Severe: Extreme impact on enterprise 13-15 ASAP
High: Loss of a major service 11-12 <24 Hours
Medium: Some impact some portion of enterprise 8-10 <72 Hours Low: Minor impact on a small portion of enterprise 5-7 <7 Days Incident Response Team Roles and Responsibilities
Table 30 lists the actions required by the IRT during the Containment phase of cyber incident response, including the position(s) responsible for performing the action. The list suggests a recommended order.
In an actual disaster, some tasks may be performed before this list suggests they be performed. Table 30: Containment Roles and Responsibilities
Step Action Responsibility
1 Document evidence from the incident Lead Investigator running a full system backup; notifying an appropriate help desk; and changing the passwords on the compromised systems.
– Development Guidance: The containment goals listed in the table above are examples of how your organization might assign those values. Update the goals based on your organization’s preferences and capabilities.
– Best Practice: SANS describes key components of Containment—which you may want to incorporate into the roles and responsibilities table below—as follows:
– • Short-term containment—limiting damage before the incident gets worse, usually by isolating network segments, taking down hacked production server and routing to failover. – • System backup—taking a forensic image of the affected system(s) with tools such as Forensic Tool Kit (FTK) or EnCase, and only then wipe and reimage the systems. This will preserve evidence from the attack that can be used in court, and also for further investigation of the incident and lessons learned.
– • Long-term containment—applying temporarily fixes to make it possible to bring production systems back up. The primary focus is removing accounts or backdoors left by attackers on the systems, and addressing the root cause—for example, fixing a broken authentication mechanism or patching a vulnerability that led to the attack.
CYBER INCIDENT RESPONSE PLAN
25 Step Action Responsibility
2 Complete a full system shutdown Operations Chief
3 [Add Containment Action] [Add Position]
4 [Add Containment Action] [Add Position]
5 [Add Containment Action] [Add Position]
6 [Add Containment Action] [Add Position]
7 [Add Containment Action] [Add Position]
8 [Add Containment Action] [Add Position]
9 [Add Containment Action] [Add Position]
10 [Add Containment Action] [Add Position]
CYBER INCIDENT RESPONSE PLAN
26 ERADICATION
The Eradication process must include measures to not only remove the infection from the primary device, but various methods to scan every device on the affected network segment to ensure the relevant risk is addressed. This step should only take place after all external and internal actions are completed. There are two important aspects of Eradication: Cleanup and Notification. Cleanup typically consists of running antivirus software, uninstalling the infected software, rebuilding the OS, or replacing the entire hard drive and reconstructing the network. Table 31 identifies several important considerations that should guide eradication procedures, as well as who is responsible for addressing each.
Table 31: Eradication Considerations Checklist
Eradication Consideration Responsibility
Have infected systems been hardened with new patches or updates?
[Identify who in your organization should
address the consideration]
Do any systems or applications need to be reconfigured? [Identify who in your organization should address the consideration]
Have all possible entry points been reviewed and closed up? [Identify who in your organization should address the consideration]
Have all processes to eradicate the threat(s) been covered? [Identify who in your organization should address the consideration]
Are any additional defenses needed to support the eradication of the threat(s)?
[Identify who in your organization should
address the consideration]
Has all malicious activity been eradicated from affected systems?
[Identify who in your organization should
address the consideration]
Once that is complete, notification will be sent to relevant members of the IRT and others in the organization to alert them that the source of the incident has been removed. Table 32 identifies who must be notified, as well as the individuals responsible for providing the notification and the method though which the notification will be provided. All executive-level officials should be included in this list.
Table 32: Notification Requirements Following Removal of Incident Cause Individual Requiring Notification Individual Providing Notification Method of Notification IT Service Manager Managed Service Support Email
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
– Development Guidance: The goal of this phase is to find and eliminate the root cause of the breach. Eradication is intended to actually remove malware or other artifacts introduced by the attacks, and fully restore all affected systems. Once an incident is detected, analyzed, and contained, your organization can determine how to effectively and safely remove the source of the incident from the computing device and ensure another node in the network is not affected in the future.
CYBER INCIDENT RESPONSE PLAN
27 Individual Requiring Notification Individual Providing Notification Method of Notification [Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add an organization chart below to depict the call chain that will be required to notify all members of the IRT of an incident]
Incident Response Team Roles and Responsibilities
Table 33 lists the actions required by the IRT during the Eradication phase of cyber incident response, including the position(s) responsible for performing the action. The list suggests a recommended order.
In an actual disaster, some tasks may be performed before this list suggests they be performed.
Individual Who
First Detects an
Incident
Individual A
Individual A.1
Individual B
Individual B.1
Individual C
Individual C.1
– Development Guidance: The organization chart above should be replaced with one from your organization.
– Best Practice: SANS describes key components of Eradication—which you may want to incorporate into the roles and responsibilities table below—as follows:
– • Reimaging—complete wipe and re-image of affected system hard drives to ensure any malicious content is removed.
– • Preventing the root cause—understanding what caused the incident preventing future compromise, for example by patching a vulnerability exploited by the attacker. – • Applying basic security best practices—for example, upgrading old software versions and disabling unused services.
– • Scan for malware—use anti-malware software, or Next-Generation Antivirus (NGAV) if available, to scan affected systems and ensure all malicious content is removed.
CYBER INCIDENT RESPONSE PLAN
28 Table 33: Eradication Roles and Responsibilities
Step Action Responsibility
1 Identify and prioritize vulnerabilities for mitigation Operations Chief 2 Remove malware, inappropriate materials, and other components Database SMEs 3 [Add Eradication Action] [Add Position]
4 [Add Eradication Action] [Add Position]
5 [Add Eradication Action] [Add Position]
6 [Add Eradication Action] [Add Position]
7 [Add Eradication Action] [Add Position]
8 [Add Eradication Action] [Add Position]
9 [Add Eradication Action] [Add Position]
10 [Add Eradication Action] [Add Position]
CYBER INCIDENT RESPONSE PLAN
29 RECOVERY
As a result of the ever-increasing reliance on technology, [Add Organization Name] has developed a comprehensive Technology Recovery Plan (TRP) to re-establish services quickly and completely following a disaster. The TRP should be activated immediately after a disaster strikes to enable the efficient recovery of critical systems and help the organization avoid further damage to mission-critical operations.
Data Recovery
The key to an effective data recovery strategy begins with a well planned and executed backup strategy. A back-up strategy may vary from company to company based on the data type, location, sensitivity, availability requirements, and / or data owners. Other variables may come into play such as location of the backup media or the Statement of Work (SOW) with an external data recovery vendor.
Refer to [Add Organization Name]’s TRP for a detailed overview of the actions required for data recovery.
Service Recovery
The organization’s reliance on third-party services during normal operations means that those entities will also play an important role during technology recovery after an incident. Refer to [Add Organization Name]’s TRP for a detailed overview of the actions required for service recovery.
Site Recovery
The actions required for site recovery are based upon what type of recovery site is defined in the BCP (e.g., cold site, warm site, or hot site). Refer to [Add Organization Name]’s Continuity of Operations (COOP) or TRP for a detailed overview of the actions required for site recovery.
– Development Guidance: Today’s technological and business environments are dynamic and utilize multiple platforms for information management. This phase of the incident response lifecycle includes your organization’s plans for data recovery, service recovery, and site recovery. Much of this information should be captured in your organization’s Technology Recovery Plan (TRP) or Continuity of Operations (COOP) Plan. These plans are vital to recovering from a cyber incident and resume normal operations. – You can reference those plans below rather than duplicating the same information here.
This will help avoid inconsistency between the plans that can arise if content that is quoted in one plan, is updated in another.
CYBER INCIDENT RESPONSE PLAN
30 POST-INCIDENT ACTIVITY
Following an incident, [Add Organization’s Name] should perform lessons learned activities, with the purpose of improving security measures and the incident handling processes, determining the root cause a cyber incident, and identifying recommendations and any shortfalls identified during the incident response process.
Lessons Learned
Learning and Improving
[Add Organization Name]’s IRT will hold lessons learned meetings with all involved parties after a major incident, and periodically after lesser incidents (as resources permit) to improve security measures and incident handling processes. Questions to be answered in these meetings include:
How well did staff and management perform? Were documented procedures followed? Were procedures adequate?
What information was needed sooner?
Were any steps or actions taken that might have inhibited the recovery? What would staff and management do differently the next time a similar incident occurs? How could information sharing with other organizations have been improved? What corrective actions can prevent similar incidents in the future? What precursors or indicators will be watched for in the future to detect similar incidents? What additional tools or resources are needed to detect, analyze, and mitigate future incidents? [Add any additional relevant questions]
[Add Position or Name] will lead the lessons learned meeting following an incident. Table 34 describes how soon these lessons learned meeting will occur after a major incident, and how frequently they will occur for lesser incidents.
– Development Guidance: This section will describe the lessons learned activities that the organization will conduct following an incident as well as the process to collect recommendations.
– Best Practice: Based on available resources, your organization can customize the contents of this chapter to reflect the amount and type of post-incident assessment and reporting that you would like to complete. It may be possible to combine several products/assessments described below into a single, comprehensive reporting product.
CYBER INCIDENT RESPONSE PLAN
31 Table 34: Frequency of Lessons Learned Assessments Type of Incident Timeline for Lessons Learned Assessment Major Incident Initiate lessons learned process within [Add Timeline] of incident.
Lesser Incidents Conduct a lessons learned process for any lesser incidents that have occurred every [Add Frequency].
After these lessons learned meetings, the organization will use the identified lessons learned to:
[Add a description of any lessons learned products (e.g., trainings, best practice presentations, guidance material) that you would like your IRT to develop based on the key takeaways from the lessons learned meetings].
Table 35 describes the lessons learned products that [Add Individual or Position(s) Name] will develop and provides a timeline for development of these product. Table 35: Lessons Learned Product Development
Product Description Timeline for Development
Incident Response Training
Training will detail strengths, previously
identified areas for improvement, and
best practices for incident response
Within 90 Days of Incident
Resolution
[Add Product Name] [Add Description of Product] [Add Timeline] [Add Product Name] [Add Description of Product] [Add Timeline] Root Cause Analysis
A root cause is a fundamental, underlying, system-related reason why an incident occurred that identifies one or more correctable system failures. By conducting a root cause analysis following a cyber incident and addressing root causes, [Add Organization Name] may be able to substantially or completely prevent the same or a similar incident from recurring. [Add Individual or Position] will lead the root cause analysis and will lead the review of logs, forms, report, and other incident documentation to focus on relevant assessment objective, including:
Identifying recorded precursors and indicators;
Determining if the incident caused damage before it was detected; Determining if the actual cause of the incident was identified; Determining if the incident is a recurrence of a previous incident; Identifying measures, if any, that could have prevented the incident; and [Add any additional areas for analysis]
Following the root cause analysis, [Add Position or Name] will oversee the documentation of the results for future reference and to guide continuous improvement. These results will take the form of a [Add a description of how your organization will capture and disseminate the results of the root cause analysis (e.g., a report or presentation) along with a description of who is responsible for development and the desired timeframes]
CYBER INCIDENT RESPONSE PLAN
32 Recommendations
In addition to the lessons learned guidance materials and job aides described above, [Add Organization Name] will compose an after-action report based on the lessons learned and any shortfalls identified during the incident response process. This report will also detail how the organization will use the information to update the CIRP, retrain the IRT as necessary, and share information with cybersecurity partners for them to use as lessons learned.
This after-action report will include specific recommendations that should be made to improve the organization’s incident response processes. Each recommendation will clearly capture when the recommendation was made, a target date for implementing the recommendation, and the individual(s) responsible for implementing the recommendation. This after-action report should be completed within [Add Timeframe] of the resolution of the incident. Strongly consider sharing these lessonslearned so that others can further protect themselves.
– Development Guidance: If your organization chooses to complete the root cause analysis as part of the lessons learned products described above, you can delete this section from your plan and describe how the root cause analysis will fit into the lessons learned process above.
– Best Practice: In addition to identifying strengths, areas for improvement, and recommendations, this after-action report can also be used to house other information about the incident response for future reference. For example, it may include a formal event chronology (including time-stamped information from systems), a monetary estimate of the amount of damage the incident caused, and other information for the record.
CYBER INCIDENT RESPONSE PLAN
33 PLAN AND DEVELOPMENT MAINTENANCE
The CIRP will be updated [Describe Update Frequency], or any time a major system update or upgrade is performed. [Add Individual or Position Name] will be responsible for updating the plan, and so is permitted to request information and updates from other employees and departments within the organization in order to complete this task.
Maintenance of the CIRP will include (but is not limited to) the following:
Ensuring that all team lists are complete and up to date; Making any required updates to directions and guidance to reflect changes in [Add Organization Name]’s organization, policies, personnel, priorities, and IT systems and equipment; Ensuring that the plan is compliant with all requirements specified in new laws or regulations. [Add any actions or key considerations that your organization would like to include in the plan maintenance process]
During the maintenance periods, all changes to the Incident Response Teams will be accounted for. If any member of an Incident Response Team is no longer an employee of the organization. it is the responsibility of the [Position] to appoint a new team member. [Add any additional information about the process your organization will use to review and update the plan]
– Best Practice: In order to maintain operational relevancy, the CIRP should be updated regularly. Ideally, the plan will be updated annually, though this is dependent on organization resources.
– Best Practice: You may want to describe the specific coordination processes that your organization will use to review the plan, identify gaps or required changes, update the plan, and receive approval from leadership.
CYBER INCIDENT RESPONSE PLAN
34 ANNEX A: GLOSSARY AND ACRONYMS
Glossary
Authentication: security measure designed to establish the validity of a transmission, message, or originator, or the identity confirmation process used to determine an individual’s authorization to access data or computer resources.
Availability: assurance that the systems responsible for delivering, storing, and processing information are accessible when needed by those who need them.
Breach: an impermissible use or disclosure by an unauthorized person or for an unauthorized purpose that compromises the security or privacy of Confidential Information such that the use or disclosure poses a significant risk of reputational harm, theft of financial information, identity theft, or medical identity theft.
Confidentiality: assurance that information is not disclosed to system users, processes, and devices unless they have been authorized to access the information.
Containment: the process of preventing the expansion of any harmful consequences arising from an Incident.
Data: information in an oral, written, or electronic format that allows it to be retrieved or transmitted.
Eradication: the removal of a threat or damage to an information security system.
Event: an observable occurrence in a network or system or of confidential information.
Forensics: the practice of gathering, retaining, and analyzing information for investigative purposes in a manner that maintains the integrity of the information.
Hardware: the physical technology used to process, manage, store, transmit, receive, or deliver information. The term does not include software. Examples include laptops, desktops, tablets, smartphones, thumb drives, mobile storage devices, CD-ROMs, and access control devices.
Incident: an attempted or successful unauthorized access, use, disclosure, exposure, modification, destruction, release, theft, or loss of sensitive, protected, or confidential information or interference with systems operations in an information system.
Incident Response Team (IRT): led by the Incident Response Lead, the core team composed of subjectmatter experts and information privacy and security staff that aids in protecting the privacy and security of information that is confidential by law and provides a central resource for an immediate, effective, and orderly response to Incidents at all levels of escalation.
Information Security: the administrative, physical, and technical protection and safeguarding of data (and the individual elements that comprise the data).
Integrity: assurance that the data are authentic, accurate, and complete and can be relied upon to be sufficiently accurate for their purpose.
Malware: a generic term for a number of different types of malicious code.
CYBER INCIDENT RESPONSE PLAN
35 Protected Health Information (PHI): information subject to HIPAA: Individually identifiable health information in any form that is created or received by a HIPAA Covered Entity, and relates to the individual’s healthcare condition, provision of healthcare, or payment for the provision of healthcare as further described and defined in the HIPAA Privacy Regulations.
Personal Identifying Information (PII): Under California Civil Code4 §1798.80 81 "Personal information" means any information that identifies, relates to, describes or is capable of being associated with a particular individual, including, but not limited to:
name, address, social security number, date of birth; government-issued identification number; driver’s license; state ID card; mother’s maiden name; signature, medical information; insurance information; unique biometric data, including the individual’s fingerprint, voice print, and retina or iris image;
unique electronic identification number, address, or routing code; banking information; credit card / debit card information, education, employment (current and/or history).
Recovery: process of recreating files which have disappeared or become corrupted from backup copies.
Sensitive Data: while not necessarily protected by law from use or disclosure, data that is deemed to require some level of protection as determined by an individual agency’s standards and risk management decisions. Some examples of “Sensitive Data” include but are not limited to:
Operational information
Personnel records
Information security procedures
Internal communications
Information determined to be authorized for use or disclosure only on a “need-to-know” basis Threat: any circumstance or event with the potential to adversely impact an information system through the unauthorized access, destruction, disclosure, modification of data and/or denial of service.
Vulnerability: weakness in an information system, system security procedures, internal controls, or implementation that could be exploited.
CYBER INCIDENT RESPONSE PLAN
36 Acronyms
Refer to Table 36 for definitions of all acronyms used in this plan. Table 36: Acronym List
Acronym Definition
BES Bulk Electrical Systems
CCIU Cyber Crimes Investigation Unit
CDT California Department of Technology
CHP California Highway Patrol
CIO Chief Information Officer
CIP Critical Infrastructure Protection Teams
CIRP Cyber Incident Response Plan
CISA Cybersecurity and Infrastructure Security Agency
CISO Chief Information Security Officer
CIOCC CISA Integrated Operations Coordination Center
COOP Continuity of Operations Plan
CTO Chief Technology Officer
ECS Environmental Control Systems
FBI Federal Bureau of Investigations
FERC Federal Energy Regulatory Commission
HIPAA Health Insurance Portability and Accountability Act of 1993 ICS Industrial Control Systems
IDS Intrusion Detection System
IPS Intrusion Prevention System
IRT Incident Response Team
ISP Internet Service Providers
IT Information Technology
MOA Memorandum of Agreement
MOU Memorandum of Agreement
NCATS National Cybersecurity Assessments and Technical Services
NERC North American Electric Reliability Corporation
CYBER INCIDENT RESPONSE PLAN
37 Acronym Definition
NIST National Institute of Standards and Technology
OS Operating System
PCII Protected Critical Infrastructure Information
PHI Protected Health Information
PII Personally Identifiable Information
PPD Presidential Policy Directive
SANS System Administration, Audit, Network, and Security SIEM Security Information and Event Management
SLA Service Level Agreement
SOW Statement of Work
TRP Technology Recovery Plan
UASI Urban Areas Security Initiative Program
CYBER INCIDENT RESPONSE PLAN
38 ANNEX B: MEMORANDUM OF AGREEMENT
Memorandum of Agreement (MOA) between [Add Providing Agency/Jurisdiction] and [Add Requesting Jurisdiction].
WHEREAS, on this event and associated conditions will collectively be referred to as [Add Name of Incident]; and
WHEREAS, on [Add Date], this declared emergency event consists of [List Type of Incident]; and WHEREAS, the following extreme conditions exist: [Briefly describe the incident (e.g., lives threatened, extent of property/infrastructure damaged and/or threatened). List the type of conditions contributing to the disaster such as strong winds and low humidity aiding fires that swept through the region]; and
(If applicable) WHEREAS, on [Add Date] a Presidential Declaration of Emergency (FEMA‐XXXX‐DR) was issued; and
WHEREAS, the Emergency Management Mutual Aid Plan delineates the current state policy concerning Emergency Management Mutual Aid; and
WHEREAS, the Emergency Management Mutual Aid Plan describes the standard procedures used to acquire emergency management mutual aid resources and the method to ensure coordination of emergency management mutual aid planning and readiness; and WHEREAS, the county emergency manager is the Operational Area Emergency Management Mutual Aid Coordinator; and
WHEREAS, Emergency Management Mutual Aid Plan provides, in pertinent part, “When an emergency develops or appears to be developing which cannot be resolved by emergency
– Development Guidance: This template is intended to be your guide for writing an MOU. It is important to note that the sample paragraphs are geared for illustration purposes toward a specific MOU example. Further, each community’s MOU language will need to be modified according to the purpose of the agreement. This document does not address every issue that jurisdictions may face when seeking to establish an MOU. An MOU will be customized to the capability or resource for which it is established and will consider any unique characteristics of the specific community and participating jurisdictions.
CYBER INCIDENT RESPONSE PLAN
39 management resources within an Operational Area, it is the responsibility of the Operational Area Mutual Aid Coordinator to provide assistance and coordination to control the problem;” and WHEREAS, the Emergency Management Mutual Aid Plan provides, in pertinent part, “A request for emergency management mutual aid requires the approval of an authorized official of the requesting jurisdiction;” and
WHEREAS, the (Authorized Official Title) of the County of [Add Requesting Agency/Jurisdiction] requested the mutual aid assistance of [Add Providing Agency/Jurisdiction], pursuant to the Emergency Management Mutual Aid Plan to provide emergency management support in connection with the [Add Name of Incident]; and
WHEREAS, [Add Providing Agency/Jurisdiction], provided emergency management mutual aid consisting of emergency management personnel, equipment, and/or materials from [Add Date Through Date] to assist with emergency management services in connection with the [Add Name of Incident]; and
WHEREAS, [Add Providing Agency/Jurisdiction] agrees to document all of its mutual aid assistance costs related to the [Add Name of Incident] as attachments to this MOA and submit to [Add Requesting Agency/Jurisdiction] as soon as practicable; NOW, THEREFORE, IT IS HEREBY AGREED by and [Add Requesting Agency/Jurisdiction] and [Add Providing Agency/Jurisdiction] that [Add Requesting Agency/Jurisdiction] shall reimburse all reasonable costs associated with [Add Providing Agency/Jurisdiction] emergency management mutual aid assistance during the [Add Name of Incident].
Providing Jurisdiction
Approved: _______________________________ Date ____________ [Name/Title]
Providing Agency
Approved: _______________________________ Date ____________ [Name/Title]
Requesting Agency/Jurisdiction
Approved: _______________________________ Date ____________ [Name/Title]
CYBER INCIDENT RESPONSE PLAN
40 ANNEX C: INCIDENT ANALYSIS WORKSHEET
The Incident Analysis Worksheet is used to document an incident, categorize its impacts, and ultimately calculate its severity. Once the incident is categorized it is prioritized according to its severity level. The appropriate response to an incident is dependent on the severity rating of the incident.
Incident Overview
In order to accurately identify incident impacts, use Table 37 to categorize and description the incident. Table 37: Incident Overview
Incident Type Description of Incident
[Add Incident Type based on categories listed in
Analysis chapter of this plan] [Briefly describe what occurred] Functional Impact
Incidents may affect the confidentiality, integrity, and availability of the [Add Organization Name]’s information. Use Table 38 to classify the incident’s functional impact as None, Low, Medium, or High. Table 38: Functional Impact
Category Definition
None No effect to the organization’s ability to provide all services to all users.
Low Minimal effect; the organization can still provide all critical services to all users but has lost efficiency.
Medium Organization has lost the ability to provide a critical service to a subset of system users.
High Organization is no longer able to provide more than one critical service to any users.
Functional Impact Category: [Add the category relevant to this incident] Information Impact
Use Table 39 to classify the incident’s information impact as None, Privacy Breach, Proprietary Breach, or Integrity Loss.
CYBER INCIDENT RESPONSE PLAN
41 Table 39: Information Impact
Category Definition
None No information was exfiltrated/leaked, disclosed, changed, deleted, accessed, or disclosed by or for unauthorized persons or purposes, or otherwise compromised.
Privacy Breach
Sensitive PII of taxpayers, employees, beneficiaries, etc., was accessed or exfiltrated/leaked, or Protected Health Information (PHI) of individuals was used or disclosed by or for unauthorized persons or purposes, or otherwise compromised.
Proprietary Breach Unclassified proprietary information, such as PCII, was accessed, exfiltrated/leaked, or used or disclosed by or for unauthorized persons or purposes.
Integrity Loss Sensitive or proprietary information was changed or deleted accidentally or intentionally.
Information Impact Category: [Add the category relevant to this incident] Recoverability Impact
The size of the incident and the type of resources it affects will determine the amount of time and resources that must be spent on recovering from that incident. Use Table 40 to classify an incident’s recoverability impact.
Table 40: Recoverability Impact
Category Definition
Regular Time to recovery is predictable with existing resources.
Supplemented Time to recovery is predictable with additional resources.
Extended Time to recovery is unpredictable; additional resources and outside help are needed.
Not Recoverable Recovery from the incident is not possible (e.g., sensitive data exfiltrated/leaked and posted publicly); launch investigation.
Recoverability Impact Category: [Add the category relevant to this incident] Overall Impact Severity
By adding the scores in Table 41 from the following evaluation criteria, a severity rating is established:
Table 41: Incident Severity Scoring
Action Score
Potential number of affected parties: How much productivity is impacted by this incident? Less than 1% of systems; less than 1% of workforce 1
More than 1%, but less than 10% of systems; more than 1% but less than 10% of workforce 2
More than 10% of systems; more than 10% of workforce 3
– Development Guidance: Certain types of data, due to regulatory and/or legal definitions are always classified as ‘High’. One example would be HIPAA covered Electronic Protected Health Information
CYBER INCIDENT RESPONSE PLAN
42 Action Score
Probability of widespread escalation: Does this incident have the potential to spread to as yet unaffected systems?
Minimal 1
Moderate 2
High 3
Commonality: Has this occurred in the past; is there experience in mitigating this particular incident? Commonly Seen 1
Occasionally Happens 2
Rare 3
Potential for damage or loss: How expensive is the incident expected to be, both in lost production and in mitigation costs.
Minimal 1
Moderate 2
High 3
Business impact: What is the expected negative impact on the overall health of the enterprise both in shortand long-term contexts? Minimal 1
Moderate 2
High 3
Once the analyses described above are complete, it is possible to prioritize the incident according to its severity level. The appropriate response to an incident is dependent on the severity rating of the incident. Table 42 describes the four levels of severity and identifies the timelines for initial action for incidents at each severity level.
Table 42: Impact Severity
Priority Guideline Score Initial Action
Severe: Extreme impact on enterprise 13-15 Immediately
High: Loss of a major service 11-12 Immediately
Medium: Some impact some portion of
enterprise 8-10 Within 4 hours
Low: Minor impact on a small portion of
enterprise 5-7 Within 24 hours
Incident Severity Score: [Add Incident Severity Score
CYBER INCIDENT RESPONSE PLAN
43 ANNEX D: INCIDENT RESPONSE CHECKLIST
Table 43 section presents a sequential list of tasks that [Add Organization Name] will perform during the seven steps of incident response. The list suggests a recommended order. In an actual disaster, some tasks may be performed before this list suggests they be performed. Table 43: Incident Response Checklist
Step Action Responsibility Completed
1 Detection
1.1 Report signs of a security incident to the CISO Database Group Supervisor ☐
1.2 Performs an initial assessment to determine source
of cyber threat Lead Investigator ☐
1.3 [Add Actions] [Add Position/Individual] ☐
2 Analysis
2.1 Begin steps for evidence preservation and
containment Lead Investigator ☐
2.2 Perform detailed impact analysis to properly prioritize additional response activities that may be required
Network Subject-Matter
Experts (SMEs) ☐
2.3 [Add Actions] [Add Position/Individual] ☐
3 Containment
3.1 Document evidence from the incident Lead Investigator ☐
3.2 Complete a full system shutdown Operations Chief ☐
3.3 [Add Actions] [Add Position/Individual] ☐
– Development Guidance: The checklist captures key, high-level actions that commonly occur during incident response. Based on your organization’s resources, staff, standard operating procedures, priorities, and other factors, you should modify the checklist to reflect the actions you anticipate being required to response to a cyber incident. – In the “Responsibility” column, you do not need to list the names of every individual that is responsible for performing each action. Including the name of the relevant team, office, or entity is sufficient. If a single individual is responsible, consider including either the position name or the position name and the individual’s name. Including only the name of the individual responsible can make implementation of the plan more challenging or confusing if that individual is no longer with the organization when this plan is used during an incident.
The roles and responsibilities you fill-out in each phase of the incident response lifecycle should also be included here.
– Best Practice: The table below reflects only Detection, Analysis, Containment, and Eradication. Preparation and Post-Incident are left out, as they do not have specific actions that must be performed in a particular order under time sensitive conditions. Recovery is left out as recovery actions are captured in the TRP.
CYBER INCIDENT RESPONSE PLAN
44 Step Action Responsibility Completed
4 Eradication
4.1 Identify and prioritize vulnerabilities for mitigation Operations Chief ☐
4.2 Remove malware, inappropriate materials, and other
components Database SMEs ☐
4.4 [Add Actions] [Add Position/Individual] ☐
Disaster Debris Management Plan
2025
Prepared by: In collaboration with:
Attachment IV
Disaster Debris Management Plan December 2025
i
TABLE OF CONTENTS
TABLE OF CONTENTS ............................................................................................................. I
1.0 INTRODUCTION AND OVERVIEW ................................................................................ 4
2.0 METHODOLOGY ............................................................................................................ 7
2.1 PLANNING ASSUMPTIONS ........................................................................................ 7
2.2 DEBRIS MANAGEMENT STRATEGIES ...................................................................... 7
2.3 PLAN MAINTENANCE ................................................................................................ 8
3.0 GUIDANCE DOCUMENTS AND REGULATORY REQUIREMENTS .............................. 9
3.1 SEMS .......................................................................................................................... 9
3.2 NIMS............................................................................................................................ 9
3.3 CALIFORNIA DISASTER RECOVERY FRAMEWORK ............................................... 9
3.4 ALAMEDA COUNTY EMERGENCY OPERATIONS PLAN .......................................... 9
3.5 HAYWARD EMERGENCY MANAGEMENT PLAN .....................................................10
4.0 ROLES AND RESPONSIBILITIES ................................................................................11
4.1 CITY ROLES ..............................................................................................................11
4.2 OPERATIONAL AREA ................................................................................................14
4.3 STATE ROLES ...........................................................................................................15
4.4 FEDERAL ROLES ......................................................................................................16
4.5 PRIVATE BUSINESS/COMMERCIAL SECTOR .........................................................16
4.6 NON-PROFIT SECTOR ..............................................................................................18
5.0 DEBRIS MANAGEMENT OPERATIONS .......................................................................19
5.1 MATERIALS AND DEBRIS STREAMS .......................................................................19
5.2 DEBRIS QUANTITIES ................................................................................................20
5.3 DEBRIS MANAGEMENT PROCEDURES ..................................................................21
5.4 DEBRIS COLLECTION AND DISPOSITION ...............................................................23
5.5 TEMPORARY DEBRIS MANAGEMENT SITES .........................................................23
5.6 TRANSPORTATION ...................................................................................................24
5.7 MONITORING OF DEBRIS OPERATIONS ................................................................25
6.0 SPECIAL DEBRIS PROGRAMS ....................................................................................27
6.1 PRIVATE PROPERTY DEBRIS REMOVAL................................................................27
6.2 HAZARDOUS TREES ................................................................................................27 Disaster Debris Management Plan December 2025
ii
7.0 DEBRIS WASTE CHARACTERIZATION ......................................................................29
8.0 FINANCE AND ACCOUNTING ......................................................................................30
8.1 COST TRACKING AND REPORTING ........................................................................30
8.2 FUNDING SOURCES FOR DISASTER DEBRIS OPERATIONS ................................31
8.3 PROCUREMENT REQUIREMENTS ..........................................................................32
9.0 COMMUNITY OUTREACH ............................................................................................33
10.0 TRAINING ..................................................................................................................34
10.1 TRAINING ...............................................................................................................34
10.2 EXERCISES ............................................................................................................35
11.0 AUTHORITIES AND REFERENCES ..........................................................................36 APPENDIX A – DEBRIS ESTIMATION (HAZUS) ....................................................................39 APPENDIX B – TEMPORARY DEBRIS MANAGEMENT SITE (TDMS) CONSIDERATIONS .41 APPENDIX C – CALEPA DEBRIS REMOVAL GUIDANCE .....................................................44 APPENDIX D – PUBLIC INFORMATION HEALTH AND SAFETY CONSIDERATIONS .........52 Disaster Debris Management Plan December 2025
iii
ACRONYMS AND ABBREVIATIONS
ACM asbestos-containing materials
CalEPA California Environmental Protection Agency
CalOES California Governor’s Office of Emergency Services C&D construction and demolition material
CDAA California Disaster Assistance Act
CY cubic yards
DDMP Disaster Debris Management Plan
EMP Emergency Management Plan
EOC Emergency Operations Center
FEMA Federal Emergency Management Plan
HAZMAT hazardous materials
HFD Hayward Fire Department
HHW household hazardous waste
LRP Local Resilience Plan
NGO Non-governmental organization
NIMS National Incident Management System (NIMS)
NRF National Response Framework
OA Operational Area
RCRA Resource Conservation and Recovery Act
SEMS Standardized Emergency Management System
TDMS Temporary Debris Management Sites
USACE U.S. Army Corps of Engineers
USEPA U.S. Environmental Protection Agency
Disaster Debris Management Plan December 2025
4 1.0 INTRODUCTION AND OVERVIEW
The City of Hayward (the “City”), located within the Greater San Francisco Bay area, features rolling hills and a beautiful shoreline. Like all communities, the City also has predictable vulnerability to disasters. A recent update to the City’s Local Resilience Plan (LRP) describes this vulnerability and places high priority on emergency management planning. Recognizing that debris removal operations have accounted for approximately 27 percent of nationwide disaster recovery costs in recent years, the City has developed this Disaster Debris Management Plan (DDMP).
This DDMP provides the City’s guidelines for conducting the clean-up, removal, transport, reduction, and final disposal of disaster-generated debris in compliance with environmental requirements and cost recovery procedures. Most disaster debris management activities are implemented at the local level. This DDMP presents methods by which disaster debris management can be coordinated citywide. The purpose of the Hayward DDMP is to develop a coordinated approach for managing disaster-related debris generated in Hayward.
All communities can benefit from the lessons learned in other local jurisdictions and apply the state and federal standards that have been developed from those lessons learned through planning and preparing. By planning ahead, disaster-related waste can be managed in a manner that protects the environment, maximizing recycling options and minimizing landfilling of debris.
In the United States, the Federal Emergency Management (FEMA) National Preparedness Goal, and the National Response Framework (NRF) establish mission areas and a set of core capabilities that recognize and standardize what must be achieved during disasters to save lives, protect property and the environment, and preserve the social, economic, cultural, and political structure of impacted communities. This DDMP focuses on disaster debris management operations in support of the response and recovery mission areas and their associated core capabilities (Figure 1).
There are two major phases to debris operations – the initial response phase and the recovery phase. The response phase occurs during and immediately after an event. The recovery phase includes clearing emergency access routes and the major debris removal and disposal operations. It involves moving debris to temporary storage sites for volume reduction, or to landfills for permanent disposal. The DDMP addresses how response to and recovery from a debris-generating incident will be coordinated at the local level. The DDMP conforms to the State of California’s Standardized Emergency Management System (SEMS) and current U.S. Environmental Protection Agency (EPA) guidance.
Disaster Debris Management Plan December 2025
5 Figure 1: NRF Mission Areas, Core Capabilities
(source: FEMA, 2023)
The DDMP is a management document intended to be read and understood before an emergency occurs. The content herein outlines the potential activities of all City Departments to conduct disaster debris management operations in alignment with state and federal statutes, regulations, and policies at the time of plan development.
This DDMP is divided into the following sections:
Section 2 – Methodology. This section describes the process through which the DDMP was developed and will be updated.
Section 3 – Guidance Documents and Regulatory Requirements. Section 3 lists the guidance documents that provide the framework for the DDMP. Section 4 – Roles and Responsibilities. This section describes the roles, responsibilities, and actions that local, state, and federal agencies, and other organizations will fulfill to perform or support debris management operations.
Section 5 – Debris Management Procedures, including debris streams and materials, estimating quantities, recovery operations, and transportation. Section 5 also covers establishment of temporary or long-term sites for debris storage. Section 6 – Special Debris Programs describes private property debris removal and the removal of hazardous trees, which may be required following some disasters. Section 7 – Debris Waste Characterization discusses debris waste sampling and analysis that would be required to properly characterize debris for appropriate reuse or disposal.
Section 8 – Finance and Accounting. This section identifies the basic accounting and recordkeeping requirements needed to qualify for reimbursement by state or federal emergency funds for disaster debris diversion.
Disaster Debris Management Plan December 2025
6 Section 9 – Community Outreach. This section outlines the plan for developing a City education and public information program regarding disaster debris management. Section 10 – Plan Maintenance and Training. The needs for plan updates, and predisaster training for the debris management team are discussed in this section.
Sources utilized in preparation of this DDMP are provided in the list of references (Section 11).
Disaster Debris Management Plan December 2025
7 2.0 METHODOLOGY
This DDMP was prepared in conjunction with the update of the City’s Emergency Management Plan. The DDMP was developed using a comprehensive engagement and subject matter expert consultation strategy to develop content to ensure accuracy and applicability. The Hayward Fire Department (HFD) acted as the lead agency in developing the DDMP through collaboration between Ganey Science (consultant) and representatives from City Fire Rescue, Public Works and Maintenance Services. This strategy included meetings among HFD, its consultant, and key stakeholders from other City Departments. Feedback from this team guided the framework of the plan. The resulting information, refined with extensive research of state and federal regulations, policies, and plans, resulted in the procedures outlined in this plan.
2.1 PLANNING ASSUMPTIONS
Planning assumptions for debris management take into consideration the following ideas:
A substantial volume of debris will be generated by a disaster impacting the City. Initial emergency response will require debris clearance coordination with a focus on critical transportation corridors and nodes.
Critical infrastructure damage assessment and restoration will depend on a prioritized debris clearance approach.
A significant incident will also impact surrounding jurisdictions; competition for resources with other jurisdictions will impact debris management capabilities. Estimation of likely debris volumes. Appendix A provides debris estimates and resource requirements for high probability/vulnerability incident types. Temporary Debris Management Sites (TDMS) will need to be established in accordance with applicable environmental protection regulations. These, and other TDMS considerations are described in Appendix B.
Disasters result in large expenditures for labor, equipment, materials, and supplies. Federal disaster assistance. Federal disaster assistance (FEMA Public Assistance) will require the City to identify and report damages to FEMA within the 60-day regulatory timeframe.
California Environmental Protection Agency (CalEPA) Guidance for Conducting Emergency Debris, Waste and Hazardous Material Removal Actions Pursuant to a State and Local Emergency Proclamation is provided in Appendix C.
2.2 DEBRIS MANAGEMENT STRATEGIES
Debris management strategies generally align with those in the Alameda County Operational Area and include the following:
The quantity of disaster-related debris that is diverted and disposed of will be measured and recorded;
The repair of damaged structures is preferred over demolition; and Disaster Debris Management Plan December 2025
8 For the replacement of an existing structure damaged in a disaster, the use of disaster debris will be promoted for its reconstruction.
2.3 PLAN MAINTENANCE
For this Plan to maintain viability, the document will be updated regularly, and personnel should be trained on the content prior to a disaster. FEMA updates debris operations program guidance throughout the year based on lessons learned from recent disasters. It is important for this plan to include the most current program guidance.
The City will facilitate an annual review of their DDMP with the debris planning team. The plans will be updated based on organizational changes, new policies and guidance, and lessons learned from actual debris events.
Disaster Debris Management Plan December 2025
9 3.0 GUIDANCE DOCUMENTS AND REGULATORY REQUIREMENTS
3.1 SEMS
The SEMS is California’s emergency response system. It began in 1993, in response to the state’s frequent hazard threats. The National Incident Management System (NIMS) mirrors SEMS for use nationwide. The objective of SEMS is to improve the coordination of state and local emergency response. All local governments must use SEMS in multijurisdictional or multiagency emergency responses to be eligible for state reimbursement of response-related personnel costs. Section 3 describes roles and responsibilities for disaster debris management by the City, Operational Area, State, Federal government, the private sector and non-profit sector within the SEMS structure.
3.2 NIMS
NIMS guides all levels of government, non-governmental organizations (NGOs), and the private sector to work together to prevent, protect against, mitigate, respond to, and recover from incidents. This system provides disaster response and recovery teams nationwide with shared vocabulary systems and processes to guide operations.
3.3 CALIFORNIA DISASTER RECOVERY FRAMEWORK
The California Disaster Recovery Framework establishes the overall disaster recovery strategy for the State of California. This framework guides how state entities organize, operate, and utilize existing resources to promote effective recovery to support local government. It also provides an overarching framework to assist local and tribal governments, the private sector, NGOs, and other emergency managers to plan for and execute disaster recovery operations in California. The CDRF is also a resource for how to access anticipated state and federal disaster assistance programs following ad disaster.
3.4 ALAMEDA COUNTY EMERGENCY OPERATIONS PLAN
The Alameda County Emergency Operations Plan provides an overview of the jurisdiction’s approach to emergency operations. It identifies emergency response policies, describes the response and recovery organization, and assigns specific roles and responsibilities to County departments, agencies, and community partners. The Plan has the flexibility to be used for all emergencies and is intended to facilitate response and recovery activities efficiently and effectively. This Plan is also a reference for managers from other local governments in the Operational Area, including Hayward.
Disaster Debris Management Plan December 2025
10 3.5 HAYWARD EMERGENCY MANAGEMENT PLAN
This DDMP is a part of the City’s Emergency Management Plan (EMP), and the authorities, policies and procedures described in the latest version of the EMP apply to debris management, too.
Disaster Debris Management Plan December 2025
11 4.0 ROLES AND RESPONSIBILITIES
Disaster recovery efforts begin at the local level at the City of Hayward and the leadership roles for disaster debris management and functional area leads for recovery tasks are listed in this section. Disasters of higher magnitude may require supplemental state or federal assistance.
This section describes the relevant responsibilities of applicable government agencies, as well as the roles of the private sector, NGOs, and local residents.
4.1 CITY ROLES
NIMS identifies four standardized positions to be designated with authority and responsibility for disaster debris planning and operations. The City adopts the use of the following positions as described below and shown in Table 11.
Debris Operations Officer NIMS ID 7-509-1347
Activates the DDMP and oversees the following matters related to debris removal:
Quantities and types of equipment necessary;
Temporary debris collection sites;
Methods for tracking debris types and quantities;
Methods for tracking force account and related costs; Final debris disposal;
Relevant public information; and
Reimbursement.
Debris Planning Officer NIMS ID 7-509-1348
The Debris Planning Officer establishes the DDMP, which includes:
Quantities and types of equipment necessary;
Temporary debris collection sites;
Methods for tracking debris types and quantities;
Methods for tracking force account and related costs; Final debris disposal;
Relevant public information;
Reimbursement; and
Debris forecasting.
Debris Supervisor NIMS ID 7-509-1098
Coordinates the routing of equipment, personnel and other resources involved in debris removal;
Collects and maintains appropriate field documentation; Ensures that equipment operators/haulers complete debris clearance, removal and disposal in accordance with applicable regulations and requirements; Disaster Debris Management Plan December 2025
12 Schedules and deploys debris monitors; and
Reports debris field/monitoring progress and issues to the Debris Operations Officer.
Debris Technical Specialist NIMS ID 7-509-1460
Evaluates types and quantities of disaster-generated debris; Provides an estimate of debris types and quantities;
Supports the Authority Having Jurisdiction’s (AHJ) debris removal operation in the field; and
The following personnel are the current officials in these roles and should be notified in the case of an incident:
Table 1. Hayward Debris Operations Officials
Position Primary Contact Secondary Contact Tertiary Contact Debris Operations
Officer
Jeff Krump
908-506-8268
Erik Pierson
510-299-5490
Rod Affonso
510-677-0428
Debris Planning
Officer
Rich Nield
510-385-1068
John Sanders
510-681-9592
Dave Jackson
510-385-1070
Debris Supervisor Randy Nunes
209-834-7152
Mike Stotts
510-882-4928 (work)
510-909-4242
(personal)
J.C. Oliva
415-513-926*
Debris Technical
Specialist
Brian Figuroa
510-381-3097
Andrew Tapia
510-468-7337
Armondo Quintaro
510-690-3964
The City also assigns responsibility to the following Departments/functional areas in support of the DDMP:
Public Works Department
Serves as the Debris Operations Officer;
Activates and implements the City’s DDMP;
Conducts damage assessments and estimates debris totals; Oversees debris operations including internal resources and contracted services; Coordinates with local, state, and federal agencies regarding regulatory requirements for debris operations;
Coordinates with the Operational Area (OA), i.e., Alameda County. and other City Departments as needed for debris operations support;
Obtains approval from regulatory agencies for TDMS;
Disaster Debris Management Plan December 2025
13 Provides situational updates on debris operations to the local Emergency Operations Center (EOC);
Maintains documentation for federal disaster assistance for debris operations; Ensures compliance with federal disaster assistance programs for debris removal; and Reviews the DDMP annually.
City Administration
Makes policy-level decisions related to debris operations; and Provides signature authority for legal documents, including mutual aid agreements with neighboring jurisdictions, inter-local agreements, and notices to proceed with contracted service providers.
Emergency Management/Fire Department
Coordinates the preparation, review, and update of the jurisdiction’s DDMP. Provides emergency services at TDMS in the event of a fire.
Finance and Purchasing
Understands current federal disaster assistance program guidance and regulations related to debris operations;
Manages documentation for federal reimbursement for debris operations; Coordinates with public works and purchasing to obtain force account labor, equipment, and overtime documentation related to debris removal operations for potential federal reimbursement;
Audits purchase orders and documents, general ledger entries, cash receipts, and payroll documents related to debris removal operations; Manages and audits contractor invoices for payment;
Provides support to procure goods and services for debris removal operations; Coordinates with finance and administration to ensure disaster debris services are procured following local, state, and federal procurement regulations; Reviews and updates emergency procurement policies as necessary following an emergency;
Assists with the documentation of debris operations for potential federal reimbursement; and
Supports audit and closeout of debris projects.
Code Enforcement
Enforces nuisance abatement codes;
Documents nuisance abatement cases to support private property debris removal; and Maintains awareness of TDMS and operations.
Disaster Debris Management Plan December 2025
14 Planning Department
Provides GIS data to appropriate agencies and vendors for debris removal operations, which may include road lists, data on historical properties, debris estimates, and land ownership.
Establishes debris estimates using U.S. Army Corps of Engineers (USACE) HAZUS software for planning purposes.
Health Services
Determines debris that poses an imminent threat to public health and safety; and Provides documentation regarding health and safety issues to support debris operations. Provides recommendations for health and safety procedures for debris operations; and Coordinates with health services and public works to review solid waste management sites including administration buildings, recycling centers, landfills, and transfer stations for damage, safety, and health issues.
Law Enforcement
Provides security for debris management sites and other debris removal operations when necessary; and
Leads debris operations resulting from a crime scene or terrorism incident.
Legal Services
Reviews debris operations procedures for compliance with applicable local, state, and federal regulations; and
Supports the jurisdiction with regulatory reviews, audits, and appeals regarding disaster assistance for debris operations.
Public Information Officer
Coordinates with public works and emergency management to develop public information messages related to debris operations;
Provides press releases related to debris removal operations, set out procedures and citizen debris drop-off locations; and
Provides timely information regarding debris operations in accessible formats.
4.2 OPERATIONAL AREA
An Operational Area (OA) means an intermediate level of the state emergency services organization, consisting of a county and all political subdivisions within the county area. The OA for Hayward is Alameda County. The OA was established by a January 1995 Agreement for Participation in Alameda County Operational Area Emergency Management Organization. All the cities in the county including Hayward are participants in this Agreement (Alameda County Waste Management Authority, which has the following responsibilities during an emergency:
Disaster Debris Management Plan December 2025
15 Implement OA Emergency Response Plan;
Establish and maintain the Operational Area Emergency Operations Center (EOC); Coordinate the utilization of County, other local government, state and federal resources within the OA; and
Support operations conducted by local governments within the County in accordance with SEMS and approved mutual aid and operations plans.
In alignment with these overarching responsibilities, the OA is also responsible for the following tasks during a catastrophic debris-generating event:
Implement the OA DDMP;
Establish a debris operations task force in the EOC; and Coordinate the utilization of County, other local government, state and federal resources and private sector business enterprise including solid waste facility operators for debris operations within the OA.
Support public entities within the OA to conduct debris operations in accordance with SEMS and approved mutual aid and operations plans.
4.3 STATE ROLES
State agencies provide regulatory guidance and technical assistance for debris operations.
Roles and responsibilities of State agencies involved in debris operations are as follows:
CALIFORNIA ENVIRONMENTAL PROTECTION AGENCY (CALEPA)
• Provide guidance on environmental regulations regarding debris operations. • Provide technical assistance for debris removal of HAZMAT (Department of Toxic Substances Control).
• Provide support and guidance for debris removal operations (CalRecycle) including potential provision of resources.
• Provide approvals for TDMS and emergency waivers of standards such as permitted capacity, throughput and acreage for permitted solid waste facilities (CalRecycle).
CALIFORNIA OFFICE EMERGENCY SERVICES (CALOES)
• Serve as a liaison between state and federal agencies. • Provide industry standards and best practices for debris operations. • Serve as the administrator of disaster grants for debris operations. • Provide guidance on documentation requirements for disaster assistance for debris operations.
Disaster Debris Management Plan December 2025
16 4.4 FEDERAL ROLES
Federal agencies support debris operations by providing disaster assistance funding, regulatory oversight and technical assistance. An overview of the roles and responsibilities of federal agencies involved in debris operations follows:
FEMA
Provide technical assistance for debris operations.
o Environmental and historical preservation review process. o Public assistance grant program reimbursement process. o Procurement assistance.
Make federal mission assignments as requested
o Emergency Support Function #3, Public Works and Engineering o Emergency Support Function #10, Oil and HAZMAT Response Administer the FEMA Public Assistance Program for Category A Debris Removal. o Ensure safety, eligibility, and compliance are maintained.
USACE
Primary federal entity for Emergency Support Function (ESF) #3 - Public Works and Engineering.
Provide debris operations for mission assignments.
Remove sunken vessels from navigable waterways under emergency conditions. Provide strong technical assistance and training support to State and local agencies. Enable state and local operations to the greatest extent possible.
NATURAL RESOURCES CONSERVATION SERVICE
Provide technical assistance for debris removal from natural streams and creeks. Provide funding for debris operations through the Emergency Watershed Protection Program.
FEDERAL HIGHWAY ADMINISTRATION
Support repair and reconstruction of federal aid highways and roads on federal lands. Provide funding for debris operations through the Federal Highway Administration’s Emergency Relief Program.
4.5 PRIVATE BUSINESS/COMMERCIAL SECTOR
Private businesses will have a very large role in managing mass debris operations. The City does not have enough internal resources to conduct debris operations during a widespread event without the use of contracted service providers. The roles and responsibilities of private sector businesses for debris operations is described here.
Disaster Debris Management Plan December 2025
17 WASTE MANAGEMENT (FRANCHISED HAULER)
Collect, transfer, transport, process, and divert organic materials within the City. Collect, transfer, transport, and dispose of solid waste generated within the City. Collect, transport, and transfer recyclable materials generated within the City.
DEBRIS HAULING FIRMS
In the event the scope of debris collection operations is beyond the capabilities of the City, state, and mutual aid resources, it may be necessary to contract for labor and equipment. The City will use its purchasing policies in coordination with federal contracting guidance to establish a contract with one or more debris hauling firms to assist with debris collection and disposal. Responsibilities of a debris hauling firm will include the following:
Clear and remove debris from City roadways and waterways to make them passable immediately following a declared disaster.
Conduct debris removal from the right-of-way.
Decommission, demolish, and dispose of eligible non-regulated asbestos-containing material structures on private property.
Manage and operate TDMS locations.
Conduct debris reduction.
Haul-out reduced materials to a final disposal site.
Remove hazardous leaning trees, hanging limbs and stumps. Remove white goods debris from the right-of-way.
Coordinate the removal of household hazardous waste from the right-of-way. Remove animal carcasses from areas designated by the jurisdiction.
Develop, test, and implement debris operations plans. Take into account worker safety and health and potential employee unavailability or attrition due to a disaster. Educate and train employees to implement debris operations plans. Ensure contracts comply with state and/or federal procurement requirements. Communicate status of operations and supply chains as well as challenges and time lines to local officials.
Research available funding sources and types of funding for debris operations. Know, understand, and comply with state and/or federal regulations for disaster assistance programs.
MONITORING FIRMS
Perform truck certifications.
Perform on-site, street-level debris monitoring at all collection sites to verify debris eligibility based on contract requirements, and initiate debris removal documentation using load tickets.
Conduct disposal monitoring to document the disposal of disaster debris at approved TDMSs and at final disposal or end use locations.
Disaster Debris Management Plan December 2025
18 4.6 NON-PROFIT SECTOR
The City will partner with nonprofit and volunteer organizations to provide assistance to individuals with disabilities and/or access and functional needs. The City will ask that non-profit sector entities coordinate with jurisdictions to ensure their efforts are conducted in coordination with jurisdiction objectives. In addition, the City will coordinate with non-profit sector entities to ensure response efforts are conducted in a safe manner to minimize the risk of injuries in keeping with health and safety policies. These entities will not be asked to conduct tasks that are beyond their member’s training or capabilities. The roles and responsibilities for nonprofit organizations in debris operations are listed below.
• Coordinate with City to identify vulnerable populations and incorporate strategies to assist these populations in local DDMPs.
• Coordinate with City and volunteer organizations post-disaster to assist individuals with disabilities and access and functional needs with debris to the public right-of-way (ROW) collection area.
• Coordinate with City to provide public information regarding debris operations to populations with communication barriers.
• Provide debris services to vulnerable and underserved groups, individuals, and communities as necessary.
RESIDENTS
To coordinate effective debris operations, residents play an important role in maximizing the potential for recycling and reuse of disaster-generated debris. Roles and responsibilities for residents in debris operations include the following:
Follow instructions from local officials on set out procedures for disaster-related debris. Segregate disaster debris from regular household waste. Safely bring debris to the public ROW.
Bring household hazardous waste to citizen drop-off locations. Use caution when operating equipment and dangerous machinery. Help others who may need assistance with debris removal.
Appendix D provides health and safety messages for use by the City Public Information Officer.
Disaster Debris Management Plan December 2025
19 5.0 DEBRIS MANAGEMENT OPERATIONS
Debris management operations includes the steps to plan for, remove, and dispose of disastergenerated debris. This section provides information regarding types of debris materials, collection and disposition.
5.1 MATERIALS AND DEBRIS STREAMS
Various types of disaster-generated debris require distinct removal practices, transportation methods, and final disposal locations to minimize environmental impacts and protect public health and safety. The separation of types of materials in transportation and processing is referred to as debris/waste streams. In classifying waste streams, it must be determined whether a material is waste, reusable, or recyclable. Table 2 shows the various debris types typical to disaster waste streams.
Table 2. Disaster Debris Types
Debris Type Description Disposal Options
Vegetative debris Whole trees, tree stumps,
tree branches, tree trunks,
and other leafy material
Recyclable wood, (chipping or
mulching for compost or erosion
control). Wood materials can be sold
to lumber mills, firewood providers, or
biomass to energy facilities, or taken
to a landfill
Soil, mud, sand These materials are often
deposited by floods,
landslides, and storm surges
Contaminated materials: Class I/II
Landfill.
Non-contaminated materials: Class III
Landfill
Sandbags Used to protect against
flooding may be
contaminated with pollutants
from flooded sewage
treatment plants, pesticides,
herbicides, and other
chemicals
Contaminated materials: Class I/II
Landfill.
Non-contaminated materials: Class III
Landfill
Construction and
demolition material
May include disasterdamaged building materials
and damaged contents
Treated Wood Waste: Class I Landfill
(unless re-regulated to permitted lined
Class 2 Landfills). Concrete rubble
can be recycled/ disposed of at a
landfill. Wood material can be sold for
reuse, recycling, or taken to a landfill
Disaster Debris Management Plan December 2025
20 Debris Type Description Disposal Options
Utility
systems/electrical
waste
May include utility poles,
wiring, conduit, and other
items from power lines,
computers, TV, cell phones,
batteries and other electrical
equipment
Consolidated at landfill
Household
hazardous waste
Includes paints, solvents,
cleaning supplies,
insecticides, pool chemicals,
propane, gasoline, oils, and
other residential chemicals.
Segregated for appropriate disposition
to Class II or III landfills
Hazardous waste Waste with properties that
make it potentially harmful to
human health or the
environment. Hazardous
waste is regulated under
Resource Conservation and
Recovery Act
Processed to consolidate like
materials near the operation then
disposed of at a Class I Landfill
White goods Include washers, dryers,
freezers, clothes dryers, and
stoves. Any refrigerants in
these materials must be
removed by certified
technicians
Once hazardous chemicals are
removed from white goods, they can
be recycled as metal
Vehicles and vessels Automobiles, farm
equipment, trailers, boats
Must perform State vehicle
identification and remove hazardous
chemicals
Putrescent Debris Carcasses of domestic and
wild animals and other fleshy
organic matter
Class III landfill
Chemical, Biological
(Infectious),
Radiological, Nuclear
Contaminated by chemical,
biological, radiological, or
nuclear materials
Contaminated: Class I/II Landfill.
Non-contaminated: Class III Landfill
5.2 DEBRIS QUANTITIES
Estimating the quantities of debris that may be generated by various natural or man-made disasters is a complex analysis. There are multiple variables (type of incident, severity, location, etc.) that can dramatically affect the quantities of debris that may be generated by a disaster.
Appendix A provides debris estimates and resource requirements for those scenarios identified in the City LRP as high probability/vulnerability incident types.
Disaster Debris Management Plan December 2025
21 METHODS FOR ESTIMATING ACTUAL DEBRIS QUANTITIES DURING/AFTER A
DISASTER
Debris estimates are based on a series of assumptions and should not be considered as the actual volumes following a disaster event. Debris estimate models use factors such as household population and parcel data to forecast the volume and type of potential debris in each disaster management area.
The USEPA recommends the Incident Waste Decision Support Tool (I-WASTE DST) for estimating debris volume (http://www2.ergweb.com/bdrtool/login.asp).
FEMA’s Hazards U.S.-Multi-Hazard (Hazus-MH) model can be used for estimating potential losses from earthquakes, floods, and hurricanes (http://www.fema.gov/hazus). ArcGIS software is required to use Hazus-MH). FEMA also provides guidance on debris estimation in their publication titled Debris Estimating Field Guide (FEMA 329) https://www.fema.gov/sites/default/files/2020-07/fema_329_debris-estimating_fieldguide_9-1-2010.pdf.
The assumptions used in all of these debris estimation models include:
Average debris collection truck capacity: 35 cubic yards (CY) Average number of trips per day for each collection truck: 6 Average truck to loading equipment ratio: 2:1
Debris Management Sites per jurisdiction: 1 (This could potentially be reduced by jurisdictions with smaller acreage requirements sharing sites.) Volume of debris that can be staged per acre based on a 10-foot stack height: 16,117 CY/acre
Estimated collection period: 30 days (unless otherwise stated)
5.3 DEBRIS MANAGEMENT PROCEDURES
INITIAL RESPONSE
Immediately following a debris-generating incident, debris managers will initiate emergency roadway clearance to ensure the movement of emergency response vehicles, allow for access to and assessment of high priority critical infrastructure, and open evacuation routes. Debris managers will work with fire rescue and law enforcement to establish a prioritization scheme and will request support from power company representatives to ensure crew safety.
The City will use city owned resources to conduct emergency roadway clearance; if the scope of work for this stage requires more resources, the City will contract for services, or request additional resources through the OA.
SHORT-TERM RECOVERY
For debris operations, the recovery phase begins with debris removal from the public ROW and ends when debris operations are complete, and all documentation is closed out.
Disaster Debris Management Plan December 2025
22 During this phase, the City will continuously evaluate their capacity to conduct debris removal operations internally using force account equipment and labor, using mutual aid or by using contracted services. The City will also assess their capacity to conduct special debris programs and will identify the need for guidance and assistance with those activities that exceed local capability. Other tasks during short-term recovery include:
Open TDMS locations.
Establish segregation criteria.
Establish decontamination procedures for trucks, equipment and personnel. Establish monitoring procedures and responsibilities. Prioritize support to roads/areas.
Issue press releases regarding segregation of debris. Begin ROW debris removal.
Begin environmental monitoring program of TDMS.
Coordinate with mutual aid and contracted services providers. Obtain FEMA guidance for procurement and special debris programs. Obtain CalOES/CalEPA direction on state policies and regulations.
INTERMEDIATE RECOVERY
Intermediate recovery includes activities that that take place after immediate debris needs have been addressed. Intermediate recovery typically occurs two weeks to several months postdisaster. These activities include:
Maintain and evaluate ROW cleanup.
Begin ROW stump removal as necessary.
Open additional TDMS locations as necessary.
Conduct daily meetings with the county, state and/or FEMA. Begin special debris programs.
Communicate ROW debris removal program closeout to residents via press release.
LONG-TERM RECOVERY
Long-term recovery includes activities to closeout debris programs and reconcile documentation.
Long-term recovery can take several years depending on the severity of the disaster and the audit processes from regulatory agencies. Long-term activities include:
Complete all debris recovery activities.
Identify ineligible debris on ROW.
Complete the disposal of reduced debris.
Close out and remediate TDMS locations.
Conduct project closeout meetings with FEMA and external agencies.
Disaster Debris Management Plan December 2025
23 5.4 DEBRIS COLLECTION AND DISPOSITION
In the interest of conserving landfill capacity and reducing solid waste disposal, disaster-related debris should be recycled to the greatest extent possible and/or centrally held until it can be processed for maximum recycling.
Mixed debris collection is more convenient and allows all debris types to be delivered to a specific collection area (e.g., curbside or community collection centers), while source-segregated requires residents to sort the debris themselves. Collection types for a specific disaster should be determined during debris management planning following a disaster.
5.5 TEMPORARY DEBRIS MANAGEMENT SITES
A TDMS allows for the temporary staging, separation, reduction, and processing of disaster-generated debris when transport directly to an end-use facility is not immediately possible. TDMS serve a critical role in supporting the City’s waste reduction, goals.
TDMS locations will require approval from the Alameda County Department of Environmental Health, CalRecycle and permits from the agencies listed below. An Emergency Waiver of Standards grants a landfill operator temporary relief from specific standards such as permitted capacity, throughput, and acreage. Existing operations may pursue such a waiver with CalRecycle in accordance with the California Code of Regulations, Title 14, Section 17210.
The use of closed landfills and planned solid waste facilities will require permission from Alameda Environmental Health and appropriate local land use and other jurisdictional agencies.
Environmental permits and land-use variances may be required during removal operations for TDMS.
Several agencies may be involved in issuing permits and granting land-use approvals. Permits may include:
Waste processing and recycling operations permit;
Temporary land use permits;
Land use variances;
Traffic circulation strategies;
Air quality permits;
Water quality permits;
Coastal commission land use permits;
Household hazardous waste permits; and
Fire department permits.
In November 2023 planning meetings the City’s debris management professionals identified preliminary locations considered to be suitable and well positioned for use as potential debris Disaster Debris Management Plan December 2025
24 management sites. Figure 2 shows the map used during the planning meetings to discuss and select TDMS. Debris management sites include:
Debris staging and storage (short-term and long-term) locations; and Equipment staging and storage (short-term and long-term) locations Figure 2: Potential Debris Management Sites
City owned equipment is stored and staged at the Corporation Yard located at:
24505 Soto Road
Hayward, CA 94544
Decontamination and treatment stations and waste management facilities had not yet been identified at the time of this DDMP and will be inserted into the next update of the Plan.
5.6 TRANSPORTATION
Truck certification is a critical component of debris management operations. Truck certification is the process to document the capacity of debris removal trucks. All debris removal trucks hauling debris on a volumetric basis must have their capacity and dimensions measured, sketched, photographed, and documented on a truck certification form. Each debris removal truck must be assigned a unique number for debris tracking and invoice reconciliation purposes. Truck certifications should contain:
Disaster Debris Management Plan December 2025
25 Unique truck number;
Driver name;
Driver phone number;
License number, state issued, and expiration date;
Tag number, state issued, and expiration date;
Vehicle measurements; and
Sketch/photo of the vehicle.
5.7 MONITORING OF DEBRIS OPERATIONS
The City will monitor its debris removal operations and document disaster-related quantities and reasonable expenses to ensure that the work is eligible for federal disaster assistance. The loading site monitors will perform on-site, street-level debris monitoring at all loading sites to verify debris eligibility based on contract requirements, and initiate debris removal documentation using load tickets. Loading site debris monitors’ primary job is to maintain documentation of work performed at the point of debris collection.
Disposal monitoring will be performed to document the disposal of disaster debris at approved TDMS locations and final disposal or end use locations. Monitors will perform quality assurance/quality control checks on all load documentation and haul-out documentation to ensure that information captured by loading site monitors is complete. This process includes the following tasks:
Inspection of truck placards for authenticity and signs of tampering. Verification that placard information is documented properly. Verification that all required fields on the load ticket have been completed.
The disposal monitor will document the amount of debris collected by making a judgment call on vehicle fullness (typically on a percentage basis). The percentage documented for each debris removal vehicle is later applied to the calculated capacity of the vehicle to determine the amount of debris collected.
The disposal monitor’s responsibilities include the following:
Completing and physically controlling load tickets.
Ensuring debris removal trucks are accurately credited for their loads. Ensuring trucks are not artificially loaded.
Ensuring hazardous waste is not mixed in with loads.
Ensuring all debris is removed from the debris removal trucks before exiting the TDMS or final disposal site.
Ensuring only debris specified within the scope of work is collected.
In addition to the responsibilities listed above, final disposal site monitors are also tasked with the following:
Disaster Debris Management Plan December 2025
26 Ensuring all debris is disposed at a properly permitted landfill. Matching landfill or compost facility receipts and/or scale house records to haul-out documentation.
Disaster Debris Management Plan December 2025
27 6.0 SPECIAL DEBRIS PROGRAMS
6.1 PRIVATE PROPERTY DEBRIS REMOVAL
When large-scale disaster events cause mass destruction and generate large quantities of debris over vast areas, debris on private property may sometimes pose health and safety threats to the public-at-large. If private property owners are not available because they have evacuated, the public entities may need to enter private property to remove debris considered to be an immediate threat to the lives, health, and safety of its residents. In such situations, CalOES and FEMA are authorized to approve the provision of Public Assistance for the removal of debris from private property when it is considered to be in the public interest.
The City will seek prior approval from the state and/or FEMA to determine eligibility for reimbursement. The following procedures are required for potential state and/or federal assistance and are best practices for conducting debris removal from private property regardless of potential reimbursement.
The jurisdiction must obtain documentation from the public health authority stating that disaster-generated debris on private property in the designated area constitutes an immediate threat to life, public health, and safety.
The jurisdiction may obtain documentation stating that the debris poses an immediate threat to improved property and that its removal is cost-effective. The cost to remove the debris should be less than the cost of the potential damage to the improved property. The jurisdiction must demonstrate its authority and legal responsibility to enter private property to remove debris. The legal basis for this responsibility must be established by law, ordinance, or code at the time of the disaster and must be relevant to the postdisaster condition representing an immediate threat to life, public health, and safety, and not merely define the public entity’s uniform level of services. Typically, solid waste disposal ordinances are considered part of an applicant’s uniform level of services.
6.2 HAZARDOUS TREES
Determining removal of hazardous trees and stumps is challenging. FEMA has established criteria to assist in making these determinations, using objective information that can be collected in the field.
Removing a hazardous tree may be eligible for FEMA Public Assistance grant funding. A tree is considered hazardous if its condition was caused by the disaster; it is an immediate threat to lives, public health and safety, or improved property; it has a diameter at breast height (4.5 feet from the ground on the high side) of six inches or greater; and the tree:
Has a split trunk;
Has a broken canopy; or
Is leaning at an angle greater than 30 degrees.
Disaster Debris Management Plan December 2025
28 The eligible scope of work for a hazardous tree may include removing the leaning portion and cutting the stump at ground level. An example of an ineligible costing method for such work would be removing the tree and stump for two separate unit costs.
Removal of broken limbs or branches that are two inches or larger in diameter (measured at the point of break) that pose an immediate threat are eligible for Public Assistance grant assistance.
FEMA funds removal of broken limbs or branches located on private property if:
The limbs or branches extend over the public ROW;
The limbs or branches pose an immediate threat; and
The Applicant removes the hazard from the public ROW (without entering private property).
Only the minimum amount of work necessary to remove the hazard is eligible.
A tree stump may be determined to be hazardous and eligible for Public Assistance grant funding as a per-unit cost for stump removal if it meets all of the following criteria:
It has 50 percent or more of the root-ball exposed (less than 50 percent of the root-ball exposed should be flush cut);
It is greater than 2 feet in diameter, as measured 2 feet above the ground; It is on improved public property or a public ROW; and It poses an immediate threat to life, and public health and safety.
Disaster Debris Management Plan December 2025
29 7.0 DEBRIS WASTE CHARACTERIZATION
Two different types of sampling may be needed to meet waste acceptance criteria at waste management facilities and to allay community concerns:
1) Sampling to classify and determine compliance with federal, state, local, or tribal regulatory criteria, and
2) Sampling to ensure that waste/materials have been effectively decontaminated.
The City will make all reasonable attempts to take the appropriate number of representative samples from the waste stream where it is expected to exhibit the average properties of the whole.
The City will coordinate with Alameda County (the OA), CalOES and CalEPA to identify laboratories to support sample analysis and to establish sample quantities and procedures.
The City will rely on available laboratories identified by CalEPA or CalOES to conduct analysis of samples, and will rely on guidance from CalEPA to establish quality assurance procedures.
Disaster Debris Management Plan December 2025
30 8.0 FINANCE AND ACCOUNTING
8.1 COST TRACKING AND REPORTING
Accurate and complete cost tracking is critical to obtain assistance for disaster-related costs.
Emergency protective measures can be eligible for reimbursement. If the incident allows for warning, the City will begin tracking costs once the threat has been identified. If there is no warning, The City will begin tracking costs as soon as possible. Accounting best practices for tracking costs includes the following:
Identify a person that will be responsible for compiling disaster-related costs for the jurisdiction.
Establish a cost code for disaster-related costs.
Establish a file structure for each site where recovery work has been or will be performed.
Maintain accurate disbursement and accounting records to document the work performed and the cost incurred.
Obtain and review applicable local, state, and federal policies and regulations. Document administrative costs.
Begin compiling recovery project documentation, including:
o Executed contracts, bids, periods of performance, and locations worked; o Property insurance;
o Donated resources (labor, equipment and materials);
o Mutual aid;
o Force account labor;
o Force account equipment;
o Equipment rental agreements;
o Fuel logs;
o Materials including meals and gas purchases;
o Description of damage;
o Scope of work to be completed;
o Photos of damage;
o Copies of estimates;
o Maintenance records; and
o Site inspection records.
The City will coordinate with state and federal agencies to obtain disaster-specific cost tracking spreadsheets and templates.
Disaster Debris Management Plan December 2025
31 8.2 FUNDING SOURCES FOR DISASTER DEBRIS OPERATIONS
FEMA PUBLIC ASSISTANCE
The Stafford Act constitutes the statutory authority for most federal disaster response activities, especially as they pertain to FEMA and FEMA programs. The federal government provides several assistance programs through various agencies to support debris operations.
The mission of the FEMA Public Assistance Grant Program is to provide assistance to State and local governments and certain private nonprofit organizations to quickly respond to and recover from disasters or emergencies declared by the President. FEMA provides supplemental federal disaster grant assistance for debris removal, emergency protective measures and repair, and replacement or restoration of disaster-damaged facilities through the Public Assistance Program.
The Program also encourages protection of these damaged facilities from future events by providing assistance for hazard mitigation measures during the recovery process.
The FEMA Public Assistance Grant Program is a cost-sharing program. Cost share refers to the portion of disaster-related costs the federal government is responsible for funding. Per the Stafford Act, the federal cost share of assistance is not less than 75% of the eligible cost for emergency measures and permanent restoration. The remaining 25% is the responsibility of the State and local governments. The State serves as the grant administrator or the grantee. The grantee determines how the non-federal share is funded.
The policy guidance for these assistance programs changes and adapts with lessons learned from each disaster across the United States. The City will maintain awareness of current federal assistance program guidance and regulations related to disaster debris federal funding programs.
CALIFORNIA DISASTER ASSISTANCE ACT
The State can provide additional assistance through the California Disaster Assistance Act (CDAA). The CDAA was created to assist the State to provide funding to local governments after a disaster and to manage regularity and administrative issues related to disasters. CDAA regulations govern the eligibility rules for disaster debris removal reimbursements within the State.
The CDAA provides regulatory guidance for three components of disaster finance and administration; emergency work, emergency protective measures, and debris removal.
CDAA Regulations, Section 2925 state that debris removal from publicly and privately owned lands and waters, undertaken in response to a state of emergency proclamation by the Governor is eligible for State financial assistance; and for purposes of this program, the removal of debris from private property shall be reimbursed only when there is an immediate threat to public health and safety.
OTHER FUNDING OPTIONS
Public entities may be eligible for other federal assistance programs for disaster debris management including:
Disaster Debris Management Plan December 2025
32 Federal Highway Administration Emergency Relief Program USDA Natural Resources Conservation Service Emergency Watershed Protection Program and Farm Services Agency Emergency Programs.
8.3 PROCUREMENT REQUIREMENTS
USE OF FORCE ACCOUNT RESOURCES
Force account resources must be accurately documented during the response and recovery operations. Often, the use of force account labor and equipment can apply to the public entity’s share for disaster-related costs. Labor and equipment expenses may be eligible for state and/or federal reimbursement if documented properly. The City will document the pre-existing condition for any equipment used for debris operations and determine if equipment is appropriate for debris operations. The City will provide training to personnel that will be involved in debris operations, to include those responsible for tracking costs.
USE OF PROCUREMENT AND CONTRACTED SERVICES
The City may find it necessary to contract for debris management services if operational needs exceed their force account resources, or if it is otherwise determined that securing contracted services is in their best interest. If contracted services are to be used for debris management including removal and monitoring, these contracts must meet federal procurement requirements to be eligible for potential federal disaster assistance. The City may also need to implement its emergency procurement procedures during a disaster debris management incident.
The City is responsible for conducting debris operations within areas under their authority to the greatest extent possible using internal resources, mutual aid, or contracted services. The use of resources, including staff, equipment, and supplies, will be documented and tracked by the local jurisdictions to support reimbursement of eligible expenses.
In the event that The City is unable to conduct their own debris operations, they can request assistance from the OA. The OA will provide support for debris operations to public entities within the OA in accordance with SEMS and approved mutual aid and operations plans.
Disaster Debris Management Plan December 2025
33 9.0 COMMUNITY OUTREACH
Public information following a disaster will be a coordinated effort in accordance with the principles of SEMS. Public information messages will be needed to get the public’s support and cooperation in debris management operations. Public information messages might be developed to communicate the following information:
The status of debris operations;
What the City is doing to manage debris;
The importance of getting debris to the ROW;
The importance of segregating debris in the ROW;
Clarification as to what constitutes the ROW;
What to do if assistance is needed in moving debris to the ROW; and The status of garbage pickup.
The City’s public information professionals will monitor public and media comments and correct any misinformation that could result in confusion among the general public and hinder debris operations.
As part of ongoing updates to the DDMP the City intends develop education and information programs that provide consistent messaging designed to familiarize people with their role in the diversion and disposal of debris wastes. The public information and education campaign will include press releases and public service announcements, social media posts, postings and storage of information at the City Library, and other methods deemed appropriate to maximize receipt of information by City residents.
Disaster Debris Management Plan December 2025
34 10.0 TRAINING
10.1 TRAINING
Personnel must be trained on debris policies and procedures to maintain a viable plan. The City will maintain an ongoing training and exercises program, which. will include debris operations training and exercises. The following provides recommendations for debris operations training:
The City will train new personnel in their specific job duties related to debris operations. Personnel with response responsibilities must maintain competence in SEMS as prescribed in Government Code §8607(c).
Personnel operating equipment must be trained to operate any equipment they are responsible for competently and safely.
Personnel performing debris monitoring tasks will be trained by the jurisdiction or a qualified designee.
Personnel with responsibility for preparing documentation for reimbursement should receive training on the FEMA Public Assistance Program. All personnel involved in response to a debris-generating incident should participate in a briefing on safety policies and procedures.
Individuals identified as debris managers will be trained in the regulatory requirements for debris operations including:
Health and safety;
Environmental and historical preservation;
Procurement;
Federal disaster grant programs;
Considerations for individuals with disabilities and access and functional needs; and Damage assessment for debris
Training options include the following:
FEMA E0202: Debris Management Planning for State, Tribal and Local Officials. This is a 4-day class designed to provide an overview of issues and recommended actions necessary to plan for, respond to, and recover from a major debris-generating event with emphasis on state, local and tribal responsibilities.
FEMA IS – 1009 Conditions of the Public Assistance Grant. This is a 7-hour course that is designed to identify strategies to better enable Applicants to execute the Public Assistance Grant, describe the Federal requirements for receipt of Federal funds, and inform Applicants of actions that may jeopardize Public Assistance grant funding and potential remedies for non-compliance.
FEMA IS – 0632a Introduction to Debris Operations. This is a 2-hour online course designed to familiarize participants with general debris removal operations and identify critical debris operations issues.
Disaster Debris Management Plan December 2025
35 Finance and administration staff responsible for documenting and tracking costs and activities will be trained in regulatory requirements for debris operations including procurement, Federal disaster grant programs, and documentation.
Training options include the following:
FEMA IS – 1000 Public Assistance Program and Eligibility. This is an 8-hour online course designed to provide an overview of Public Assistance project eligibility and requirements FEMA IS – 0632.a Introduction to Debris Operations. This is a 2 hour online course designed to familiarize participants with general debris removal operations and identify critical debris operations issues.
FEMA IS – 1009 Conditions of the Public Assistance Grant. This is a 7-hour course that is designed to identify strategies to better enable Applicants to execute the Public Assistance Grant, describe the Federal requirements for receipt of Federal funds, and inform Applicants of actions that may jeopardize Public Assistance grant funding and potential remedies for non-compliance.
10.2 EXERCISES
Exercises are essential to maintaining readiness and in determining the effectiveness of plans, personnel, and resources in responding to a debris-generating event. Workshops and exercises should be conducted periodically to test the ability of jurisdictions to coordinate resources for debris operations.
Following exercises, an after-action report will be developed to document strengths and areas needing improvement. An improvement plan will be developed to list corrective actions, identify individuals or agencies responsible for completing the corrective actions, as well as indicating a timeline for completion.
Disaster Debris Management Plan December 2025
36 11.0 AUTHORITIES AND REFERENCES
LOCAL AUTHORITIES
• Hayward Emergency Operations Plan, 2023
• Hayward Local Resilience Plan Update, 2023
• Hayward Solid Waste Authority Ordinance No. 97-01 Regulating Solid Waste, Green Waste And Recyclable Material Collection, Processing, Disposal And Litter10 • Hayward, CA Maintenance Agreements with the California Transportation Department (CalTrans) for the Intersection at Sycamore Valley Road and Camino Ramon and the 680 Auxiliary Lane Widening Project
• Hayward Solid Waste Authority Ordinance No. 19-1, An ordinance amending the construction and demolition debris program ordinance.
STATE AUTHORITIES
• Joint Exercise of Powers Act: Government Code § 6500 et seq. • California Disaster Assistance Act (CDAA), Title 19, California Code of Regulations o Section 2920 – Emergency Work
o Section 2930 – Emergency Protective Measures
o Section 2925 – Debris Removal
• California Environmental Protection Agency (CalEPA) Guidance for Conducting Emergency Debris, Waste and Hazardous Material Removal Actions Pursuant to a State and Local Emergency Proclamation, Appendix C
• California Governor’s Office of Emergency Services Debris Management Plan • California Health & Safety Code §§ 41800-41815
• California Integrated Waste Management Act of 1989, California Public Resources Code §§ 40000-49620
• California Hazardous Waste Control, California Health and Safety Code § 25100 et seq. • California Carpenter-Presley-Tanner Hazardous Substance Account Act, California Health and Safety Code § 25300 et seq.
• Porter-Cologne Water Quality Control Act, California Water Code § 13000 et seq. • Safe Drinking Water And Toxic Enforcement Act, California Health and Safety Code §25249.5 et seq.
• California Health and Safety Code §§ 25115-25117, 25249.8, 25281, and 25316
FEDERAL AUTHORITIES
• Clean Air Act, 42 U.S.C. § 7401 et seq.
• FEMA Comprehensive Planning Guide 102 Version 2
• FEMA Publication FP 104-009-2 – Public Assistance Program and Policy Guide 2020 • FEMA 329 Debris Estimating Field Guide, September 2010 • FEMA Public Assistance Alternative Procedures Debris Management Plan Job Aid • FEMA Public Assistance Alternative Procedures EMMIE Cost Codes for Debris Removal Disaster Debris Management Plan December 2025
37 • FEMA Public Assistance Alternative Procedures FAQ for Debris Removal • National Response Framework, Department of Homeland Security, October 2019 • National Disaster Recovery Framework, Department of Homeland Security, June 2016 • Sandy Recovery Improvement Act (SRIA), included as Division B of the Disaster Relief Appropriations Act, PL 113-2, signed into law January 29, 2013 • Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. § 5121 et seq., including the Sandy Recovery Improvement Act (SRIA), which amended Title IV of the Stafford Act, PL 113-2
• 23 U.S.C., § 125 – Emergency Relief, part of Moving Ahead for Progress in the 21st Century Act (MAP-21), signed into law July 6, 2012
• Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 C.F.R. § 200 et seq.
• Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA), 42 U.S.C. § 9601 et seq.
• Emergency Planning and Community Right-to-Know Act, 42 U.S.C. § 11001 et seq. • Resource Conservation and Recovery Act, 42 U.S.C. § 6901 et seq. • Federal Clean Water Act, 33 U.S.C. § 1251 et seq.
• Toxic Substances Control Act, 15 U.S.C. § 2601 et seq. • Occupational Safety and Health Act, 29 U.S.C. § 651 et seq. • Hazardous Materials Transportation, 49 U.S.C. § 5101, et seq.
References
U.S. Department of Homeland Security Federal Emergency Management Agency (FEMA). 2023. National Preparedness Goal. (available at: https://www.fema.gov/emergencymanagers/national-preparedness/goal) U.S. Department of Homeland Security FEMA. 2023. National Response Framework. (available at: https://www.fema.gov/emergency-managers/nationalpreparedness/frameworks/response).
U.S. Department of Homeland Security FEMA. 2023. Assistance for Governments and Private Non-Profits After a Disaster. (available at: https://www.fema.gov/assistance/public).
U.S. Department of Homeland Security FEMA. 2015. National Preparedness Goal Second Edition. Available at https://www.fema.gov/sites/default/files/2020- 06/national_preparedness_goal_2nd_edition.pdf.
U.S. Department of Homeland Security FENA. 2017. Emergency Management Institute Debris Management Plan Development Course, Lesson 8: Contracted Services. Available at:
https://emilms.fema.gov/is_0633/groups/194.html.
U.S Department of Homeland Security FEMA. 2019. National Response Framework Fourth Edition. Available at https://www.fema.gov/sites/default/files/2020- 04/NRF_FINALApproved_2011028.pdf.
Disaster Debris Management Plan December 2025
38 U.S. Department of Homeland Security FEMA. 2020. Public Assistance Program and Policy Guide. Available at https://www.fema.gov/sites/default/files/documents/fema_pappg-v4- updated-links_policy_6-1-2020.pdf.
U.S. Department of Homeland Security FEMA. 2021. FEMA Debris Monitoring Guide. Available at https://www.fema.gov/sites/default/files/documents/fema_debris-monitoringguide_sop_3-01-2021.pdf. •
Disaster Debris Management Plan December 2025
39 APPENDIX A – DEBRIS ESTIMATION (HAZUS)
EARTHQUAKE SCENARIO ASSUMPTIONS AND DEBRIS ESTIMATE
For the earthquake scenario, Hazus, a program developed by FEMA to aid jurisdictions in estimating damage and debris, was used to run three earthquake scenarios.
Table A.1. Concord-Green Valley Fault Earthquake Debris Estimate Jurisdiction
Type 1
Debris
(CY)
Type 2
Debris
(CY)
Total (CY) DMS Acres
Needed
Trucks
Needed
Personnel
(Debris Monitors)
Hayward, CA 10,131.62 2,905.08 13,036.70 1 3 1
Notes:
CY – Cubic Yards
Type 1 Debris – Brick, wood, and other debris in CY
Type 2 Debris – Wrecked reinforced concrete and steel members
FLOODING SCENARIO ASSUMPTIONS AND DEBRIS ESTIMATE
Three flooding scenarios are listed below. The scenarios include a 10 percent annual flooding chance, a 1 percent of chance of flooding (100-year flood), and a 0.2 percent chance of flooding (500-year flood).
Table A-2. 10% Flooding Debris Estimate
Jurisdiction 10% Annual Flood
in Cubic Yards
DMS Acres
Needed
Trucks
Needed
Personnel (Debris
Monitors)
Hayward, CA 180 5 1 1
SEVERE WEATHER EVENT SCENARIO ASSUMPTIONS AND DEBRIS ESTIMATE The City is susceptible to severe weather including flooding and strong winds. For this reason, the U.S. Army Corps of Engineers (USACE) hurricane debris estimation model was used to determine the type and volume of debris for each jurisdiction. Though it is unlikely that The City will experience a hurricane, a Category 1 hurricane was used because it most closely resembled the type of conditions related to wind speed and flooding the City could experience in a severe weather incident. • USACE formula: Q=H(C)(V)(B)(S)
Where:
Q = Cubic Yard (CY) of debris
Disaster Debris Management Plan December 2025
40 H = Number of households in the community
C = Storm category factor (Storm category 1, multiplier = 2) V = Vegetative multiplier (Medium vegetative cover, multiplier =1.3) B = Commercial multiplier (Medium commercial multiplier = 1.2)
S = Precipitation multiplier (medium to heavy rains multiplier = 1.2) • Estimated allocation of construction and demolition (C&D) to vegetative debris:
o C&D debris 30%
o Vegetative debris 70%
Table A-3. Severe Weather Debris Estimates
Jurisdiction Households
Debris
Estimate
(CY)
C&D
(CY)
Vegetative
(CY)
DMS
Acres
Needed
Trucks
Needed
Personnel
(Debris
Monitors)
Hayward, CA 15,959 59,750 17,925 41,825 5 10 5
Notes:
CY – Cubic Yards
WILDFIRE SCENARIO ASSUMPTIONS AND DEBRIS ESTIMATE
Portions of The City are susceptible to a wildfire incident. Using data from past California wildfire incidents compiled by consultants to the state, a formula was used takes into consideration the number of parcels damaged by fire, average tree density in the area, the average size of the trees, as well as the types of housing structures that might be in the path of the fire.
Table A-4. Wildfire Debris Estimates
Jurisdiction Parcels at
Risk
Debris
Estimate
(CY)
DMS
Acres
Needed
Trucks Needed
Personnel
(Debris
Monitors)
Hayward 322 80,135 5 12 6
Notes:
CY – Cubic Yards
Disaster Debris Management Plan December 2025
41 APPENDIX B – TEMPORARY DEBRIS MANAGEMENT SITE (TDMS)
CONSIDERATIONS
TDMS IDENTIFICATION AND PREPARATION
Concurrent to emergency roadway clearance and damage assessments, affected jurisdictions need to identify and prepare TDMS locations. The purpose of a TDMS is to temporarily store debris and conduct some form of debris reduction method before the debris is transported to a final disposal facility. Parks and jurisdiction-owned properties can be used as possible TDMS locations. In addition, land within transfer stations or solid waste facilities can be utilized as TDMSs. This can be desirable because of their ability to immediately accept debris.
There are several potential TDMSs in The City. These will be further vetted and included in the next version of the DDMP. Debris brought to a TDMS is sorted to remove recyclable materials and materials not suitable for reuse. The materials not suitable for reuse are taken to a landfill.
Ideally, all concrete rubble would be processed at the TDMS into reusable aggregate. This option may be considered if space, site characteristics, and available resources allow.
The size of the site is dependent on the quantity of debris that needs to be stored and processed. The site should be large enough to safely accommodate processing of various debris materials, storing heavy equipment, and maneuvering trucks and large processing equipment.
The TDMS should be established in an area that does not impede the flow of traffic along major transportation corridors, disrupt local business operations, or cause dangerous conditions in residential neighborhoods or schools. Whenever possible, avoid locating a TDMS near residential areas, schools, churches, hospitals, and other such sensitive areas.
The City needs to consider community acceptability when selecting a potential TDMS. The community’s acceptance of the TDMS location usually depends on the debris reduction methods that will be conducted at the site. Smoke from burning, around-the-clock light and noise from equipment operation, dust, and traffic are generally tolerated early in a disaster recovery operation but may have to be curtailed later in the recovery phase.
The following factors should be taken into consideration when identifying a debris management site:
Current availability
Duration of availability
Site ingress/egress
Geographic location within the jurisdiction
A minimum of 10 acres of usable land
Well drained site with soils suitable for supporting heavy vehicles and equipment Easy access to transportation routes
Disaster Debris Management Plan December 2025
42 Strategic placement to minimize debris transportation requirements and travel time to and from loading points; TDMS should be located as close as possible to the concentrations of disaster debris
Access to electrical and water utilities for site operations Minimum potential for disruption of critical services
Potential locations for a TDMS may include the following:
Recycling facility
Landfill
Transfer station
Vacant lot
Corporation yard
Parks
Large parking lot
Right of way
Jurisdiction owned property
Private property
SITE APPROVAL
TDMS locations will require approval from The Alameda County Environmental Health Department and CalRecycle as well as permits from the agencies listed below.
An Emergency Waiver of Standards grants a landfill operator temporary relief from specific standards such as permitted capacity, throughput, and acreage. Existing operations may pursue such a waiver with the LEA for CalRecycle in accordance with the California Code of Regulations, Title 14, Section 17210.
The use of closed landfills and planned solid waste facilities will require permission from Alameda County Health Department and appropriate local land use and other jurisdictional agencies.
Environmental permits and land-use variances may be required during removal operations for TDMS(s). Selection of sites may require review and approval under the California Environmental Quality Act.
Permits may include:
Waste processing and recycling operations permit
Temporary land use permits
Land use variances
Traffic circulation strategies
Air quality permits
Water quality permit
Coastal commission land use permits
Household hazardous waste permits
Fire department permits
Disaster Debris Management Plan December 2025
43 After a review of the availability and suitability of a TDMS, site preparation can begin. As part of the preparation, baseline data should be gathered from the site to document the state of the land before debris is deposited. The following action items are recommended to compile baseline information:
Photograph the site – Digital photos should be taken to capture the state of the site before debris reduction activities begin. Photos should be updated periodically throughout the project to document the progression of the site.
Record physical features – Records should be kept detailing the physical layout and features of the site. Items such as existing structures, fences, landscaping, etc., should be documented in detail.
Historical evaluation – The past use of the site area should be researched and documented. Issues relating to historical or archeological significance of the site should be cleared with the state historical preservation agency.
Sample soil and water – If possible and deemed necessary, soil and groundwater samples will be taken before debris reduction activities commence. Samples will help ensure the site is returned to its original state. Typically, soil and groundwater samples should be analyzed for total RCRA metals, volatile organic compounds, and semivolatile organic compounds using approved U.S. Environmental Protection Agency (EPA) methods.
DEBRIS REDUCTION METHODS
Once debris is collected from the public ROW, it is transported to a TDMS where it is segregated and reduced. Reduction methods include:
Chipping and Grinding – Using this method, vegetative debris is chipped or ground and typically results in a reduction ratio of up to 4:1. Factors such as debris composition, weather, site conditions, and other factors may impact the reduction ratio. The leftover mulch is either hauled to a final disposal facility or recycled.
Incineration – Although incineration is rarely authorized, there are circumstances where a public entity can request to reduce debris through burning. The burning of vegetative debris typically results in a reduction ratio of up to 20:1. Factors such as debris composition, weather, site conditions and other factors may impact the reduction ratio.
The leftover ash may be hauled to a final disposal facility or be incorporated in a land application.
Crushing – The crushing of vegetative debris is the least effective reduction method and results in a reduction ratio of up to 2:1. Crushing is an appropriate reduction method for C&D debris that cannot be recycled. However, if crushing is used to reduce C&D debris, the residual debris must show a reduction in volume.
Disaster Debris Management Plan December 2025
44 APPENDIX C – CALEPA DEBRIS REMOVAL GUIDANCE
CalEPA provides guidance for local and state agencies to conduct disaster debris, waste and hazardous material removal activities. The following section includes best management practices from CalEPA to be considered to address the removal of hazardous materials, household hazardous waste (HHW), debris, asbestos containing materials (ACM), and air monitoring and sampling from the disaster or incident site.
HEALTH AND SAFETY
Given that ash may contain elevated levels of heavy metals and/or asbestos, an exclusion zone will be established around each site during debris removal operations. All personnel entering this area will be required to wear Level C protective attire.
It is recommended that all on-site cleanup personnel entering the exclusion zone must be 40- hour HAZWOPER trained Under 29 CFR 1910.120, and CCR Title 8, Section 5192, and will be required to wear Level C personal protective equipment (PPE).
A full-time health and safety officer will be assigned to the project. It is recommended that the health and safety officer be a certified industrial hygienist. Depending on the task and activity, all cleanup contractors working on-site must have the following certifications and licenses:
State Contractor’s License – Must include an asbestos certification component (if conducting ACM removal), and general engineering, demolition and hazardous substance certifications depending on the task performed. Department of Occupational Safety & Health Asbestos Registration Number (if conducting ACM removal)
Hazardous Waste Transporter Registration Number – Issued by California Department of Toxic Substances Control RCRA EPA ID Number – Issued by US Environmental Protection Agency, Region 9
US Department of Transportation, Pipeline and Hazardous Materials Safety Administration – Hazardous Material Certificate of Registration California Highway Patrol – Hazardous Materials Transportation License US Department of Transportation, Federal Motor Carrier Safety Administration – US Department of Transportation Identification Number
California Department of Motor Vehicles – Motor carrier permit
HAZARDOUS MATERIALS AND HOUSEHOLD HAZARDOUS WASTE
Standard operating procedures for conducting hazardous material (HAZMAT) assessment activities should be followed pursuant to Cal/OSHA and OSHA HAZWOPER requirements.
Prior to commencing debris removal activities, all areas are to be cleared of HAZMAT, including the removal of easily identifiable (visible) gross asbestos, radioactive, and explosive materials.
Disaster Debris Management Plan December 2025
45 Explosive material includes firearms and ammunition, black powder, blasting caps, some fireworks, and military ordinance. If explosive materials are identified on-site, they should be handled by trained personnel and removed immediately to ensure safety of the public. If local agencies are unable to address explosive materials through their cleanup contract resources, contact the local law enforcement authority to provide assistance.
Prior to the removal of HAZMAT and HHW, a California Division of Occupational Safety and Health (Cal/OSHA) Certified Asbestos Consultant (CAC) should assess and sample all residential areas, and other affected areas of the site, to identify and remove gross asbestos. This is to ensure that any areas identified as containing gross asbestos material will not be disturbed by HAZMAT cleanup personnel.
Any ACM that is not found on the ground due to natural forces may be subject to National Emission Standards for Hazardous Air Pollutants (NESHAP) requirements.
Once the removal of easily identifiable gross asbestos has been completed, HAZMAT and HHW may be identified, segregated, classified, and properly removed from the site.
Initial hazmat assessment activities must include screening for radioactivity and ensuring that a flammable atmosphere does not exist. Typical HAZMAT includes HHW such as:
Automotive/marine batteries;
Automotive oils and fuel;
Compressed gas cylinders;
Propane tanks;
Herbicides and pesticides;
Solvents;
Paint thinners and strippers;
Oil and latex-based paints; and
Pool chemicals.
The following standard procedures are recommended by CalEPA:
The property, site, or affected area of the disaster should be assessed for HAZMAT and HHW.
A Cal/OSHA CAC will be utilized to assess the area or each residential or commercial property for easily identifiable and removable pieces of ACM. After assessing each property or area, the CAC will consult with a licensed asbestos removal contractor to identify the location and area of ACM to be removed.
A Cal/OSHA certified Asbestos Removal Contractor will be responsible for overseeing the safe removal of ACM identified on-site by the CAC.
All on-site personnel working to remove ACM must have received the necessary health and safety training for conducting asbestos removal activities pursuant to OSHA regulations (29 CFR 1910.1001), and CCR Title 8, Section 5192, and will be required to wear Level C PPE when working in the exclusion zone.
Disaster Debris Management Plan December 2025
46 All gross ACM that can easily be removed from the site will be adequately wetted prior to being bagged or bulked for removal. The easily identifiable gross ACM can be doublebagged and appropriately labeled as ACM. (At a minimum, the plastic bags must be of at least 6-mil thickness.)
If bulk loading of ACM is utilized, the bin or container used for transport (e.g., end-dump trailer or roll-off box) shall be double-lined with 10-mil poly in such a way that once loaded both layers can be sealed up independently.
HHW and HAZMAT identified on-site will be characterized, segregated, staged, consolidated, and packaged for transport and disposal by a licensed environmental contractor.
All on-site cleanup personnel must be 40-hour HAZWOPER trained under 29 CFR 1910.120, and CCR Title 8, Section 5192.
All hazardous waste and HHW removed from the site will be manifested and transported to a permitted treatment, storage, and disposal facility in good standing with local, state, and federal agencies.
Disposal facility emergency waivers and suspension of regulations for disposing of hazardous wastes generated from a disaster or large-scale event must be coordinated with the CalRecycle local enforcement agency (LEA) and the Regional Water Quality Control Board.
DEBRIS AND ASBESTOS CONTAINING MATERIAL
If burn ash or building material on the ground is from structures completely destroyed by natural forces (as opposed to structures demolished in whole or in part by human activity), this material is not subject to the Asbestos NESHAP as it relates to the demolition and renovation, transport and disposal requirements. If the building material and debris is not completely destroyed and requires further demolition, it may be subject to the Asbestos NESHAP.
At a minimum, the following best management practices should be used for undertaking debris and asbestos containing debris removal activities:
California Cal/OSHA CAC will be utilized to assess the area or each residential or commercial property for easily identifiable and removable pieces of ACM. After assessing each property or area, the CAC will consult with a licensed asbestos removal contractor to identify the location and area of ACM to be removed. A Cal/OSHA registered Asbestos Removal Contractor will be responsible for overseeing the safe removal of ACM identified on-site by the CAC.
All on-site personnel working to remove ACM must have received the necessary health and safety training for conducting asbestos removal activities pursuant to OSHA 1910.100, and CCR Title 8, Section 5192, and will be required to wear Level C PPE when working in the exclusion zone.
As noted in Sub-Section a. Health and Safety (above), all on-site cleanup personnel must be 40-hour HAZWOPER trained Under 29 CFR 1910.120, and CCR Title 8, Section 5192.
Disaster Debris Management Plan December 2025
47 The affected disaster or incident area (commercial, residential, or rural properties) will be screened by a CAC to identify all gross ACM that can be easily removed from the ground or structure prior to debris removal activities. Request an asbestos consultation from the state or local Air Quality Management District (AQMD) for any structure that is not completely destroyed or for any structure with vermiculite insulation, for large-facility components or material that will be broken up upon movement, or for other asbestos issues as identified by the CAC. Note: Current field definition of destroyed means the structure does not have a roof or any load bearing walls.
During asbestos screening process, it is recommended that bulk samples be collected from 10 to 20 percent of the representative structures that have not been destroyed to determine the presence of ACM above NESHAP regulations, and to ensure residual building materials do not contain asbestos that may change the overall waste classification.
All gross ACM that can be safely and easily removed from the site will be adequately wetted prior to being bagged or burrito wrapped to meet the NESHAP leak-tight requirement for removal. The easily identifiable gross ACM can be double-bagged and appropriately labeled as ACM. (At a minimum, the plastic bags must be of at least 6-mil thickness, and the contents must remain wet.)
If bulk loading of ACM is utilized, the bin or container used for transport (e.g. end-dump trailer or roll-off box) shall be double-lined with 10-mil poly in such a way that once loaded both layers can be sealed up independently.
Conduct on-site and off-site air monitoring and sampling for asbestos and heavy metals during all ACM and debris removal operations to demonstrate the effectiveness of engineering controls to protect cleanup personnel and the surrounding community. Engineering controls must be utilized to maintain dust and fiber control during removal activities. A water fog must be used during debris handling, bulking/bagging, and waste loading operations. It is recommended that cleanup contractors will use fire grade firefighting nozzles with shut off valves for dust control. The fire nozzle shall have sufficient water pressure to generate a high mist fog stream. The fire nozzle should have an adjustable flow rate, preferably 20 to 60 gallons per minute, and constructed of hard coated aluminum with brass and stainless steel internal components. Plastic nozzles should not be used. While the costs of metal firefighting nozzles are significantly more than plastic nozzles, only metal nozzles are able to generate a sufficient fog to control dust.
All burn ash and debris must be sufficiently wetted 48 to 72 hours in advance of initiating removal of the material. The water shall be applied in a manner so not to generate significant runoff. Engineering controls for storm water discharges must be in place prior to dust control operations.
All waste material that is not loaded out at the end of each workday should be stockpiled, sufficiently wetted, and/or covered to prevent the off-site migration of contaminants.
All waste haulers who observe loading operations outside of the vehicle cab, and/or covering (e.g., tarping) the trailer or container must wear Level C PPE.
Disaster Debris Management Plan December 2025
48 All approved landfill operators that may come in contact with the waste during off-loading operations should follow their facilities protocols for wearing PPE and respiratory protection.
All ACM and debris removed from the property, site or area must be manifested and transported for disposal to a permitted treatment, storage, and disposal facility in good standing with local, state, and federal agencies.
Cal/OSHA may require procedures for the receiving landfill facility to establish an appropriate site safety plan for the protection of the facility employees to potential ACM in the waste stream.
Disposal facility emergency waivers, and suspension of regulations for disposing of wastes generated from a disaster or large-scale event, must be coordinated with the CalRecycle local enforcement agency (LEA) and the Regional Water Quality Control Board.
AIR MONITORING AND SAMPLING
To demonstrate the effectiveness of best management practices and the engineering controls used during emergency debris removal actions, air monitoring and sampling activities should be conducted in the exclusion zone (on-site) and along the perimeter of the site (community-based) during removal activities, as well as non-work hours to establish relevant background air pollution levels.
ON-SITE AIR MONITORING
An on-site (industrial hygiene) air monitoring program is defined as one conducted within the immediate debris removal area with the objective of protecting occupational health and quantifying dust mitigation practices. Document on-site air monitoring activities in a site-specific Health and Safety Plan (HASP).
All personnel entering the immediate removal area should be required to wear Level C PPE, as defined in CCR Title 8 Section 5192; this level of PPE may be downgraded based on results of industrial hygiene air sampling.
Sample/monitor for dust, heavy metals, and asbestos. Particulate matter monitoring shall be done by direct reading instruments for real-time analysis. Heavy metal sampling can be conducted via cartridge or filter analysis using National Institute for Occupational Safety and Health (NIOSH) Method 7300 (metal scan). Asbestos samples should be collected with a 50mm antistatic cowel on a 25mm Mixed Cellulose Ester filter (MCEF) cassette and analyzed by transmission electron microscopy (TEM) NIOSH Method 7402 (high volume). Collect at least one upwind and two downwind dust samples from the immediate debris removal area in a triangular configuration.
Personal air sampling collected in the breathing zone of site cleanup workers should be conducted for dust, heavy metals, and asbestos; Sampling can be representative rather than comprehensive so long as monitored personnel represent of various on-site operators, laborers, and supervisors.
Disaster Debris Management Plan December 2025
49 The on-site air monitoring program shall include steps to modify debris removal operations to reduce the potential for exposures above the NIOSH Recommended Exposure Limits, the Threshold Limit Values published by the American Conference of Governmental Industrial Hygienists, or other protective occupational health guidance used in the site-specific HASP.
It is recommended that a full-time safety officer be assigned to the removal operations, preferably a CIH. At the conclusion of the debris removal project, a summary of air monitoring activities and any resulting health and safety issues should be provided to the project manager or Operations Chief.
OFF-SITE AIR MONITORING
No off-site migration and/or emission of dust or airborne contaminants is expected from disaster debris removal operations when appropriate dust mitigation controls are in place. However, a community-based air monitoring program may be established to monitor off-site migration of airborne contaminants, especially if adjacent neighborhoods are reoccupied.
Sampling or monitoring can also target sensitive population centers or locations such as schools and hospitals. While community monitoring is not required during disaster recovery efforts, increased community sensitivity following a disaster may justify a monitoring program.
Coordinate any monitoring and sampling efforts with County environmental health departments and local AQMDs. Additional state and federal resources are available if local resources are unavailable or exhausted. The favored approach is an interagency effort with either the Air District or local health department as the lead agency.
Develop a Sampling Plan and document community monitoring activities in a Community HASP.
Monitoring may be for particulate matter alone or in combination with asbestos or other suspected contaminants. Particulate matter can serve as a proxy for the migration of other particulate-type airborne contaminants, but not gases and aerosols, which need separate monitoring.
Direct read or near real-time dust measurement instrumentation such as a data ram is preferred and allows immediate feedback to removal operations and to impacted communities. If instituted, community monitoring should be conducted in both upwind and downwind locations relative to debris removal operations and/or the immediate impacted area.
Occupational health recommendations cannot be used in determining risk to public health. Only public health guidance values can be used to interpret community monitoring data. Twentyfour-hour average particulate matter concentrations (PM2.5 or PM10) should be equal to or less than 35 µg/m3; 8-hr averages should be equal to or less than 50 µg/m3; and, 3hr averages should be equal to or less than 88 µg/m.
STORM WATER CONTROLS
One of the most prevalent water pollution threats from burn sites is the discharge of ash and other burn related debris into storm drains or natural receiving waters. Sites where debris and ash have been removed are often graded and have soils prepared similar to those of construction projects.
Disaster Debris Management Plan December 2025
50 Debris removal and site clearing activities increase the exposure of soils to wind, rain, and concentrated flows that cause erosion and adversely impact storm water quality with high levels of total suspended solids and many other pollutants, which subsequently impacts surface waters.
The main objective is to provide best management practices that stabilize disturbed soil and reduce sediment transport caused by erosion from entering a storm drain system or receiving water body during debris removal after a disaster. Best management practices for storm water controls may include the use of fiber rolls, silt fences, erosion control blankets, hydro seeding, soil binders, and other devices to reduce sediments.
Effort should be made to preserve existing vegetation, if practicable. Once the removal has been completed, operation and maintenance of storm water control measures must be maintained by the property owner or the local government.
REDUCTION OF DISASTER DEBRIS BY BURNING
The California Health & Safety Code (HSC) § 41800 prohibits individual persons from using fire to dispose of waste. This applies to individual property owners and tenants. HSC § 41800 has rarely been waived by a Governor’s Proclamation of Emergency. However, HSC§ 41801 does establish specific authority for any public officer, including the Governor, to set or permit fires for the following purposes:
The prevention of a fire hazard that cannot be abated by any other means. The instruction of public employees in the methods of fighting fire. The instruction of employees in methods of fighting fire, when such fire is set, pursuant to permit, on property used for industrial purposes.
The setting of backfires necessary to save life or valuable property pursuant to Section 4426 of the Public Resources Code.
The abatement of fire hazards pursuant to HSC Section 13055. Disease or pest prevention, where there is an immediate need for and no reasonable alternative to burning.
The remediation of an oil spill pursuant to Section 8670.7 of the Government Code.
Burning debris should be coordinated with the Bay Area Air Quality Management District.
Guidance for burning disaster debris can be found on the Bay Area Air Quality Management District web page at https://www.baaqmd.gov/permits/open-burn.
HISTORICAL CONSIDERATIONS
There are a number of historical properties in the City. The city will ensure that guidelines in accordance with CEQA are adhered to regarding those properties. In addition, in the event a project funded by FEMA has the potential to affect one of these historical properties, FEMA is required to conduct a Section 106 consultation.
Disaster Debris Management Plan December 2025
51 Section 106 of the National Historic Preservation Act (NHPA) requires federal agencies to enter a four-step consultation process if historic properties may be affected by a federal “undertaking” as defined in the Act. The four steps are listed below:
1. FEMA initiates the Section 106 consultation process
2. Historic properties are identified and evaluated – FEMA will assess the significance of the properties and consult with the State Historic Preservation Officer (SHPO) or Tribal Historic Preservation Officer (THPO)
3. Adverse effects are assessed – FEMA will consult with the SHPO and THPO to determine if there will be any adverse effects to the properties. If it is determined there will be no adverse effects, the project may proceed.
4. Adverse effects are resolved – If it is determined there would be adverse effects, FEMA will consult with affected parties to determine ways to minimize the adverse effects on the properties.
Disaster Debris Management Plan December 2025
52 APPENDIX D – PUBLIC INFORMATION HEALTH AND SAFETY
CONSIDERATIONS
Lead in Damaged Materials or Debris - Homes built before 1978 are likely to contain leadbased paint, which may flake after being soaked by flood water. Lead is a toxic metal that causes many negative health effects, especially in children. Disturbing materials containing lead-based paint may release lead dust into the air. If you suspect that debris in your home is contaminated with such paint, seek help from public health authorities or specially trained contractors.
Contaminant Sediment - The sediment left behind by receding flood water often contains a wide variety of pollutants. They can include fuel oils, gasoline, human and animal waste, metals, and other material. Health officials caution against contact with sediment, if possible. If you do come in contact with it, wash any exposed skin with soap and water and change into clean clothing.
Asbestos in Debris - Older buildings may contain asbestos. Pipe or other insulation, ceiling tiles, exterior siding, roof shingles, and sprayed-on soundproofing may contain asbestos. If your home contains asbestos and may have been damaged or will be disturbed during cleanup, contact public health authorities.
Household Hazardous Waste - When returning to flood-damaged homes and buildings, be alert for leaking containers and household chemicals, such as caustic drain cleaners and chlorine bleach. Keep children and pets away from leaking or spilled chemicals. Do not combine chemicals to avoid dangerous or violent reactions. Do not dump chemicals down storm sewers, drains, or toilets. Mark and set aside unbroken containers until they can be properly disposed of.
Use of Chainsaw to Clear Debris - Over 35,000 people are injured by chainsaws yearly in the United States. Understand how to use the equipment and follow the instructions while using these tools for debris operations.
Read your owner’s manual.
Wear proper safety gear, including eye and hearing protection, heavy work gloves, and work boots.
Check controls, chain tension, and all bolts and handles to ensure they are functioning properly.
Fuel your saw at least 10 feet from sources of ignition. Clear debris that may interfere with cutting.
Keep hands on the handles, and secure footing.
Do not cut directly overhead or overreach with the saw. Be prepared for kickback.
Make sure someone is nearby to help you in case of an emergency. Understand that emergency responders are addressing issues related to the disaster so response times might be delayed.
Shelter Management Plan
2025
Prepared by: In collaboration with:
Attachment V
Shelter Management Plan December 2025
i
TABLE OF CONTENTS
TABLE OF CONTENTS ............................................................................................................. I ACRONYMS AND ABBREVIATIONS .......................................................................................III
1.0 INTRODUCTION AND OVERVIEW ................................................................................ 5
2.0 METHODOLOGY ............................................................................................................ 8
2.1 PLANNING ASSUMPTIONS ........................................................................................ 8
2.2 SHELTER OBJECTIVES ............................................................................................. 8
2.3 PLAN MAINTENANCE ................................................................................................ 9
3.0 GUIDANCE DOCUMENTS AND REGULATORY REQUIREMENTS .............................10
3.1 STATE EMERGENCY MANAGEMENT SYSTEM (SEMS) .........................................10
3.2 NATIONAL INCIDENT MANAGEMENT SYSTEM (NIMS) ..........................................10
3.3 CALIFORNIA DISASTER RECOVERY FRAMEWORK (CDRF) .................................10
3.4 ALAMEDA COUNTY EMERGENCY OPERATIONS PLAN (EOP) ..............................10
3.5 HAYWARD EMERGENCY OPERATIONS PLAN (EOP).............................................11
4.0 ROLES AND RESPONSIBILITIES ................................................................................12
4.1 CITY ROLES ..............................................................................................................12
4.2 OPERATIONAL AREA ROLES ...................................................................................16
4.3 STATE ROLES ...........................................................................................................17
4.4 FEDERAL ROLES ......................................................................................................18
4.5 PRIVATE SECTOR ROLES ........................................................................................19
4.6 NON-GOVERNMENTAL ORGANIZATIONS (NGO) ROLES ......................................20
5.0 SHELTER OPERATIONS ..............................................................................................22
5.1 SHELTER ACTIVATION .............................................................................................22
5.2 POPULATION EVACUATION .....................................................................................23
5.3 MASS CARE SERVICES ............................................................................................25
5.4 SHELTER DEACTIVATION ........................................................................................26
6.0 SUPPORTING SHELTER RESOURCES .......................................................................27
6.1 OPERATIONAL AREA RESOURCES ........................................................................27
6.2 STATE RESOURCES .................................................................................................27
6.3 FEDERAL RESOURCES ............................................................................................28
7.0 FINANCE AND ACCOUNTING ......................................................................................32 Shelter Management Plan December 2025
ii
7.1 COST TRACKING AND REPORTING ........................................................................32
7.2 FUNDING SOURCES FOR EMERGENCY SHELTERING OPERATIONS .................33
7.3 PROCUREMENT REQUIREMENTS ..........................................................................34
8.0 COMMUNITY OUTREACH ............................................................................................36
9.0 PLAN MAINTENANCE AND TRAINING ........................................................................38
9.1 TRAINING SUPPORT ................................................................................................38
9.2 EXERCISES ...............................................................................................................39
10.0 AUTHORITIES AND REFERENCES ..........................................................................40
10.1 AUTHORITIES ........................................................................................................40
10.2 REFERENCES ........................................................................................................41 APPENDIX A – SHELTER PROFILES .....................................................................................43 APPENDIX B – SHELTER JOB ACTION SHEETS ..................................................................45 APPENDIX C – SHELTER MANAGEMENT FORMS ...............................................................72 APPENDIX D – SHELTER STAFFING MATRIX ......................................................................89 APPENDIX E – SHELTER STAFFING ROSTER .....................................................................93 APPENDIX F – SHELTER RESOURCE MATRIX ....................................................................94 APPENDIX G – DHHS FEDERAL MEDICAL STATION GUIDANCE .......................................95 Shelter Management Plan December 2025
iii
ACRONYMS AND ABBREVIATIONS
ARC American Red Cross
AST Ambulance Strike Team
Cal OES California Governor’s Office of Emergency Services CAL-MAT California Medical Assistance Team
CSD Community Services Division
CDAA California Disaster Assistance Act
CDRF California Disaster Recovery Framework
DHHS Department of Health and Human Services
DMAT Disaster Medical Assistance Team
DSW Disaster Services Worker
EMSA California Emergency Medical Services Agency
EOC Emergency Operations Center
EOP Emergency Operations Plan
FEMA Federal Emergency Management Plan
FMS Federal Medical Station
HARD Hayward Area Recreation & Park District
HFD Hayward Fire Department
HPD Hayward Police Department
ICS Incident Command System
IHP Individual and Household Program
LTRG Long-Term Recovery Group
MMAA Master Mutual Aid Agreement
MOU Memorandum of Understanding
Shelter Management Plan December 2025
iv
MRC Medical Reserve Corps
NDMS National Disaster Medical System
NGO Non-Governmental Organization
NIMS National Incident Management System
NRF National Response Framework
NSS National Shelter System
OA Operational Area
PIO Public Information Officer
SEMS Standardized Emergency Management System
UASI Urban Area Security Initiative
Shelter Management Plan December 2025
5 1.0 INTRODUCTION AND OVERVIEW
The City of Hayward (the “City”), located within the Greater San Francisco Bay area, features rolling hills and a beautiful shoreline. Like all communities, the City also has predictable vulnerability to disasters. A recent update to the City’s Local Resilience Plan describes this vulnerability and places high priority on emergency management planning.
This Shelter Management Plan provides the City’s guidelines for implementing shelter and mass care operations following an incident or disaster event. Shelter and mass care operations are implemented at the local level and this plan presents methods by which shelter management operations can be coordinated citywide. The purpose of the Hayward Shelter Management Plan is to develop a coordinated approach for managing shelter activated in Hayward by leveraging local resources and capabilities as part of a Whole Community approach.
All communities can benefit from the lessons learned in other local jurisdictions and apply the state and federal standards that have been developed from those lessons learned through planning and preparing. By planning ahead, shelter operations can be integrated between community stakeholders, improving overall disaster response effectiveness.
In the United States, the Federal Emergency Management (FEMA) National Preparedness Goal, and the National Response Framework (NRF) establish mission areas and a set of core capabilities that recognize and standardize what must be achieved during disasters to save lives, protect property and the environment, and preserve the social, economic, cultural, and political structure of affected communities. The Shelter Management Plan focuses on the Mass Care Services mission area taking place within a disaster response phase and the associated core capabilities (Figure 1).
There are four major phases to shelter management operations – 1) Activation, 2) Population Evacuation, 3) Mass Care Services, and 4) Deactivation. The shelter activation phase can occur prior to a disaster event for noticed events (e.g., winter storm, wildfire) or immediately following a disaster for no-notice events (e.g., earthquake, landslide). This phase involves the deployment of interagency resources including personnel, equipment, and supplies to establish shelter locations. For the evacuation phase, guidance is provided to the community to ensure safe and orderly movement to designated shelters, while ensuring accessibility for all populations, including those with special needs and pets. The mass care services phase involves providing support services (i.e., shelter, health care, meals) to citizens affected by a disaster and the deactivation phase consists of steps taken to demobilize following completion of disaster recovery.
Shelter Management Plan December 2025
6 Figure 1. NRF Mission Areas, Core Capabilities
(source: FEMA, 2023)
It is important to note that shelter phases do not represent sequential steps and phases may occur out of order and some not at all depending on the nature of the incident. The following scenarios demonstrate the impacts that different types of disasters can have on shelter operations:
1. Following sudden disasters (e.g., earthquakes), shelter activation and the provision of mass care services may occur simultaneously to address immediate needs, bypassing the evacuation phase.
2. During a wildfire where the path and impact can be somewhat predicted, shelters may be activated and resources mobilized well in advance, but the evacuation might be delayed until the threat becomes imminent to specific areas.
3. Following a flood, the shelter deactivation phase might be postponed for an extended period, if individuals are unable return to their homes due to water damage and ongoing cleanup efforts, necessitating prolonged mass care services.
4. In advance of a forecasted winter storm, resources and personnel may be mobilized and quickly deactivated if the impact is less severe than anticipated.
5. In a scenario with multiple back-to-back incidents, such as aftershocks following an earthquake, some shelters may be activated for new evacuations while others are being deactivated as people return home, demonstrating the dynamic nature of emergency response.
The Shelter Management Plan addresses the resources and services that need be coordinated at the local level to support shelter and mass care services and aligns with the State of California’s Standardized Emergency Management System (SEMS) and Master Mutual Aid Agreement Shelter Management Plan December 2025
7 (MMAA) to coordinate external resources from the Operational Area (OA), region, and state, as needed.
The Shelter Management Plan is a management document intended to be read and understood before an emergency occurs. The content herein outlines the potential activities of all City Departments to conduct shelter management operations in alignment with state and federal statutes, regulations, and policies at the time of plan development.
This Shelter Management Plan is divided into the following sections:
Section 1 – Introduction and Overview. Section 1 provides a background and framework for the Shelter Management Plan, outlining its purpose, scope, and objectives. Section 2 – Methodology. This section describes the process through which the Shelter Management Plan was developed and will be updated.
Section 3 – Guidance Documents and Regulatory Requirements. Section 3 lists the guidance documents that provide the framework for the Shelter Management Plan. Section 4 – Roles and Responsibilities. This section describes the roles, responsibilities, and actions that local, state, and federal agencies, and other organizations will fulfill to perform or support shelter management operations.
Section 5 – Shelter Operations. Section 5 includes an overview of the processes for shelter activation, opening, delivery of mass care services, and deactivation. Section 6 – Shelter Resources. This section highlights resources available through various government levels and community partners to support shelter and mass care operations.
Section 7 – Finance and Accounting. This section identifies the basic accounting and recordkeeping requirements needed to qualify for reimbursement by state or federal emergency funds for shelter operations.
Section 8 – Community Outreach. This section outlines the plan for developing a City education and public information program regarding shelter operations. Section 9 – Plan Maintenance and Training. The needs for plan updates, and predisaster training for shelter management teams are discussed in this section. Section 10 – References. Sources utilized in preparation of this Shelter Management Plan are provided in the list of references.
Shelter Management Plan December 2025
8 2.0 METHODOLOGY
This Shelter Management Plan was prepared in conjunction with the update of the City’s Emergency Operations Plan (EOP). The Shelter Management Plan was developed using a comprehensive engagement and subject matter expert consultation strategy to develop content to ensure accuracy and applicability. The Hayward Fire Department (HFD) acted as the lead agency in developing the Shelter Management Plan through collaboration between Ganey Science (consultant) and representatives from City Community Services, American Red Cross, shelter owner/operators, and other community stakeholders. This strategy included meetings among HFD, its consultant, and agency representatives from other City Departments. Feedback from this team guided the framework of the plan. The resulting information, refined with extensive research of state and federal regulations, policies, and plans, resulted in the procedures outlined in this plan.
2.1 PLANNING ASSUMPTIONS
Planning assumptions for shelter management take into consideration the following ideas:
Preparedness implemented through pre-disaster education and emergency drills improves response outcomes including the public's ability to respond to evacuation orders and shelter directives.
Shelter operations will adhere to health and safety standards to prevent the spread of disease, manage chronic health conditions, and ensure the well-being of evacuees. Human, financial, and material resources may be insufficient to sustain mass care services throughout the duration of the shelter activation necessitating external support. Community-based organizations will play a critical role in coordinating access to recovery resources and services needed to transition clients out of the shelter. A significant incident will also impact surrounding jurisdictions; competition for resources with other jurisdictions will impact shelter management. Disasters result in large expenditures for labor, equipment, materials, and supplies. Authorization of FEMA Individual Assistance will require the City to identify and report damages to residential structures within the 60-day regulatory timeframe.
2.2 SHELTER OBJECTIVES
The sheltering objectives within this plan generally align with those established by the Alameda County Operational Area and Bay Area Urban Area Security Initiative (UASI) include the following:
Project the current and projected shelter needs from the disaster. Define the planning assumptions.
Identify agencies supporting mass care and sheltering operations and define their roles. Describe the resources required for mass care and sheltering operations, and the systems and processes for integrating external resources. Identify recommended priorities.
Establish a response timeline of tasks for mass care and sheltering operation.
Shelter Management Plan December 2025
9 Facilitate the transition of displaced populations from shelters to interim and long-term housing solutions.
2.3 PLAN MAINTENANCE
For this Plan to maintain viability, the document will be updated regularly, and personnel should be trained on the content prior to a disaster. State and federal sheltering guidance is updated regularly based on best practices and lessons learned from recent disasters. Regular updates are intended to ensure the plan remains in alignment with current program guidance.
The City will facilitate an annual review of their Shelter Management Plan with the shelter management team. The plans will be updated based on organizational changes, new policies and guidance, and lessons learned from incidents or events that result in shelter activation(s).
Shelter Management Plan December 2025
10 3.0 GUIDANCE DOCUMENTS AND REGULATORY REQUIREMENTS
3.1 STATE EMERGENCY MANAGEMENT SYSTEM (SEMS)
The SEMS is California’s emergency response system. It began in 1993, in response to the state’s frequent hazard threats. The National Incident Management System (NIMS) mirrors SEMS for use nationwide. The objective of SEMS is to improve the coordination of state and local emergency response. All local governments must implement SEMS in multi-jurisdictional or multiagency emergency responses to be eligible for state reimbursement of response-related personnel costs. Section 3 of SEMS guidelines describes requirements of the City during activation of emergency management operations in terms of the local organizational structure and the coordination of response and recovery activities with the OA, State, and Federal government.
3.2 NATIONAL INCIDENT MANAGEMENT SYSTEM (NIMS)
The National Incident Management System (NIMS) sets federal standards for response and recovery coordination, guiding efforts across all levels of government and with non-governmental organizations (NGOs) and private sector partners. This system equips response and recovery personnel with shared vocabulary, systems, and processes allowing disaster efforts to be scaled up and personnel from different backgrounds to work together.
3.3 CALIFORNIA DISASTER RECOVERY FRAMEWORK (CDRF)
The California Disaster Recovery Framework (CDRF) establishes the overall disaster recovery strategy for the State of California. This framework guides how state entities organize, operate, and utilize existing resources to promote effective recovery to support local government. It also provides an overarching framework to assist local and tribal governments, the private sector, NGOs, and other emergency managers to plan for and execute disaster recovery operations in California. The CDRF is also a resource for how to access anticipated state and federal disaster assistance programs following a disaster.
3.4 ALAMEDA COUNTY EMERGENCY OPERATIONS PLAN (EOP)
The Alameda County EOP and supporting annexes provide an overview of the jurisdiction’s approach to emergency operations. It identifies emergency response policies, describes the response and recovery organization, and assigns specific roles and responsibilities to County departments, agencies, and community partners. The Plan has the flexibility to be used for all emergencies and is intended to facilitate response and recovery activities efficiently and effectively. This Plan also serves as a reference for other local governments in the OA, including Hayward.
The Mass Care and Shelter Annex to the Alameda County EOP outlines the roles and responsibilities of the OA for coordinating care and shelter activities as well as provides information on shelter types and locations, available resources, and planned shelter and mass care services. The lead agency for implementation of the plan is the Alameda Shelter Management Plan December 2025
11 County Social Services Agency, which maintains the County’s emergency shelters and hotel vouchers program among other human and social services programs (e.g., CalFresh, CalWORKs, Medi-Cal).
3.5 HAYWARD EMERGENCY OPERATIONS PLAN (EOP)
This Shelter Management Plan represents a functional annex to the City of Hayward’s EOP, and the authorities, policies and procedures described in the latest version of the EOP serve as an overarching framework for the implementation of shelter management operations.
Shelter Management Plan December 2025
12 4.0 ROLES AND RESPONSIBILITIES
Disaster recovery efforts begin at the local level at the City of Hayward and the leadership roles for shelter management and functional area leads for recovery tasks are listed in this section.
Disasters of higher magnitude may require supplemental state or federal assistance. This section describes the relevant responsibilities of applicable government agencies, as well as the roles of the private sector, NGOs, and residents.
4.1 CITY ROLES
As the agency designated with lead authority, the City of Hayward Community Services Division will serve as the lead agency for shelter operations in partnership with the American Red Cross Northern California Coastal Region (ARC).
Lead Agency City of Hayward, Community Services Division (CSD) in partnership with American Red Cross, Northern California Coastal Region (ARC) Supporting
Partners
City of Hayward Disaster Service Workers (DSW)
Hayward Area Recreation and Park District (HARD)
Hayward Fire Department (HFD)
Hayward Police Department (HPD)
HPD Animal Services
Various Facility Owner/Operators
Various Non-Governmental Organizations (NGOs)
The City of Hayward and its partners shall carry out the activities below in support of mass care and shelter operations following an incident or disaster event that results in the activation of emergency shelters.
CSD (IN PARTNERSHIP WITH ARC)
Preparedness
Assess and approve shelter locations prior to incident/disaster event. Develop and maintain site-specific shelter profiles.
Establish Memoranda of Understanding (MOU) with interagency partners to increase local capability and capacity.
Establish emergency contracts or MOUs for shelter wraparound services (e.g., janitorial services, transportation).
Facilitate joint training and exercises to maintain shelter and mass care capability.
Response
Staff the Care & Shelter Branch at the Emergency Operations Center (EOC) during activation.
Assess shelter and mass care needs and identify response requirements. Coordinate shelter and feeding operations.
Coordinate the bulk distribution of personal relief supplies.
Shelter Management Plan December 2025
13 Provide public information to disseminate about mass care services. Coordinate situational awareness with the EOC and Agency Representatives. Coordinate/Facilitate the delivery of shelter and mass care services. Communicate resource gaps to the EOC.
Document expenses resulting from shelter and mass care operations.
Recovery
Facilitate the transition to recovery through the provision of recovery resources to shelter clients.
Organize local community-based organizations into a Long-Term Recovery Group that can serve the long-term recovery needs of survivors, as needed. Submit documentation on disaster-related shelter and mass care expenses to submit for reimbursement, if eligible.
Facilitate after-action process to capture best practices and lessons learned to inform updates to the plan.
CITY OF HAYWARD DSWS
Preparedness
Participate in training and exercises with response partners to ensure readiness for shelter operations.
Response
Staff shelters and facilitate the delivery of sheltering and mass care services in collaboration with partners.
Assist with supply chain logistics to supply/resupply the shelter. Assist with the setup of the shelter according to floorplan layout. Document conditions of the shelter facility prior to opening. Communicate shelter status throughout the duration of activation.
Recovery
Assist with the demobilization of the shelter and return of the facility to pre-shelter status. Conduct joint walkthrough to document facility condition prior to returning the site to the facility owner/operator.
Submit cost summary of disaster-related expenses encumbered as a result of shelter operations.
Participate in after-action reporting process to capture best practices and lessons learned.
FACILITY OWNER-OPERATORS
Preparedness
Update MOU(s) with the City of Hayward regularly.
Shelter Management Plan December 2025
14 Communicate any changes in processes or designated points of contact responsible for MOU execution and facility access.
Facilitate access to facilities to conduct shelter assessments and mass care exercises, when possible.
Response
Make facilities available for use as shelters
Communicate facility availability with the Care & Shelter Branch Transfer facility control to designated shelter manager Deliver any additional services detailed in established MOU Recovery
Submit documentation of any damages to the facility identified during joint walkthrough. Submit cost summary of disaster-related expenses encumbered as a result of shelter operations.
Participate in after-action reporting process to capture best practices and lessons learned.
HAYWARD AREA RECREATION AND PARK DISTRICT (HARD)
Preparedness
Participate in training and exercises with response partners to ensure readiness for shelter operations.
Update MOU(s) with the City of Hayward regularly.
Communicate any changes in processes or designated points of contact responsible for MOU execution and facility access.
Facilitate access to facilities to conduct shelter assessments and mass care exercises, when possible.
Response
Facilitate the preparation of HARD-owned facilities to serve as emergency shelters. Facilitate access to recreational and psychosocial support services to shelter clients in coordination with CSD and ARC.
Recovery
Submit documentation of any damages to the facility identified during joint walkthrough. Submit cost summary of disaster-related expenses encumbered as a result of shelter operation.
Participate in after-action reporting process to capture best practices and lessons learned.
Shelter Management Plan December 2025
15 HAYWARD FIRE DEPARTMENT (HFD)
Preparedness
Assist with the development and review of site plans for shelters, including planning for the provision of emergency medical services and patient-facility transport. Establish MOU or emergency contract with clinical providers and hospitals/health care facilities for onsite clinical support and patient transport, as needed.
Response
Facilitate the delivery emergency medical services within the shelter setting through coordination of City resources and/or leveraging of MOUs. Request additional resources through the OA leveraging the State MMAA, as needed Recovery
Submit cost summary of disaster-related expenses encumbered as a result of shelter operations.
Participate in after-action reporting process to capture best practices and lessons learned.
HAYWARD POLICE DEPARTMENT
Preparedness
Assist with the development and review of site plans for shelters, including the identification of traffic control needs, establishment of ingress and egress, and other public safety considerations.
Response
Provide staffing to support site security during client intake and operation of the shelter, as available.
Assist with the establishment of traffic control measures, as needed.
Recovery
Submit cost summary of disaster-related expenses encumbered as a result of shelter operations.
Participate in after-action reporting process to capture best practices and lessons learned.
HAYWARD POLICE DEPARTMENT, ANIMAL SERVICES
Preparedness
Assist with the development and review of site plans for shelters, including the provision of onsite and/or offsite animal care resources and services.
Shelter Management Plan December 2025
16 Response
Establish and operate animal shelters in conjunction with human shelters to ensure that pet owners can evacuate with their pets.
Manage and track the intake, care, and disposition of animals in emergency shelters. Provide supplies and equipment necessary for animal care during emergencies, such as crates, food, leashes, and medical supplies.
Recovery
Facilitate the reunification of pets with owners post-disaster and manage the adoption process for unclaimed animals.
Submit cost summary of disaster-related expenses encumbered as a result of shelter operations.
Participate in after-action reporting process to capture best practices and lessons learned.
NON-GOVERNMENTAL ORGANIZATIONS (NGOS)
Preparedness
Participate in training and exercises with response partners to ensure readiness for shelter operations.
Response
Provide specialized services and support, such as health services, family reunification, counseling, and legal assistance, complementing the basic services offered at shelters. Mobilize the collection and distribution of emergency supplies as well as the provision of technical or financial resources.
Recovery
Organize a Long-Term Recovery Group (LTRG) to facilitate access to goods and services, as needed.
Implement disaster case management system to capture information on and address disaster-related unmet needs, as needed.
Submit documentation of disaster-related expenses encumbered as a result of shelter operations.
Submit documentation of any donations and volunteer hours. Donated resources, including labor, may offset the non-Federal share of Emergency Work Projects. Participate in after-action reporting process to capture best practices and lessons learned.
4.2 OPERATIONAL AREA ROLES
An OA represents an intermediate level within the state emergency services organization structure and consists of the county and all political subdivisions within the county area. The City of Hayward resides within the OA of Alameda County. The OA was established by a January 1995 Agreement for Participation in Alameda County Operational Area Emergency Management Shelter Management Plan December 2025
17 Organization. All the cities in the County including Hayward are participants in this Agreement.
The OA has the following responsibilities during an emergency:
Implement OA Emergency Response Plan.
Establish and maintain the Operational Area Emergency Operations Center (EOC). Coordinate the utilization of County, other local government, state and federal resources within the OA.
Support operations conducted by local governments within the County in accordance with SEMS and approved mutual aid and operations plans.
In alignment with these overarching responsibilities, the OA is also responsible for the following tasks during a catastrophic event resulting in the activation of emergency shelters:
Implement local activities identified the OA Shelter and Mass Care Annex. Support public entities within the OA to conduct shelter operations in accordance with SEMS and approved mutual aid and operations plans.
4.3 STATE ROLES
State agencies provide guidance, technical assistance, and direct support for local shelter and mass care operations. Roles and responsibilities of State agencies involved in shelter and mass care operations are as follows:
CALIFORNIA DEPARTMENT OF SOCIAL SERVICES
• Provides standards and best practices for the delivery of shelter and mass care services. • Coordinates the deployment of the Volunteer Emergency Services Team, intended to assist with mass care and shelter operations including support at emergency shelters and disaster recovery centers.
• Coordinates the deployment of the Functional Assessment Service Team, intended to ensure individuals with disabilities and/or access and functional needs obtain the resources needed to live as independently as possible.
• Administers FEMA Disaster Case Management Program
• Administers State Supplemental Grant Program, intended to provide grant funds to disaster survivors who have suffered damage as a result of a presidentially declared disaster.
CALIFORNIA EMERGENCY MEDICAL SERVICES AUTHORITY (EMSA)
• Co-administers the Regional Disaster Medical Health Coordination Program intended to support regional information flow and resource management. • Coordinates the deployment of Ambulance Strike Teams to support medical transport from shelters, as needed.
• Coordinates the deployment of California Medical Assistance Teams (CAL-MAT) to support health and medical needs within shelters.
Shelter Management Plan December 2025
18 CALIFORNIA GOVERNOR’S OFFICE OF EMERGENCY SERVICES (CAL OES) • Serve as a liaison between state and federal agencies for assistance programs. • Provide industry standards and best practices for coordination of response and recovery resources.
• Serve as the administrator of disaster grants for reimbursement of shelter, mass care, and temporary housing operations.
• Provide guidance on documentation requirements to seek reimbursement.
4.4 FEDERAL ROLES
Federal agencies support shelter operations by providing direct services, equipment, supplies, and technical assistance. An overview of the roles and responsibilities of federal agencies involved in shelter operations follows:
FEMA
Coordinates emergency resources following a federal emergency declaration. o Emergency Support Function #6, Mass Care.
o Emergency Support Function #8, Public Health & Medical. Delivers recovery resources through the Individual Assistance program, if authorized. o Temporary Shelter Assistance Program.
o Rental Assistance Program.
o Disaster Case Management Program.
o Direct Housing, if there is limited temporary housing available. Administer the FEMA Public Assistance Program for Category B: Emergency Protective Measures.
DEPARTMENT OF HEALTH AND HUMAN SERVICES (DHHS)
Primary federal entity for Emergency Support Function (ESF) #8 - Public Health and Medical.
Provides medical and disaster behavioral health resources including personnel, supplies, and equipment.
Responsible for the deployment of Federal Medical Stations (FMS) to support mass care operations.
Provides strong technical assistance and training support to State and local agencies on the request, receipt, and utilization of equipment and supplies. Provides veterinary medical support.
US SMALL BUSINESS ADMINISTRATION
Provides low-interest loans to small businesses, including landlords, to assist with disaster impacts.
Supports disaster recovery center operations to assist survivors with recovery needs.
Shelter Management Plan December 2025
19 4.5 PRIVATE SECTOR ROLES
Private businesses can play a large role in supporting disaster recovery needs and aiding survivors with the return to their homes. Through public-private partnerships, private sector resources can be leveraged to complement local, state, and federal recovery efforts in areas where there may be resource gaps due to program limitations, applicant eligibility, etc. Potential roles and responsibilities of private sector and philanthropic partners are described here.
BEHAVIORAL HEALTH PROVIDERS
Integrating disaster behavioral health support within the shelter can help mitigate the impact of trauma and stress often experienced by survivors. By providing access to mental health professionals within shelters, individuals experiencing emotional and psychological reactions can receive immediate support. This approach can help foster a sense of safety and stability in an otherwise high-stress situation.
CHILDCARE AND EDUCATION PROVIDERS
Access to childcare and educational providers within the shelter and during the early recovery phase can increase the capacity of shelterees to address initial recovery needs. This support can contribute to a calmer shelter setting for all clients by ensuring children and youth have structured activities. This is especially helpful as parents work to address initial recovery needs related to the disaster. To minimize disruptions, childcare and education services should be established prior to a disaster to maximize support to families throughout the sheltering and early recovery process.
GROCERY AND BIG BOX STORES
Grocery and “big box” stores can provide significant contributions to disaster recovery efforts and the return of survivors to their homes by providing access to essential goods, offering employment, and participating directly in recovery efforts. Many also play a disaster philanthropy role through in-kind donations, the implementation of recovery grants, partnering with relief organizations, donating equipment, and by providing direct cash assistance. This role helps survivors return to their homes and supports the broader recovery and rebuilding process.
HEALTH CARE FACILITIES
Health care facilities, including long-term care and skilled nursing facilities, can support shelter operations by absorbing clients with long-term care needs when deactivating shelters. They can also receive shelter clients that require high-acuity or chronic care needs, ensuring individuals receive necessary medical care within the proper setting. This collaboration can be essential in facilitating shelter closure in situations where continued medical services are required. Health care facilities can also be leveraged to provide consultation for individuals with chronic care needs, such as feeding options for shelter clients with dietary restrictions.
Shelter Management Plan December 2025
20 PHARMACIES
Collaboration between shelters and pharmacies can help shelter clients with accessing necessary medications during a disaster and can also provide health consultations to shelter clients. Through public messaging and community preparedness, individuals should also be encouraged to refill any important prescription medications prior to arriving at the shelter. Clear communication between shelters and pharmacies, aids in smoother transitions in emergency settings.
4.6 NON-GOVERNMENTAL ORGANIZATIONS (NGO) ROLES
The City of Hayward, Community Services Division works to build capacity around shelter operations through the engagement of local partners to prepare for future disasters. Building partnerships with non-governmental organizations (NGO) including community-based organizations, community foundations, churches, and neighborhood associations can help to quickly establish a LTRG to coordinate resources and services to disaster survivors.
As a best practice, the City works with NGOs to align planning needs for vulnerable populations to support the coordination of shelter and mass care services during an emergency. In accordance with federal guidance, this assessment includes the steps below. Collect Population Data: Collect data on the demographics of the city, including information on economic disadvantage, language and literacy, medical issues and disabilities, geographical/social isolation, and age.
Estimate Size of Priority Populations: Use the collected data to estimate the number of people in each at-risk population category.
Identify Supporting Organizations/Agencies: Identify organizations and agencies that work with at-risk populations and establish contacts with key individuals who can provide assistance.
Engage Key Contacts: Facilitate discussions with the identified key contacts to understand the specific needs and challenges of at-risk populations in the community. Maintain Regular Communication: Stay connected with the key contacts and establish MOUs, where appropriate, to coordinate situational awareness and resources to at-risk populations.
Following a disaster, NGOs should be assembled into an LTRG as quickly as possible to establish a network for the delivery of recovery resources. Once established, relief funds can then be channeled through the through the LTRG, forming a coordinated and collaborative approach to recovery, rather than individual organizations duplicating efforts. This system can be leveraged to deliver resources through disaster case managers, including resources that can assist disaster survivors with replacing damaged items and returning to their homes. This system can also help survivors access disaster behavioral services, employment assistance, and other services so their focus can remain on other aspects of the recovery process.
NGO partnerships with community foundations and philanthropic organizations can also provide benefits to support community recovery needs and help facilitate the transition of survivors out of Shelter Management Plan December 2025
21 sheltering or temporary housing. Through collaboration with NGOs to understand survivor needs, philanthropic contributions can be targeted to address gaps in available state and federal resources.
Shelter Management Plan December 2025
22 5.0 SHELTER OPERATIONS
Shelter operations include steps to provide a safe place for individuals and families affected by a disaster to rest and receive mass care services. This section provides information regarding the execution of shelter operations. Hayward shelter profiles are provided in Appendix A.
Note: For additional position-specific details, refer to Appendix B – Shelter Job Action Sheets and FEMA-ARC Shelter Field Guide (P-785).
5.1 SHELTER ACTIVATION
NOTIFICATION AND STAFF ACTIVATION
Following, or in anticipation of, a disaster event that requires the activation of emergency shelters, the City of Hayward Community Services Division (CSD), in coordination with ARC, will determine the need to activate personnel under the Care and Shelter Branch. As needed, activation notices will be issued to all relevant supporting partner organizations, City departments, or communitybased organizations. Notification will be issued in accordance with procedures outlined in the City of Hayward EOP and used as a means to provide known information about the event, reporting instructions, and any necessary directions specific to the event.
Upon notification of an event, CSD will begin planning efforts to include:
1. Defining the extent of required Care and Shelter Branch support.
2. Identifying potential response/resource requirements and needs.
3. Placing relevant personnel on standby.
4. Determining Care and Shelter Branch activation and staffing requirements.
SHELTER SETUP
Prior to setting up the shelter, the Shelter Manager should conduct an inspection of the facility with the facility operator-owner. The condition of the shelter, including any damages that exist prior to taking possession of the facility should be documented in the Shelter Shift Inspection Form (see Appendix C – Shelter Management Forms).
External and internal facility space should be allocated according to space availability as detailed in shelter profiles developed for each facility, which are maintained within the National Shelter System (NSS) database as well as by CSD (see Appendix A – Shelter Profiles). This includes areas for parking, drop-off, registration, sleeping, children and family interaction, household pets, food preparation and serving, health and mental health services, recreation, storage areas, shelter management offices, and staff.
Equipment and supplies necessary to support service areas include the following:
Communications equipment (phones, computers, radios, etc.). Food and food service supplies/equipment.
Sanitation supplies/equipment.
Shelter Management Plan December 2025
23 Children’s and infants’ supplies.
Universal/accessible cots.
Blankets.
Pillows (if available).
Personal hygiene supplies.
Towels.
Durable medical equipment (e.g., wheelchairs, oxygen concentrators). First aid and medical supplies.
Potable water.
Administrative supplies & signage.
Tables and chairs.
Entertainment & recreational materials.
The Regional Disaster Shelter Supply program, managed by Alameda County Office of Emergency Services serves as a source of supplies to initiate shelter activation. Through the program, Hayward is able to access a shelter trailer equipped with start-up supplies for up to 75 people. In addition to the Regional Disaster Shelter Supply, ARC maintains shelter trailers with similar supplies that are available upon request.
SHELTER OPENING
Immediately prior to opening the shelter, the Shelter Manager should conduct a facility inspection to ensure the shelter environment is safe, secure, and meets established standards. This includes documenting the condition of the facility, lighting, fire extinguishers, emergency exits, and accessibility for people with access and functional needs. In addition, an assessment of services including available equipment, supplies, and personnel should be completed to determine readiness to sustain shelter operations over the anticipated duration of the event.
5.2 POPULATION EVACUATION
Evacuation is defined as the organized, phased, and supervised withdrawal, dispersal, or removal of civilians from dangerous or potentially dangerous areas, and their reception and care in safe areas. A population or community may need to evacuate and seek shelter due to a hazard that is either threatening the area or has already occurred. In situations where evacuation is required, there are a number of considerations that should be taken into account to ensure the process is safe and organized.
TRANSPORTATION TO THE SHELTER
Transportation accommodations may be needed to mobilize vulnerable populations to the shelter, especially for individuals with access and functional needs or those unable to independently reach activated shelters. In addition, transportation resources may be needed to move shelter clients under situations where an activated shelter(s) has reached capacity. Potential transportation accommodations may include the following:
Shelter Management Plan December 2025
24 Providing transportation services that include accessible vans or buses to accommodate individuals who use wheelchairs or other mobility devices. Ensuring the availability of staff or volunteers to assist individuals with disabilities in boarding and disembarking vehicles safely.
Working with the Public Information Officer (PIO) to increase awareness of transportation options and provide clear instructions on how to access these services. Working with transportation providers to alter routes, extend hours of operation, and otherwise ensure their services are available for those needing transport to the shelter. Leveraging NGOs and other community stakeholders to coordinate transportation arrangements and ensure safe travel to the shelter.
CLIENT INTAKE AND REGISTRATION
Client intake and registration is an essential function within a shelter as it helps to maintain site security and manage the needs of the shelterees. The registration process involves gathering information about the client using a client intake form and providing them with necessary accommodations to ensure essential needs are met while residing in the shelter.
The process of client registration includes the following steps and considerations:
1. Greeting: Upon arrival at the shelter, residents are greeted by registration staff who provide a warm welcome and make them feel comfortable.
2. Information Collection: Registration staff collect important information about shelter clients including the family/individual’s name, total number of family members, predisaster address, phone numbers, and email addresses. They also record the method of transportation used to reach the shelter and the primary language spoken by the family.
3. Privacy and Confidentiality: It is important to maintain the privacy and confidentiality of shelter client information. Registration staff should manage all personally identifiable information with care and store it securely.
4. Unaccompanied Minors: In cases where unaccompanied minors arrive at the shelter, registration staff should immediately notify local law enforcement and designate a staff member to accompany the minor until custody can be transferred.
5. Legal Status Concerns: Some clients may have legal status issues that affect their placement in the shelter, such as registered sex offenders or individuals with restraining orders. Registration staff should be aware of local laws and regulations regarding the sheltering of such residents and follow the necessary protocols. Shelter services should accommodate the needs of all disaster impacted individuals, independent of immigration status.
6. Shelter Information: Registration staff should provide residents with information about the shelter, such as shelter rules, schedules, and available services. This can be done through verbal communication, posting information on bulletin boards, and providing written materials in multiple languages.
Shelter Management Plan December 2025
25 5.3 MASS CARE SERVICES
Mass care refers to a wide range of humanitarian activities that provide life-sustaining support to individuals and families who are temporarily displaced or otherwise impacted by a disaster or emergency that disrupts their ability to provide for their basic needs. This includes services such as sheltering, feeding, distribution of emergency supplies, and support for individuals with special needs. Following a disaster, mass care services will be coordinated by the Care and Shelter Branch at the City of Hayward EOC through collaboration with government partners, community organizations, and the private sector.
During an emergency, information on mass care services must be reported to the Care and Shelter Branch to provide situational awareness needed to inform communitywide shelter operations.
CHILDREN SERVICES
A section of the shelter should be designated for the delivery of childcare services either by parents or through designated providers. In the delivery of child services, consideration should be given to providing separate areas for play and rest, with access to age-appropriate activities, inclusive of children with special needs. Collaboration between local government departments, NGOs, and the private sector can help ensure areas designated for children are well equipped with the appropriate supplies and have the proper staffing levels to account for the needs of children within the shelter. health and security needs. Working with childcare professionals and child welfare agencies before opening a shelter can help establish quality standards for provision of care to children while in the shelter. This includes safety and security provisions such as child identification and family reunification protocols as well as measures for upholding health and sanitization standards.
DORMITORY SERVICES
The goal of the dormitory area of the shelter is to provide a comfortable and secure resting space for shelter clients during their stay. This includes lodging accommodation for the shelter clients including those with access and functional needs. Dormitory services within a shelter include setting up and assigning sleeping areas, coordinating the provision of cots, pillows, blankets, and personal hygiene supplies, and maintaining a healthy and safe environment for shelter clients to either sleep at night or rest during the day. Some important considerations to take into account within the shelter setting include allocating separate spaces for different groups, distributing supplies and monitoring inventory levels, and conducting safety checks throughout duration of shelter activation. Dormitory staff work closely with logistics to procure necessary supplies and equipment, communicate shelter rules to residents, and coordinate with security personnel to maintain a safe and quiet environment during sleeping hours. Overall, dormitory services involve setting up and managing the dormitory area, enforcing rules and guidelines, ensuring the safety and security of residents, and maintaining records and reporting as necessary.
Shelter Management Plan December 2025
26 5.4 SHELTER DEACTIVATION
Deactivation will occur at the point when no one is in the shelter or other arrangements can be made for a few remaining individuals. Deactivation of a shelter must be approved by the EOC Director and coordinated with the ARC.
Shelter Management Plan December 2025
27 6.0 SUPPORTING SHELTER RESOURCES
6.1 OPERATIONAL AREA RESOURCES
ALAMEDA COUNTY DISASTER PREPAREDNESS HEALTH COALITION (DPHC) The Alameda County Disaster Preparedness Health Coalition (DPHC) is a voluntary multidisciplinary, multi-agency body created to coordinate healthcare preparedness for all-hazard emergencies through mitigation, planning, response and recovery. The primary role is to provide for communication and collaboration among the participating agencies in these activities. The coalition duties include: planning; organizing and equipping; training; exercising evaluation; shared information management and communication systems; response coordination; defining priorities for funding and potentially looking for other funding opportunities.
ALAMEDA COUNTY MEDICAL RESERVE CORPS (MRC)
The Alameda County Medical Reserve Corps (MRC) deploys healthcare professionals including physicians, nurses, pharmacists, dentists, veterinarians, and epidemiologists to enhance the community's public health and medical capabilities. MRC volunteers are fully credentialed and can be requested to assist with shelter and mass care operations to address any gaps in local resources.
ALAMEDA COUNTY VOLUNTEER ORGANIZATIONS ACTIVE IN DISASTER Alameda County Voluntary Organizations Active in Disaster is a humanitarian association of independent voluntary organizations that work together to coordinate disaster relief with the mission of providing efficient services to all disaster victims and eliminating the duplication of services. The organization meets regularly to train and exercise to prepare volunteer-based organizations to work together following a disaster.
6.2 STATE RESOURCES
AMBULANCE STRIKE TEAMS (AST)
Through EMSA, ASTs are positioned throughout the State to support local emergency medical service response, including medical transportation. There are both pre-designated and undesignated ASTs in California. Pre-designated ASTs are under contract with EMSA and consist of five ambulances and one Disaster Medical Support Unit (DMSU). This Unit provides enhanced communication ability to support field deployment, including medical supplies and provisions for AST personnel. Use of the Disaster Medical Support Unit and a requirement to provide ASTs is by contract with EMSA. Undesignated ASTs are organized at the local level and are not under contract with EMSA, although they may respond to requests from EMSA in times of need.
Shelter Management Plan December 2025
28 CALIFORNIA HEALTH MEDICAL RESERVE CORPS PROGRAM
The California Health Medical Reserve Corps Program can serve as a resource to increase capacity within local shelter and mass care operations following significant disaster events. This program is used to deploy a credentialed network of health and medical support volunteers capable of delivering assistance to disaster affected communities. Volunteers are trained in a variety of medical care and psychological support disciplines including medical treatment, disaster behavioral health, and support for chronic conditions.
CALIFORNIA MEDICAL ASSISTANCE TEAM (CAL-MAT) PROGRAM
The California Medical Assistance Teams (CAL-MAT) enhance disaster response in California by providing essential medical and support services in emergencies. Composed of medical professionals and non-medical support staff, CAL-MATs fill critical gaps in local and federal disaster responses, particularly in shelter operations and mass care. Modeled after the federal Disaster Medical Assistance Team (DMAT) program, CAL-MATs offer rapid medical services at shelters, fire base camps, and alternate care sites, among other locations. Members serve as temporary state employees during 14-day deployments, ensuring continuous care for disasteraffected Californians.
STATE SUPPLEMENTAL GRANT PROGRAM
California's State Supplemental Grant Program, administered by the California Department of Social Services, Disaster Services Branch, may provide grant funds to assist people who have suffered damage as the result of a presidentially declared disaster when the FEMA authorizes the Individual and Households Programs. The Program is 100 percent State funded. The grant may assist with any eligible items not already addressed by the FEMA Individual and Household Program (IHP). However, individuals must have applied to FEMA and maximized the IHP award in to be eligible for the State Supplemental Grant Program.
There is no separate application process for State Supplemental Grant Program. If an individual has reached the maximum amount of assistance under IHP, FEMA will automatically transmit their application to State Supplemental Grant Program.
6.3 FEDERAL RESOURCES
There are many federal programs that are intended to assist disaster survivors with sheltering as well as the transition from the shelter into temporary housing. These programs will be coordinated through a Joint Field Office or Area Field Office, jointly managed by Cal OES and FEMA.
Federal agencies maintain a variety of resources that are intended to assist local jurisdictions with the establishment and operation of emergency shelters prior to and following a disaster as well as the return of disaster survivors to their original housing. City preparation to integrate these resources into local operations can assist with increasing local capacity and capability. Unless staged or pre-deployed, local jurisdictions should anticipate at least 72-hours before significant state and federal resources arrive to assist.
Shelter Management Plan December 2025
29 DISASTER MEDICAL ASSISTANCE TEAM (DMAT)
A capability maintained by the US Department of Health and Human Services (DHHS), a DMAT is a 35-member team comprised of professional and paraprofessional personnel including doctors, nurses, pharmacists, paramedics, respiratory therapists, and support personnel trained to assist local public health and medical operations following a disaster including the provision of sheltering and mass care services. Operating under the National Disaster Medical System, DMATs are capable of establishing temporary medical facilities, administering medical care within shelters, and ensuring the health and safety of populations within a mass care setting. DMAT support helps ensure continuity of care within an environment in which access medical interventions may be limited.
DMATs are deployed to arrive on site 48- to 72-hours, post-disaster and maintain enough equipment and supplies to be self-sufficient for a at least 72 hours. Typically, a DMAT is deployed for 10 to 14 days before a new team is rotated into duty.
FEDERAL MEDICAL STATIONS (FMS)
As a resource contained within the Strategic National Stockpile (SNS), FMSs are maintained by the DHHS and designed for deployment when communities experience a terrorism event or largescale natural disaster that incapacitates or overwhelms the affected area’s medical care delivery system. An FMS may be deployed as either 250- or 50-bed medical units and are equipped to provide shelter and care for displaced individuals who have non-acute medical and mental health or other health-related needs not provided for by a general shelter.
Each FMS is a flexible, modular, and scalable unit that can be staged in a large local facility within a jurisdiction. A 250-bed FMS requires an existing 40,000 square-foot facility to be fully set up and does not arrive with tentage or personnel to operate.
Each FMS is equipped with beds, medical supplies, and pharmaceuticals including IV supplies, basic medical instruments, wound care supplies, and common medications. They also arrive with portable showers, restrooms and handwashing stations to ensure a functional temporary medical care environment.
While the physical assets are provided by the federal government, staffing typically comes from the Public Health Service, Medical Reserve Corps, local healthcare volunteers, or through contracts with professional medical staffing companies.
Each FMS contains 72-hours’ worth of supplies and must be supported through local wraparound services to sustain mass care services over an extended period. Impacts to the supply chain infrastructure necessitate that the resupply process be initiated upon activation of an FMS.
FEMA INDIVIDUAL ASSISTANCE, INDIVIDUAL AND HOUSEHOLD PROGRAM (IHP) FEMA IHP provides a suite of housing and financial assistance grants to support disaster survivors impacted by a presidentially declared disaster with addressing gaps in assistance by private insurance (see Figure 2). IHP offers support for a period of up to eighteen months, with Shelter Management Plan December 2025
30 an initial standard pay-out of two months’ rent. IHP Housing Assistance includes financial assistance and direct assistance. Financial assistance is paid directly to the eligible individual or household, and includes rental assistance, lodging expense reimbursement, home repair assistance and home replacement assistance.
Direct Housing
Direct Housing is a form of assistance under FEMA IHP that may be approved when rental assistance is found to be insufficient to provide housing to disaster survivors (e.g., due to unavailability, high rental rates). Direct Housing requires federal authorization based on assessment of available housing in the disaster area and involves the deployment Transportable Temporary Housing Units such as Travel Trailers or Manufactured Housing Units to provide access to temporary housing.
To receive IHP assistance, disaster survivors must provide proof that they are documented U.S. citizens, non-citizen nationals, or qualified aliens whose needs cannot be met by private insurance and whose expenses were a direct result of a federally declared disaster. For Fiscal Year 2023, there is a $41,000 cap on total assistance to individuals/households under the FEMA IHP program.
Transitional Sheltering Assistance
FEMA’s Transitional Sheltering Assistance is an IHP program that assists eligible disaster survivors in need of short-term lodging following a federally-declared disaster. Transitional Sheltering Assistance is funded primarily by FEMA, with a 25-percent cost share with the state and local. Under this program, disaster survivors may be eligible to stay in a hotel or motel for a limited period of time. Room fees and taxes are covered by FEMA, although incidentals and food are not. Any funds provided through Transitional Sheltering Assistance are deducted from the $41,000 Individual Assistance limit that eligible disaster survivors are entitled to. The initial period of assistance is 5-14 days, but this period can be extended, as needed.
Disaster Case Management Program
The Disaster Case Management Program is an IHP program that is administered by the California Department of Social Services that provides supplemental disaster case management services to vulnerable populations following a presidential disaster declaration in which FEMA Individual Assistance is authorized. The DCMP provides a limited-term, holistic case manager that assists individuals and households to identify and address unmet needs caused by the disaster. Case managers work with the survivor to develop a comprehensive recovery plan to assist the survivor with any un-resourced items, support, or assistance that has been assessed and verified as necessary for the survivor to recover from a disaster.
Shelter Management Plan December 2025
31 Figure 2. FEMA Individual Assistance, Individual and Households Program (source: FEMA, 2024)
Shelter Management Plan December 2025
32 7.0 FINANCE AND ACCOUNTING
7.1 COST TRACKING AND REPORTING
Accurate and complete cost tracking is critical to obtain assistance for disaster-related costs.
Emergency protective measures can be eligible for reimbursement. If the incident allows for warning, the City will begin tracking costs once the threat has been identified. If there is no warning, the City will begin tracking costs as soon as possible. Accounting best practices for tracking costs includes the following:
Identify a person that will be responsible for compiling disaster-related costs for the jurisdiction.
Establish a cost code for disaster-related costs.
Establish a file structure for each site where recovery work has been or will be performed.
Maintain accurate disbursement and accounting records to document the work performed and the cost incurred.
Obtain and review applicable local, state, and federal policies and regulations. Document administrative costs.
Begin compiling recovery project documentation, including:
o Executed contracts, bids, periods of performance, and locations worked; o Property insurance;
o Donated resources (labor, equipment and materials);
o Mutual aid;
o Force account labor;
o Force account equipment;
o Equipment rental agreements;
o Fuel logs;
o Materials including meals and gas purchases;
o Description of damage;
o Scope of work to be completed;
o Photos of damage;
o Copies of estimates;
o Maintenance records; and
o Site inspection records.
The City will coordinate with state and federal agencies to obtain disaster-specific cost tracking spreadsheets and templates. For detailed information regarding disaster related cost tracking and reporting requirement, refer to the City of Hayward EOP.
Shelter Management Plan December 2025
33 7.2 FUNDING SOURCES FOR EMERGENCY SHELTERING OPERATIONS
FEMA PUBLIC ASSISTANCE GRANT PROGRAM
The Stafford Act constitutes the statutory authority for most federal disaster response activities, especially as they pertain to FEMA and FEMA programs. The federal government provides several assistance programs through various agencies to support emergency sheltering operations, including response activities to evacuate at-risk populations.
The purpose of the FEMA Public Assistance Grant Program is to provide reimbursement to State and local governments and certain private nonprofit organizations for response and recovery activities that are related to a presidentially declared disaster. Through the program, FEMA provides reimbursement for emergency protective measures including population evacuation and sheltering, as well as for any preparatory activities carried out to mitigate impacts to the affected population.
Evacuation activities eligible for reimbursement through the Public Assistance Grant Program include, but are not limited to, the following:
Transferring patients from or back to medical or custodial care facilities as needed. Transporting individuals requiring emergency medical care to appropriate facilities. One-time evacuation transportation for survivors and their pets or service animals from pre-established locations, using vehicles like buses and trucks, ensuring accessibility. Paratransit services for senior citizens, individuals with disabilities, and those in nursing homes or who are homebound.
Stabilization of individuals injured during evacuation. Provision of food and water, and emergency medical care during transport. Tracking of evacuees and their belongings, including the use of microchips for animals.
Shelter and mass care activities eligible for reimbursement under the Public Assistance Grant Program include, but are not limited to, the following:
Costs related to leasing/renting facility space, utilities, generator use, storage of medical supplies and expenses need to make minor modifications (e.g., for ADA compliance, habitability, childcare, or animal shelter functionality). Staffing expenditures, including costs for medical and personal assistance staff, veterinarians, public information officers, social workers, food service and custodial staff, and National Guard personnel.
Provision of shelter supplies including meals, snacks, beverages, cooking supplies, pet care items, medical equipment and supplies, infant necessities, personal hygiene kits, entertainment, and communication tools.
Expenses for essential services including overall shelter management, staff supervision, cleaning, safety and security, supporting equipment, care for individuals with disabilities or special needs, emergency medical and veterinary services.
Shelter Management Plan December 2025
34 In situations where group (congregate) sheltering is determined to be insufficient, individual (noncongregate) sheltering may be funded under the Public Assistance Grant Program. Under the rare occasions where non-congregate sheltering is needed, FEMA approval is required and must be formally requested to include proper justification, an analysis of alternative options, expected program duration, information shelteree demographics, and breakdown of services to be provided.
The FEMA Public Assistance Grant Program is a cost-sharing program. Cost share refers to the portion of disaster-related costs the federal government is responsible for funding. Per the Stafford Act, the federal cost share of assistance is not less than 75% of the eligible cost for emergency measures and permanent restoration. The remaining 25% is the responsibility of the State and local governments. The State serves as the grant administrator or the grantee. The grantee determines how the non-federal share is funded.
The policy guidance for these assistance programs changes and adapts with lessons learned from each disaster across the United States. The City must maintain awareness of current federal assistance program guidance and regulations related to federal funding for evacuation, emergency sheltering, and mass care services.
CALIFORNIA DISASTER ASSISTANCE ACT (CDAA)
The State can provide additional assistance for shelter and mass care operations through the California Disaster Assistance Act (CDAA). CDAA was created to coordinate resources, including funding, to local governments in support of disaster response and recovery activities. CDAA regulations govern the eligibility requirements for reimbursement of shelter and mass care operations within the state.
CDAA regulations allow for the provision of financial aid to local governments for disaster-related expenses, including shelter and mass care operations. CDAA can cover costs related to the operation of shelters, emergency services for the protection of life and property, and care for disaster survivors. CDAA also covers staff overtime and related costs for emergency personnel, supplies, materials, equipment necessary for shelter operation.
CDAA Regulations, Section 2930, state that emergency protective measures, undertaken in response to a disaster event resulting in a state of emergency proclamation by the Governor, to save lives, to protect public health and safety, and to protect improved property are eligible for state financial assistance.
7.3 PROCUREMENT REQUIREMENTS
USE OF FORCE ACCOUNT RESOURCES
Force account resources must be accurately documented during the response and recovery operations. Often, the use of force account labor and equipment can apply to the public entity’s share for disaster-related costs. Labor and equipment expenses may be eligible for state and/or federal reimbursement if documented properly. The City will document the pre-existing condition of any equipment used for shelter and mass care operations and determine if equipment is Shelter Management Plan December 2025
35 appropriate for use. The City will provide training to personnel that will be involved in shelter management and mass care operations, to include those responsible for tracking costs.
USE OF PROCUREMENT AND CONTRACTED SERVICES
The City may find it necessary to contract for shelter management and mass care services if operational needs exceed their force account resources, or if it is otherwise determined that securing contracted services is in their best interest. If contracted services are to be used for shelter management mass care services including the management of shelter sites and provision of services, contracts must meet federal procurement requirements to be eligible for reimbursement. The City may also need to implement its emergency procurement procedures during a disaster to support incident or event needs.
The City is responsible for conducting shelter management and mass care operations within areas under their authority to the greatest extent possible using internal resources, mutual aid, or contracted services. The use of resources, including staff, equipment, and supplies, will be documented and tracked by the local jurisdictions to support reimbursement of eligible expenses.
In the event that the City is unable to conduct their own shelter management and mass care operations, they can request assistance from the OA. The OA may provide support for shelter management and mass care operations to public entities within the OA in accordance with SEMS and approved mutual aid and operations plans.
Shelter Management Plan December 2025
36 8.0 COMMUNITY OUTREACH
Public information plays a crucial role in ensuring community safety during emergencies by effectively communicating vital details about evacuation orders, shelter openings, and the availability of mass care services. Timely and clear dissemination of this information helps individuals make informed decisions quickly, significantly reducing confusion and panic in highstress situations. By keeping the community well-informed, authorities can facilitate orderly evacuations, ensure people know where to find safe shelter, and direct them to necessary support services, thereby enhancing the overall response to the emergency.
The dissemination of public information following a disaster should be a coordinated effort and align with the principles of SEMS. This includes coordination with the OA and Region through a Joint Information System that ensures aligned messaging.
Public information messages might be developed to communicate the following information:
Evacuation orders and routes.
Shelter locations and opening times.
Available mass care services.
Safety and preparedness tips.
Road closures and traffic updates.
Emergency contact numbers.
Recovery assistance programs.
Utility outage updates and restoration times.
Health and safety warnings.
Donation and volunteer opportunities.
The City’s designated PIO will be responsible monitor public and media comments and address any conflicting information released through the media that might result in confusion among the general public and impact and impact emergency response efforts and recovery operations. As part of ongoing updates to the Shelter Management Plan the City intends to develop templated news briefings as well as public education materials and programs that provide consistent messaging to familiarize the community with measures that can be taken to prepare prior to arriving at a shelter. The public information and education campaign should include disaster preparedness brochures, press releases and/or public service announcements, social media posts, and the distribution of guidance in common areas throughout the community for access by citizens and visitors.
VULNERABLE POPULATIONS
Following a disaster there will be members of the community that are more prone to disaster impacts compared to others. These individuals may 1) experience challenges receiving disaster messaging through traditional communication channels, 2) be unable to understand the messaging due to communication barriers (e.g., limited English proficiency, access to technology, sensory disability), 3) be unwilling to act on the messaging due to mistrust of the message source, and/or 4) be unable to act on the messaging due to a lack of resources.
Shelter Management Plan December 2025
37 Partnerships with NGOs and human services providers will be essential to address existing gaps and coordinate the necessary assistance to vulnerable populations following a disaster. This ensures alignment of NGO activities with direction from emergency management officials and established priorities and objectives. During an emergency, these entities may be tasked with supporting activities aligning with their capability and capacity.
The roles and responsibilities NGOs can fill in support of the shelter and mass care mission include the following:
• Coordinate with City to identify vulnerable populations and incorporate strategies to assist these populations within the shelter and mass care setting. • Coordinate with City and volunteer organizations post-disaster to assist individuals with disabilities and access and functional needs with shelter-related needs. • Coordinate with City to provide public information regarding shelter operations to populations with communication barriers.
• Provide information on services and accommodations available to vulnerable populations within the shelter setting.
Shelter Management Plan December 2025
38 9.0 PLAN MAINTENANCE AND TRAINING
9.1 TRAINING SUPPORT
Personnel must be trained on shelter management policies and procedures to maintain a viable plan. The City will maintain an ongoing training and exercises program, which. will include shelter and mass care operations training and exercises. The following provides recommendations for shelter operations training:
The City will train new personnel in their specific job duties related to shelter and mass care operations.
Personnel with response responsibilities must maintain competence in SEMS as prescribed in Government Code §8607(c).
Personnel operating equipment must be trained to operate any equipment they are responsible for competently and safely.
Personnel performing shelter and mass care operations will be trained by the jurisdiction or a qualified designee.
Personnel with responsibility for preparing documentation for reimbursement should receive training on the FEMA Public Assistance Program.
Individuals identified as Shelter Managers will be trained on the regulatory requirements and operational considerations for shelter operations including:
Mass care and emergency assistance provisions.
Health and safety protocols.
Procurement procedures for acquiring shelter equipment, supplies, and services. Navigation of federal disaster grant programs.
Accommodating individuals with disabilities and access and functional needs. Accommodating for animals in disasters.
Virtual training options include the following:
FEMA IS-10.A: Animals in Disasters: Awareness and Preparedness. FEMA IS-11.A: Animals in Disasters: Community Planning. FEMA IS-22.1: Are You Ready? An In-depth Guide to Citizen Preparedness. FEMA IS-366.A: Planning for the Needs of Children in Disasters. FEMA IS-403: Introduction to Individual Assistance (IA) (Disaster Housing Plan). FEMA IS-405: Overview of Mass Care/Emergency Assistance. FEMA IS-662: Improving Preparedness and Resilience through Public-Private Partnerships.
FEMA IS-1000: Public Assistance Program and Eligibility – This is an 8-hour online course designed to provide an overview of Public Assistance project eligibility and requirements.
In-person training options include the following:
Shelter Management Plan December 2025
39 FEMA MGT-487: Mass Care - Shelter and Relocation Coordination. FEMA G-108: Community Mass Care Management.
FEMA G-358: Evacuation and Re-Entry Planning.
FEMA E/L/G 0191: Emergency Operations Center/Incident Command System Interface.
9.2 EXERCISES
Exercises are essential to maintaining readiness and in determining the effectiveness of plans, personnel, and resources in responding to events that require shelter activation. Workshops and onsite exercises will be conducted periodically to test the ability of the City to coordinate resources for debris operations.
Following exercises, an after-action report should be developed to document strengths and areas of improvement. An improvement plan should also be developed to list corrective actions, identify individuals or agencies responsible for completing the corrective actions, as well as indicating a timeline for completion.
Shelter Management Plan December 2025
40 10.0 AUTHORITIES AND REFERENCES
10.1 AUTHORITIES
LOCAL AUTHORITIES
• Hayward Emergency Operations Plan, 2025
OPERATIONAL AREA AUTHORITIES
• Alameda County Emergency Operations Plan, 2023
o ESF #6 Shelter and Mass Care Annex
REGIONAL AUTHORITIES
• San Francisco Bay Area Urban Area Security Initiative (UASI). 2023. Bay Area Care and Shelter Planning Toolkit, January 2023
STATE AUTHORITIES
• Joint Exercise of Powers Act: Government Code § 6500 et seq. • California Disaster Assistance Act (CDAA), Title 19, California Code of Regulations o Section 2930 – Emergency Protective Measures
FEDERAL AUTHORITIES
• FEMA Comprehensive Planning Guide 102 Version 2
• FEMA Direct Housing Guide, 2021
• FEMA Publication FP 104-009-2 – Public Assistance Program and Policy Guide 2020 • National Disaster Recovery Framework, Department of Homeland Security, June 2016 • National Response Framework, Department of Homeland Security, October 2019 • Sandy Recovery Improvement Act (SRIA), included as Division B of the Disaster Relief Appropriations Act, PL 113-2, signed into law January 29, 2013 • Robert T. Stafford Disaster Relief and Emergency Assistance Act, 42 U.S.C. § 5121 et seq., including the Sandy Recovery Improvement Act (SRIA), which amended Title IV of the Stafford Act, PL 113-2
• 23 U.S.C., § 125 – Emergency Relief, part of Moving Ahead for Progress in the 21st Century Act (MAP-21), signed into law July 6, 2012
• Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, 2 C.F.R. § 200 et seq.
• Emergency Planning and Community Right-to-Know Act, 42 U.S.C. § 11001 et seq.
Shelter Management Plan December 2025
41 10.2 REFERENCES
Centers for Disease Control (CDC). 2021. Access and Functional Needs Toolkit: Integrating a Community Partner Network to Inform Risk Communication Strategies. (available at CDC_Access_and_Functional_Needs_Toolkit_March2021.pdf)
CDC. 2015. Planning for an Emergency: Strategies for Identifying and Engaging At-Risk Groups. (available at https://www.cdc.gov/nceh/hsb/disaster/atriskguidance.pdf) CDC. 2010. Public Health Workbook to Define, Locate, and Reach Special, Vulnerable, and Atrisk Populations in an Emergency (available at https://emergency.cdc.gov/workbook/pdf/ph_workbookFINAL.pdf) U.S. Department of Homeland Security, Federal Emergency Management Agency (FEMA). 2021. Direct Housing Guide (available at: http://nhma.info/wpcontent/uploads/2021/07/FEMA-Direct-Housing-Guide-July-2021-Agenda-Item-2aiv.- FEMA-Direct-Housing-Guide_20210702_508_Final.pdf)
U.S. Department of Homeland Security FEMA. 2023. National Disaster Recovery Framework. (available at: https://www.fema.gov/sites/default/files/2020- 06/national_disaster_recovery_framework_2nd.pdf)
U.S. Department of Homeland Security, FEMA. 2023. National Preparedness Goal. (available at: https://www.fema.gov/emergency-managers/national-preparedness/goal) U.S. Department of Homeland Security FEMA. 2023. National Response Framework. (available at: https://www.fema.gov/emergency-managers/nationalpreparedness/frameworks/response).
U.S. Department of Homeland Security FEMA. 2023. Assistance for Governments and Private Non-Profits After a Disaster. (available at: https://www.fema.gov/assistance/public).
U.S. Department of Homeland Security FEMA. 2015. National Preparedness Goal Second Edition. Available at https://www.fema.gov/sites/default/files/2020- 06/national_preparedness_goal_2nd_edition.pdf.
U.S Department of Homeland Security FEMA. 2019. National Response Framework Fourth Edition. Available at https://www.fema.gov/sites/default/files/2020- 04/NRF_FINALApproved_2011028.pdf.
U.S. Department of Homeland Security FEMA. 2020. Public Assistance Program and Policy Guide. Available at https://www.fema.gov/sites/default/files/documents/fema_pappg-v4- updated-links_policy_6-1-2020.pdf.
Shelter Management Plan December 2025
42 U.S. Department of Homeland Security FEMA. 2015. Shelter Field Guide FEMA P-785.
Available at: https://www.nationalmasscarestrategy.org/wpcontent/uploads/2015/10/Shelter-Field-Guide-508_f3.pdf San Francisco Bay Area Urban Area Security Initiative (UASI). 2023. Bay Area Care and Shelter Planning Toolkit, January 2023. Available at
https://www.dropbox.com/scl/fo/kbkjrajfmk9a3e031clzc/h?dl=0&rlkey=nkasxx21p90erkt mtdf031hnp
Shelter Management Plan December 2025
43 APPENDIX A – SHELTER PROFILES
Table A.1 Shelter Profile Snapshot
Location Primary Point of
Contact
Dorm
Capacity
Evacuation
Capacity Primary
California State University – East
Bay
25800 Carlos Bee Blvd
Hayward, CA 94542
Rochelle Muse
510-885-3791 282 564 Rebecca Peieira
510-885-3793
Chabot College
25555 Hesperian Blvd
Hayward, CA 94545
Owen Letcher
924-485-5277 464 929 Ron Billy
510-723-7544
Cherryland Community Center
278 Hampton Rd
Hayward, CA 94541
Jose Gutierrez
510-825-1605 471 165 Phuc Le
510-224-0028
Hayward Area Senior Center
22325 N 3rd St
Hayward, CA 94546
Jose Gutierrez
510-825-1605 43 85 Phuc Le
510-224-0028
Matt Jimenez Community Center
28200 Ruus Rd
Hayward, CA 94544
Jose Gutierrez
510-825-1605 119 238 Phuc Le
510-224-0028
TOTAL 1,379 1,981 Secondary
Douglas Morrison Theater
22311 N 3rd St
Hayward, CA 94546
Jose Gutierrez
510-825-1605 0 217 Phuc Le
510-224-0028
Hayward Public Library
888 C St
Hayward, CA 94541
Main Phone
510-293-8685 70 377
San Felipe Community Center
2058 D St
Hayward, CA 94541
Jose Gutierrez
510-825-1605 61 173 Phuc Le
510-224-0028
Sorensdale Recreational Center
275 Goodwin St
Hayward, CA 94544
Jose Gutierrez
510-825-1605 52 150 Phuc Le
510-224-0028
TOTAL 183 917 Tertiary
Southgate Community Center
26780 Chiplay Ave
Hayward, CA 94545
Jose Gutierrez
510-825-1605 38 147 Phuc Le
510-224-0028
Weekes Community Center
27182 Patrick Ave
Hayward, CA 94544
Jose Gutierrez
510-825-1605 33 94 Phuc Le
510-224-0028
TOTAL 71 241
GRAND TOTAL 1,633 3,139
Shelter Management Plan December 2025
44 Shelter Name Address Shelter
Tier
Usable
Square
Footage
Dorm
Capacity
Evacuation
Capacity
Onsite Food
Preparation?
(Yes/No)
ADA
Compliant?
(Yes/No)
Limitations to
Use?
(Yes/No)
Signed
Agreement
with ARC?
(Yes/No)
Security
Provided by
Facility?
(Yes/No)
Cal State –
East Bay
25800 Carlos Bee Blvd
Hayward, CA 94542 Primary 11,280 282 564 Yes Yes Yes, Class schedules Yes Yes Chabot
College
25555 Hesperian Blvd
Hayward, CA 94545 Primary 18,584 464 929 Yes Yes Yes, Class schedules Yes No Cherryland
Community
Center
278 Hampton Rd
Hayward, CA 94541 Primary 9,415 471 165 Yes Yes Yes, Community events Yes No Hayward Area
Senior Center
22325 N 3rd St
Hayward, CA 94546 Primary 1,705 43 85 Yes Yes Yes, Community events Yes No Matt Jimenez
Community
Center
28200 Ruus Rd
Hayward, CA 94544 Primary 4,766 119 238 Yes Yes Yes, Community events Yes No Douglas
Morrison
Theater
22311 N 3rd St
Hayward, CA 94546 Secondary 0 0 217 No Yes, Partial
Yes,
Limited lodging Yes No
Hayward
Public Library
888 C St
Hayward, CA 94541 Secondary 2,830 70 377 No Yes
Yes,
Book areas
restricted
Yes No
San Felipe
Community
Center
2058 D St
Hayward, CA 94541 Secondary 3,462 61 173 Yes Yes Yes, Community events Yes No Sorensdale
Recreational
Center
275 Goodwin St
Hayward, CA 94544 Secondary 2,990 65 130 Yes Yes Yes, Community events Yes No Weekes
Community
Center
27162 Patrick Avenue,
Hayward, CA 94544 Tertiary 1,870 33 94 Yes Yes Yes, Community events Yes No Southgate
Community
Center
26780 Chiplay Ave
Hayward, CA 94545 Tertiary 2,736 38 147 Yes Yes Yes, Community events Yes No Shelter Management Plan December 2025
45 APPENDIX B – SHELTER JOB ACTION SHEETS
Job Action Sheets (JAS) for the following positions can be found in Appendix B:
1. Shelter Manager
2. Assistant Shelter Manager
3. Shift Supervisor
4. Registration Unit Leader/Registration Staff
5. Shelter Food Unit Leader/Feeding Staff
6. Dormitory Manager
7. Shelter Childcare Assistanct
Note: These JAS have been adapted from the American Red Cross Shelter Field Guide (FEMA P-785)
Shelter Management Plan December 2025
46 Shelter Manager Job Action Sheet
Position Summary
The Shelter Manager provides supervision and administrative oversight for all shelter operations. This person ensures that the needs of shelter occupants are being met. They supervise a work unit composed of service associates by assuming accountability for the assigned workers within the activity as well as being able to answer common questions on a day-to-day basis. He or she is in charge of making sure the other shelter staff roles are being filled and maintains communication with the Emergency Operations Center (EOC) through the Care and Shelter Branch.
Part of this communication involves reporting shelter counts back to the EOC to monitor shelter capacity. The Shelter Manager is responsible for scheduling and leading shelter staff meetings, briefings with shelter clients if appropriate, establishing shifts for shelter workers and working with all other shelter staff to ensure a smooth shelter operation.
Once shelter staff arrive at the shelter, the Shelter Manager should assign the following roles:
Registration
Feeding
Main Floor/Dormitory Management
Logistics
Additional staff can be assigned to roam and support shelter clients or other shelter staff. The Shelter Manager has responsibility for all those in the shelter and for requesting additional support from the EOC when needed.
Major Tasks
Responsible for all aspects/services of Shelter operation:
Registration
Dormitory
Food
Case Management
Medical/Behavioral Health
Childcare
Ensures the health and safety of all shelter staff and clients Monitors and resolves issues/problems by leveraging support staff and requesting additional resources
Authorizes all shelter expenditures for final approval by the Care and Shelter Branch Collects and maintains all shelter logs and submits all reports for the sheltering response Shelter Management Plan December 2025
47 Establishes contact with facility representative to activate the shelter when ready Ensure a shelter agreement is completed, the general facility has been assessed and any pre-existing damage is noted
Project staffing and other support requirements for the next 48 hours Coordinate recruitment of additional personnel
Organize and brief staff
Ensure that all essential positions are staffed
Ensure local affiliated and non-affiliated workers are used to the fullest extent by providing support, training, and evaluation
Request supplies and equipment and any support needed through Care and Shelter Branch.
Assess feeding options and discuss recommended solutions with supervisor and Food Services supervisor.
Establish a shelter log to capture significant actions, agreements, and accidents Ensure proper shelter identification both inside and outside of the shelter Ensure that welfare information and individual client services copies of shelter registration forms are forwarded to the Care and Shelter Branch. Keep all such information in secure location(s)
Ensure there are emergency medical services staff and security personnel at shelter, as needed and available
Develop a schedule for feeding, lights out, shelter rules and information board for all residents to view
Promote an environment that eliminates discrimination, harassment or favoritism of any sort and adheres to a zero-tolerance policy
Resolve staff conflicts and recognize when a conflict must be elevated to a higher level Organize and facilitate staff meetings as appropriate Seek guidance from Care and Shelter Branch, as necessary and appropriate. Follow and implement requests and direction received from supervisor. Monitor and support the quality of service delivery and morale of the workforce in order to achieve the mission statement of disaster services.
Coordinate with the EOC to request supplies, equipment, meals, etc., needed to sustain shelter operations.
Supervises:
Dormitory Team Leader
Shelter Management Plan December 2025
48 Registration Team Leader
Shift Supervisor
Reports to:
Care and Shelter Branch at the City EOC
Partner Agencies:
American Red Cross (ARC)
Initial Response
Conduct shelter facility walk-through (Facility Opening/Closing Assessment Form and Environmental Health Shelter Assessment Form) as available:
Facility Manager/Representative
Inspector of Buildings
Fire Inspector
Public Health Officer/Inspector
Logistic Manager
ARC Representative
Check in staff as they arrive and distribute Job Action Sheets (JAS) Hold initial staff briefing
Distribute forms and job aids
Supervise shelter set-up
Manager/Security/Communications Area
Registration Area
Food Preparation/Service Area
Dormitory Area
Childcare Assistance Area
Recreation Area
Medical Care Area/Quiet Area
Staff Break Area
Animal Care Area
Confirm shelter set-up and recommend approval to open to the Care and Shelter Branch Shelter Management Plan December 2025
49 Daily Shelter Operations
Monitor staff for burn-out and to resolve any interpersonal conflict. Report concerns to Care and Shelter Branch
Ensure continuous communications with the Care and Shelter Branch or EOC Manager Ensure shelters operate safely and efficiently and address needs as they arise Hold shift change briefings with staff and collect shelter logs:
Situational updates
Collect/Distribute Forms:
Job Action Sheets
Shelter Logs
Client Count
Emphasize the importance of documenting everything among staff including information on significant actions, agreements, and accidents Sign staff in/out
Identify needs or concerns for the next shift
Produce situational awareness reports for the Care and Shelter Branch Monitor the shelter capacity including for any animals being sheltered Ensure the safe and efficient transition of shelter clients back to their homes or alternative housing solution
Prior to each operational period, align shelter objectives/activities with overarching objectives set by the Care and Shelter Branch
Note activity completion status at the end of the operational period Provide summary of shelter logs for the Care and Shelter Branch Shelter Closing
Receive closing orders from Incident Care and Shelter Branch Coordinate closing announcement with Care and Shelter Branch and Public Information Officer
Work with the Logistics Section to facilitate shelter closing. Closing Check List:
Determine a plan for the debriefing of shelter workers Can they be of assistance with another sheltering operation? Shelter Management Plan December 2025
50 Make sure to capture all staff rosters so that workers can be included in after-action reporting
Pack excess supplies as they become unnecessary for reallocation Update supply inventory and submit to Care and Shelter Branch All shelter staff should work to clean and return the shelter to its original condition as the shelter closes
Return all moved furniture
Remove all signage
Include Activity Logs, financial forms and other documentation collected at the shelter debriefing
Work with Care and Shelter Branch to update the National Shelter System (NSS) to reflect the shelter closing
Assist with clean up and equipment return
Refresh (clean and sanitize facility and equipment)
Repair (if practical)
Restore (if able, otherwise replace)
Return (borrowed equipment)
Replace
Remove (trash and broken equipment)
Conduct facility closing walk-through with facility representative Hold final staff debriefing and collect forms
Hot Wash: What went well? What needs improvement?
Facilitate after action process and development of an improvement plan Review and revise Shelter Management Plan
Collect all Forms as record of shelter actions
Work with Finance and Administration Section, as needed, to ensure that invoices and reimbursement forms are completed
Participate in the after action process, including identification of areas that need improvement
Shelter Management Plan December 2025
51 Assistant Shelter Manager Job Action Sheet
Position Summary
Facilitates coordination between Shelter Manager and partners, agencies and organizations involved in response/recovery; coordinates with Public Information Officer to ensure consistent, coordinated situational awareness and messaging.
Note: The Shelter Manager may delegate additional shelter management tasks to the Assistant Shelter Manager, as needed
Reports to:
Shelter Manager
Partner Agencies:
American Red Cross (ARC)
Initial Planning Actions
Plan for a shelter operation with the Shelter Manager and Care and Shelter Branch/EOC Appoint additional staff as needed
Initial Response
Hold initial staff briefing and distribute shelter logs and data collection forms Establish communications with Shelter Manager, Care and Shelter Branch, and partner agencies and organizations
Daily Shelter Operations
Monitor staff for burn-out and to resolve any interpersonal conflict. Report concerns to Care and Shelter Branch
Ensure continuous communications with the Care and Shelter Branch or EOC Manager Ensure shelters operate safely and efficiently and address needs as they arise Hold shift change briefings with staff and collect shelter logs:
Situational updates
Collect/Distribute Forms:
Job Action Sheets
Shelter Logs
Client Count
Emphasize the importance of documenting everything among staff including information on significant actions, agreements, and accidents Sign staff in/out
Shelter Management Plan December 2025
52 Identify needs or concerns for the next shift
Produce situational awareness reports for the Care and Shelter Branch Monitor the shelter capacity including for any animals being sheltered Ensure the safe and efficient transition of shelter clients back to their homes or alternative housing solution
Prior to each operational period, align shelter objectives/activities with overarching objectives set by the Care and Shelter Branch
Note activity completion status at the end of the operational period Provide summary of shelter logs for the Care and Shelter Branch Shelter Closing
Maintain continuous situational awareness with partner agencies and organizations and distribute closing information
Assist with clean up and equipment return
Turn in all shelter logs to the Care and Shelter Branch Shelter Management Plan December 2025
53 Shift Supervisor Job Action Sheet
Position Summary
The Shift Supervisor oversees the shelter staff and guides their work in the absence of or as the designee of the Shelter Manager. The Shift Supervisor ensures that the needs of clients are met while in the shelter setting.
Note: The Shift Supervisor may assume all the duties of the Shelter Manager, as needed.
Major Tasks
Supervise shelter staff; conduct staff meetings.
Work with other constituency groups, such as Logistics and Operations, and other EOC branches in order to ensure smooth operations.
Maintain contact with supervisory unit or relief operation headquarters. Ensure that major events are recorded in shelter log. Ensure that feeding operations are running smoothly by interacting with feeding personnel (supervisor, if appropriate).
Ensure that proper shelter identification is posted inside and outside shelter. Delegate tasks.
Facilitate shelter staff meetings
Shelter Management Plan December 2025
54 Registration Staff Team Leader Job Action Sheet
Position Summary
Registration staff are responsible for ensuring that individuals entering or leaving a shelter go through the registration process. Without complete, legible, and accurate information about the residents of the shelter, the ability to provide needed services is impaired. To assist with registration, tables and chairs should be set up near the shelter entrance, so that those entering can fill out the necessary forms and be directed to the main shelter area.
If possible, assign a greeter at the entrance to the shelter to welcome shelter clients and guide them to the registration area. Keeping a good count of how the number of clients in the shelter will also allow the Shelter Manager and the Care and Shelter Branch to determine if additional shelters should be opened. In addition to the shelter registration staff, a representative from the Hayward City Police Department should be stationed at/near the registration table. Their role will be to ensure that those entering the shelter do not have legal status that would preclude them from staying in the shelter.
The location of the registration table will be different at each shelter, depending on the layout, but generally should be located at the entrance to the shelter. After shelter clients have completed a registration form, they can be directed to the main shelter area. A shelter log should also maintained at the registration table to document challenges during registration.
Note: It may be necessary to address the need for an isolation area near to the registration area for those exhibiting potentially communicable diseases. Clients entering the shelter will be asked to self-declare illnesses. Individuals displaying symptoms may be isolated from the general population or redirected to a health care facility.
Major Tasks
Support Shelter Manager in organizing and managing shelter Responsible for tracking each shelter occupant, including shelter clients, workers, and visitors
Oversight of all shelter pre-registration triage, check-in, registration, check-out and exit procedures and logs
Monitor shelter capacity during intake process
Refer and direct shelter clients to appropriate mass care services as needed Create registration area, allowing enough space for a waiting area Use shelter intake form record information about clients entering the shelter Send copy of Registration Form to both welfare information and disaster health services, if needed
Maintain log for those residents entering and leaving the shelter Maintain a shelter census and report this information to the Shelter Manager at appropriate intervals
Shelter Management Plan December 2025
55 Refer persons with illness or injury or those with special medication or diets to Health Services
Interact with clients to determine needs and refer appropriately Seek guidance from supervisor as necessary and appropriate Maintain a professional appearance and attitude
Follow and implement requests and direction received from supervisor Supervises:
Registration Staff
Reports to:
Shelter Manager
Partner Agencies:
American Red Cross
Hayward Police Department, or delegated
Initial Response
Review/establish shelter registration policies and procedures Plan for a shelter registration with the Shelter Manager Determine staffing and supply needs and report any resource gaps Registration Policies:
Clients are triaged as they enter the shelter to identify issues that need immediate attention
Everyone must sign in and out each time they enter/exit the shelter Clients are asked to indicate if they are permanently leaving/signing out Shelter Registration Form should be used for all shelter clients Ensure dates and times are noted for all shelter clients, staff, and visitors Participate in pre-opening shelter inspection with Shelter Manager Appoint registration staff and hold initial staff briefing Distribute JAS, shelter logs, and any necessary forms Registration Area Set-up:
Registration tables must be at an accessible height:
Height: 28” minimum, 34” maximum.
Knee clearance: 27” minimum.; 19” under the table
Shelter Management Plan December 2025
56 Route to registration much be at least 5 ft. wide and accessible Signs must be accessible:
Multiple/appropriate languages
Directional signs to Registration and Registration Desk signs “Have your Driver’s License. Or other Government Photo ID ready” “Everyone MUST Sign-in and Sign-Out Every Time”
Shelter Rules posted
Signs at Exit reminding everyone to sign-in and out
Supplies:
Office supplies (e.g., pens, paper, index cards, staplers, paper clips, storage trays) ID bracelets/badges or other shelter client identifiers Water and snacks
Guidance Documents:
Job Action Sheets
Shelter Registration Policy
Shelter Rules and Regulations
Forms:
Shelter Check-in/Check-Out Form
Shelter Client Intake Form
Shelter Log
Confirm setup with Shelter Manager
Daily Shelter Operations
Establish staffing level with Shelter Manager
Registration Details and Check List:
Welcome at entrance
Triage client needs for mass care services
Ask client to sign Shelter Check-in/Check-out Form
Ask to see Government issued photo ID and copy/scan if able Ask each client if they are required to register with a local, state or federal agency Attach Shelter Client ID bracelet or distribute other Shelter Client identifier/card Shelter Management Plan December 2025
57 Assign client to bed/dormitory area
Provide each client/family with a copy of the shelter rules and direct them to the dormitory area
Acceptable registration identification (original documents preferred) Driver’s license
State issued photo ID
School issued photo ID
Valid Passport or another federal photo ID
Unacceptable registration identification (may be waived in emergencies) Social Security Card
Credit Card
Birth Certificate
Expired Passport
Yearbook
Physical description
Monitor staff for burn-out and to resolve any interpersonal conflict. Report concerns to Care and Shelter Branch
Ongoing Actions
Sign clients, visitors, volunteers, and other staff in and out every time, include the date/time
Escort all official visitors, including the media, to the Shelter Manager Do not provide quotes or comments to the media
Do not post any shelter information on social media
Maintain a count of client registrations, shelter staff, and visitors Forward all reports and forms to Shelter Manager at the end of the shift Hold shift change briefings with staff and collect Activity Logs:
Situational updates
Collect/Distribute Forms:
Job Action Sheets
Shelter Logs
Client Count
Shelter Management Plan December 2025
58 Emphasize the importance of documenting significant actions, agreement, and accidents Sign staff in/out
Develop end-of-shift briefing and discuss needs or concerns with incoming staff Shelter Closing
Coordinate with Shelter Manager on shelter closing
Hold shelter closing briefing with registration staff Assist with transition of shelter clients to their home or alternative housing solution Assist with clean up and equipment return:
Refresh (clean and sanitize facility and equipment)
Repair (if practical)
Restore (if able, otherwise replace)
Return (borrowed equipment)
Replace
Remove (trash and broken equipment)
Turn in all shelter logs to Shelter Manager
Participate in the after action process to share strengths and areas for improvement Shelter Management Plan December 2025
59 Shelter Food Unit/Feeding Staff Job Action Sheet
Position Summary
The feeding associate prepares and serves food for clients in the shelter environment. The feeding operation in a short-term sheltering operation is managed by the American Red Cross or other supporting agency. Contracts should be in place to provide each shelter resident with a small breakfast, lunch and dinner each day. Water and juice will also be provided. Feeding staff agency(ies) takes the lead in preparing and serving food but shelter staff should be assigned to assist with this coordination. Assistance serving the meals may be needed.
It is also important to note the number of meals that were served each day. Keep in mind that shelter clients are instructed to bring basic food, water and supplies to a shelter and some of them should have their own food. Shelter staff should coordinate to establish meal times in each shelter.
Responsible for coordinating and delivery of safe and adequate food to all shelters; responsible for obtaining, storing, preparing, feeding, distribution and clean-up; determine the feeding schedule based on resources and needs; ensure that there is a knowledgeable Person-inCharge (PIC) of food operations; work with Public Health to provide daily food safety inspections
Supervises
Food Unit Staff
Reports to:
Shelter Manager
Partner Agencies:
American Red Cross (feeding, dormitory)
Voluntary Agencies
Faith Community
Local Restaurants and Food Caterers
Foodbanks
Major Tasks
Establish feeding service as soon as possible after shelter opens Prepare and/or serve food following safe food handling procedures Ensure feeding preparation and serving areas are kept clean and sanitary Keep accurate count of meals and snacks served and submit to Shelter Manager Ensure cleanliness practices are implemented by all food preparation and service personnel.
Shelter Management Plan December 2025
60 Minimum Equipment Recommendations
Request access to equipment necessary to maintain feeding services Phone, refrigerator, stove/microwave, instant read thermometer, non-latex gloves, sanitizer tablets, paper towels, paper plates, plastic utensils, paper cups, trash bags, trash receptacles.
Initial Planning Actions
Report to Shelter Manager
Obtain briefing on situational awareness from Shelter Manager Designate staff and request activation of additional personnel as needed Maintain regular communications with Shelter Manager on feeding operations Determine types of food service to be provided:
Commercially pre-prepared, packaged meals
Contract with catering service
Church or community group with licensed/permitted kitchen Licensed/permitted mobile kitchen (Red Cross, Salvation Army) Volunteers operating temporary food service
Establish and enforce appropriate food preparation and handling policies:
Maintain a clean, professional appearance and attitude Post meal and snack times with menus when possible
Provide beverages and snacks at all hours if possible Do not accept any donated food items from noncommercial/unknown sources Post required signage and enforce safe food handling procedures Eliminate potential for cross-contamination between raw and ready-to-eat foods Keep surfaces clean and sanitized at all times
Maintain hot and cold foods at the appropriate temperatures Implement temperature control measures (e.g., thermometers, temperature logs) Keep accurate count of all meals and snacks served each day (ARC form F5266) Do not allow the general public entry into any food preparation areas Consider cultural, ethnic, religious, and dietary needs within 36 hours of shelter opening, and accommodate as possible
Restrict consumption of food/drinks to designated feeding areas Shelter Management Plan December 2025
61 Ensure all utensils are washed, rinsed, and sanitized for feeding Collect and dispose of all wastes at least three times per day Ensure food distribution is responsive, transparent and equitable Adjust meal portions if food waste consistently exceeds 10%. Potentially hazardous foods must be thrown out after falling outside of temperature threshold for more than 4 hours
When in doubt regarding food safety, throw it out
Align feeding with established meal standards:
2000 calories/per day
Entrée: 8 oz. by volume entrée
Side Dishes: 6 oz. by volume side dishes
Dessert: 6 oz. by volume
Post feeding schedule based on available resources and needs Standard Meal Schedule: 7am–8am; 12pm–1:00pm; 5pm–6:30pm Snacks Recommendations: Self-serve, ready-to-eat, whole fruits and vegetables, crackers, popcorn, granola bars, cookies, etc.
Food Area Requirements
Shelter Food Unit Lead must have a current food safety certification Adequate lighting and ventilation should be established for cooking areas Control access to food preparation/storage areas
Clean and sanitize food preparation area using 10% bleach Refrigeration capability is required
Hand-wash station, and disposable gloves required
Safe Food Handling Practices:
Food holding: log time/temperatures
Hot/cold food holding: above 140 F/ below 40 F
Discard Potentially Hazardous Food (PHF) after 4 hours Food storage: secure and off the floor if possible
Safe Ice/Drinks: treat drink tubs with 1 tsp. bleach/5-8 gallons) Hand and dinnerware washing protocols must be posted
Shelter Management Plan December 2025
62 Maintain sanitation and cleanliness using 10% bleach solution Enforce the use of disposable gloves
Implement solid waste management strategy
Potable water supplies
Monitor for contamination: Chemical, bacterial, radiation, viral, particulate matter Boil and other water use orders
Bulk water must be from an approved source
Initial Response
Check in with Shelter Manager
Attend initial staff briefing
Establish a beverage and snack center of ready-to-eat, room temperature foods, as soon as possible
Establish workstation to facilitate procurement of goods and services Provide just-in-time training to staff on safe food handling procedures Proper hand washing and use of gloves
Proper hot and cold holding
Proper sanitation
Proper food serving
Receive immediate shelter food requests from Shelter Manager Communicate any gaps in food service to the Shelter Manager Set up Shelter Food Service Area with provisions for:
A dedicated, labeled hand washing station (warm water, pump soap and paper towels) Sanitation protocols and supplies
Food temperature log to show time food left temperature control Hot and cold holding (below 40 and above 140 degrees F) Food preparation
Food service
Clean-up, sanitize and waste disposal
Confirm set-up with Service Manager
Shelter Management Plan December 2025
63 Daily Shelter Operations
Maintain situational awareness and communications with Shelter Manager
Ensure continuous communications with the Shelter Manager Coordinate procurement of goods and services with Shelter Manager, as needed Prepare and serve meals and snacks according to feeding schedule Accommodate special diets as able
Maintain a safe food environment
Monitor staff for burn-out and to resolve any interpersonal conflict. Report concerns to Care and Shelter Branch
Attend shift change briefings with staff and collect shelter logs:
Situational updates
Collect/Distribute Forms:
Job Action Sheets
Shelter Logs
Client Count
Emphasize the importance of documenting significant actions, agreements, and accidents
Sign staff in/out
Discuss needs or concerns for the next shift
Create update for the Supervisor/IC
Continue to train and monitor staff on each shift for safe food handling Develop end-of-shift briefing and discuss needs or concerns with incoming staff Shelter Closing
Receive closing orders from Shelter Manager
Attend staff briefing on closing and forms collections Hot Wash: What went well?; What needs improvement?
Participate in after action process
Review and revise Shelter Management Plan
Implement a Closing/Demobilization Plan
Include a list of voluntarnry agencies and individuals to be thanked Shelter Management Plan December 2025
64 Pack excess supplies as they become unnecessary
Ship extra supplies to other shelters, return, or donate Assist with clean up and equipment return
Refresh (clean and sanitize facility and equipment)
Repair (if practical)
Restore (if able, otherwise replace)
Return (borrowed equipment)
Replace
Remove (trash and broken equipment)
Participate in the after action process to identify strengths and areas of improvement
Shelter Management Plan December 2025
65 Dormitory Manager Job Action Sheet
Position Summary
The dormitory area or main floor of the shelter is the area where most shelter clients will be spending the majority of their time. The Dormitory Manager position ensures that sleeping areas are appropriately chosen, set up and equipped with all necessary items. Those assigned to the Dormitory Manager position should be responsible for setting up cots, coordinating with team members for blankets, comfort kits and other items if available and necessary. This area is also known as the Dormitory Area
Once registered, shelter clients can walk to this area and set up any cots, sleeping bags or supplies they brought with them. Cots, mattresses and other available supplies can also be set up here. Staff working in this area should monitor the main floor of the shelter and report any significant issues to the Shelter Manager. In this area of the shelter, there will most likely be a good amount of interaction with shelter clients. Staff should be as helpful as possible to shelter clients, and work with them to provide a safe and comfortable environment. All reasonable efforts should be pursued to protect the shelter property.
Provide adequate dormitory services to shelter clients; works with partner agencies to ensure that individual sheltering needs are met; provide coordination and assistance to parents to provide age-appropriate childcare activities.
Note: The dormitory area and layout of the main shelter area will vary by facility.
Major Tasks
Designate space for sleeping areas that is appropriate, considering separate areas for families with children, the elderly or other unique situations. Set up cots and, if possible, place two blankets on each cot. Ensure that set up allows for those individuals with disabilities or those who need other forms of support.
Ensure space is available to distribute comfort kits and other appropriate items. Seek guidance from your supervisor as necessary and appropriate. Maintain a professional appearance and attitude.
Follow and implement requests and directions received from your supervisor. Exhibit good stress reduction skills. Strive to encourage an environment for the unit that minimizes the stress level as much as possible under the disaster conditions. Plan use of space while considering various possibilities.
Minimum Dormitory Equipment Recommendations
Cots or floor mats, blankets, cribs
1 each client
Shelter Management Plan December 2025
66 Minimum Childcare Equipment Recommendations
Simple toys
Cards
TV
Dormitory Information, Rules and Routines
Cot Cleaning Guide
Initial Planning Actions
Plan for a shelter dormitory operation with the Shelter Manager or Incident Command/EOC
Review dormitory policies and procedures
Contact partner agencies to assist with operations
Determine staffing and supply needs, complete Resource Request Form (ICS 308) and send to Shelter Manager
Set and post dormitory rules
Supervises:
Childcare Assistance Unit Staff
Reports to:
Shelter Manager
Partner Agencies:
Local Schools
Local Day Care
Local Hotels/Motels
Local Social Service Agencies
American Red Cross
Initial Response
Conduct Final Pre-Opening Shelter inspection with Shelter Manager or IC Appoint Childcare Assistance Unit Leader
Appoint Staff (Volunteers) as needed
Hold Initial Staff Briefing and distribute Activity Logs, Resource Request Forms and Dormitory Rules List
Oversee and assist with Dormitory and Childcare Assistance area set-up Shelter Management Plan December 2025
67 Minimum 40 square feet per person
3 feet between cots
Allow families to form groups with extra space
Dormitory Area is restricted to clients and is quiet zone Confirm staffing and Resource Requests with Shelter Manager Confirm set-up with Shelter Manager or Shelter Services Coordinator/IC/EOC Daily Shelter Operations
Determine staffing schedule with Shelter Manager
Monitor staff for burn-out and to resolve any interpersonal conflict. Report concerns to Care and Shelter Branch
Hold shift change briefings with staff and collect Activity Logs:
Situational updates
Collect/Distribute Forms:
Job Action Sheets
Activity Logs
Medical Logs
Client Count
Expense Sheets
Inspections, etc.
Emphasize the importance of documenting everything, especially injuries and complaints
Sign in/out staff
Discuss needs or concerns for the next shift
Create update for the Supervisor/IC
Oversee Dormitory and Childcare Assistance Areas (Note: parents are responsible for the children at all times.)
Set up Functional Needs Support Services cots only as needed to ensure that there are cots available for FNSS clients as they arrive
Maintain quiet and low light hours as posted for the Dormitory Area Shelter Closing
Coordinate with Shelter Manager on shelter closing
Hold shelter closing briefing with Dormitory and Childcare Staff Shelter Management Plan December 2025
68 Assist with transition of shelter clients to their new normal as needed Assist with demobilization, clean-up and equipment return in Dormitory Area, including cot cleaning
Refresh (clean and sanitize facility and cots)
Repair (if practical)
Restore (if able, otherwise replace)
Return (borrowed equipment)
Replace (pillows and blankets)
Remove (trash and broken equipment)
Turn in all logs to Supervisor
Participate in the After Action Report process, including identification of areas for improvement
Shelter Management Plan December 2025
69 Shelter Childcare Assistant Job Action Sheet
Position Summary
Assist parents in providing age appropriate childcare services in the shelter; help ensure parents are able to provide their children with a safe environment while in the shelter.
Initial Planning Actions
Plan for a shelter childcare assistance operation with the Dormitory Team Leader Contact partner agencies to assist with Operations
Determine staffing and supply needs, complete Resource Request Form (ICS 308) and send to Logistics
Review childcare policies and procedures
Staff should provide safe, pleasant, age-appropriate resources for parents to run a child-friendly activities area.
When children are present, at least two adults are to be present at all times. No child should be left alone with one adult who is not their parent, guardian or caregiver.
A child should never be alone in the shelter. They must be accompanied to all parts of the shelter.
The children area should be free from significant physical hazards and/or structural barriers.
The environment should be secure and separated from other parts of the shelter. The children area should be close to restrooms.
All staff members must be at least 18 years of age.
Supervisors should be at least 21 years of age.
Procedures for sign in and sign out:
Parents/guardians must sign child in and out, on Childcare Registration Form When placing their child or children in this area parents, guardians or caregivers are required to stay on-site or designate a responsible adult child care proxy to be responsible for their child who is on-site at all times. Children can only be released to the parent, guardian, caregiver or designee listed on the registration form.
The parents, guardians or caregivers are responsible for identifying any special needs for the child/children (food allergies, behavioral issues, medications, etc.).
Shelter Management Plan December 2025
70 Supervises:
Childcare Assistance Unit Staff
Reports to:
Shelter Dormitory Manager
Partner Agencies:
Local Schools
Local Day Care
Local Faith Community
Initial Response
Set-up Childcare Assistance Area
Confirm Set-up with Dormitory Team Leader
Appoint staff as needed
Hold Initial Staff Briefing and distribute Activity Logs, Resource Request Forms and Childcare Rules
Confirm Staffing and Resource Requests with Logistics Daily Shelter Operations
Determine staffing schedule with Dormitory Team Leader Monitor staff for burn-out and to resolve any interpersonal conflict. Report concerns to Care and Shelter Branch
Hold shift change briefings with staff and collect Activity Logs:
Situational updates
Collect/Distribute Forms:
Job Action Sheets
Activity Logs
Medical Logs
Client Count
Expense Sheets
Inspections, etc.
Emphasize the importance of documenting everything, especially injuries and complaints
Sign in/out staff
Shelter Management Plan December 2025
71 Discuss needs or concerns for the next shift
Create update for the Supervisor/IC
Recruit parents to lead/provide childcare activities
Oversee Childcare Assistance Areas (Note: parents are responsible for the children at all times.)
Oversight of child sign-in and sign-out in Childcare Assistance Area Monitor for child safety and security
Assist parents with maintaining order in the Childcare Assistance Area Shelter Closing
Coordinate with Dormitory Team Leader on shelter closing Hold shelter closing briefing with Childcare Staff
Assist with transition of shelter clients to their new normal as needed Assist with clean up and equipment return
Refresh (clean and sanitize facility and equipment)
Repair (if practical)
Restore (if able, otherwise replace)
Return (borrowed equipment)
Replace
Remove (trash and broken equipment)
Turn in all logs to Supervisor
Participate in the After Action Report process, including identification of areas for improvement
Shelter Management Plan December 2025
72 APPENDIX C – SHELTER MANAGEMENT FORMS
The following shelter management forms can be found in Appendix C:
1. Shelter Log Form
2. Shelter Shift Inspection Form
3. Unaccompanied Minor and Separated Child Report Form
Note: These forms have been adapted from the American Red Cross Shelter Field Guide (FEMA P-785). Additional shelter forms are maintained by Hayward Fire Department.
Shelter Management Plan December 2025
73 Shelter Log Instructions
Use a Shelter Log Form to document exceptional circumstances that occur in the shelter. There will be at least two shelter logs: a general log to which all staff members contribute, and a manager log used only by the shelter manager.
General Log:
o All staff members contribute entries regarding:
Problems, solutions, and commitments;
Information related to client needs;
Other information concerning shelter activities or incidents. o All information maintains the privacy of our clients and staff. o See doctrine sources below for details.
Manager Log:
o The shelter manager is the only person who completes the manager log. o The manager shelter log contains confidential information, such as:
Staff performance issues (positive and negative);
Activities involving clients needing to register with local law enforcement; Requests for information from law enforcement;
Disclosure of confidential client information;
Unaccompanied minors;
Issues in the shelter that are escalated for resolution. o Both logs are stored in a secured location. The manager log is securely stored where only the shelter manager has access to it.
o See doctrine sources below for details.
This job tool should be used in conjunction with the following doctrine:
Sheltering Standards and Procedures
Job Tool: Operating a Shelter
Job Tool: Shelter Staffing
Follow the steps below to complete this form:
1. Indicate if this is a “General Log” or a “Manager Log.”
2. Enter the first date the form was used.
3. Consult with the shelter manager if necessary to identify the “DR Number” and the “Shelter Name/Location.”
4. To add log entries:
a. Enter the date and time when the event/ activity/ incident took place. b. Enter the name of the shelter staff member who recorded the entry. a. Document all information describing situation or issue. This section should be updated as the follow-up action boxes are checked. b. Indicate “Follow-Up Action:”
Shelter Management Plan December 2025
74 • Required: In the initial log entry, note if the event/ activity/ incident needs follow-up action taken. If known, note the individual completing the follow-up action.
• Completed: As the event/ activity/ incident is completed, check the completed box and add any pertinent information about the completion, including the completer’s name, to the initial log entry.
5. Enter the page number and total number of pages at the bottom of each page. Use as many pages as needed.
Shelter Management Plan December 2025
75 Shelter Log Form
□ General Log □ Manager Log
Shelter Management Plan December 2025
76 Shelter Log Form
□ General Log □ Manager Log
Date: ___________ Incident/DR#: _____________ Shelter Name/Location: _____________________ Date &
Time Name
Log Entry
(Use Additional Lines as Needed)
Follow-Up
Action
□ Required
□ Completed
□ Required
□ Completed
□ Required
□ Completed
□ Required
□ Completed
□ Required
□ Completed
□ Required
□ Completed
□ Required
□ Completed
□ Required
□ Completed
Shelter Management Plan December 2025
77 Shelter Referral Log Form
Use this log to record client needs that were identified when completing the Shelter Client Information form or other interactions with clients so Red Cross activities can provide specialized support to clients
Date: ___________ Incident/DR#: _____________ Shelter Name/Location: _____________________ Referral Timing Client Name /
Contact Info Reason(s) for Referral Referral To
Date/Time Recorded:
Date/Time Received:
Name of person who
received referral:
Do not record confidential
information
□ Health Services
□ Mental Health
□ Spiritual Care
□ Shelter Manager
□ SRT
□ Feeding
□ Other (specify)
Date/Time Recorded:
Date/Time Received:
Name of person who
received referral:
Do not record confidential
information
□ Health Services
□ Mental Health
□ Spiritual Care
□ Shelter Manager
□ SRT
□ Feeding
□ Other (specify)
Date/Time Recorded:
Date/Time Received:
Name of person who
received referral:
Do not record confidential
information
□ Health Services
□ Mental Health
□ Spiritual Care
□ Shelter Manager
□ SRT
□ Feeding
□ Other (specify)
Shelter Management Plan December 2025
78 Referral Timing Client Name /
Contact Info Reason(s) for Referral Referral To
Date/Time Recorded:
Date/Time Received:
Name of person who
received referral:
Do not record confidential
information
□ Health Services
□ Mental Health
□ Spiritual Care
□ Shelter Manager
□ SRT
□ Feeding
□ Other (specify)
Date/Time Recorded:
Date/Time Received:
Name of person who
received referral:
Do not record confidential
information
□ Health Services
□ Mental Health
□ Spiritual Care
□ Shelter Manager
□ SRT
□ Feeding
□ Other (specify)
Date/Time Recorded:
Date/Time Received:
Name of person who
received referral:
Do not record confidential
information
□ Health Services
□ Mental Health
□ Spiritual Care
□ Shelter Manager
□ SRT
□ Feeding
□ Other (specify)
Date/Time Recorded:
Date/Time Received:
Name of person who
received referral:
Do not record confidential
information
□ Health Services
□ Mental Health
□ Spiritual Care
□ Shelter Manager
□ SRT
□ Feeding
□ Other (specify)
Shelter Management Plan December 2025
79 Shelter Shift Inspection Form Instructions
The Shelter Shift Inspection Form is completed at the end of every shift, as well as other times established by the shelter manager. This job tool is used in conjunction with the following doctrine:
Sheltering Standards and Procedures
Job Tool: Operating a Shelter
Follow the steps below to complete this form:
1. Enter the date the inventory is being completed.
2. Consult with the shelter manager if necessary to identify the “DR Number” and the “Shelter Name/Location.”
3. Indicate for which shift the inspection is being conducted.
4. Enter the time the inspection was conducted.
5. Enter the name of the shift supervisor. During the day shift, this is often the shelter manager.
6. Enter the name of the worker conducting the inspection.
7. Indicate Yes, No, or not applicable (N/A) for each question on the form. N/A only applies if the item in question does not exist. For example, if there are no restricted areas requiring limited access, indicate N/A to the question, “Are controls in place for restricted areas requiring limited access?”
8. For any item marked “No,” list the resolution to the issue in the Resolution of Issues Identified Above section.
9. Note any identified issues in the shelter log.
Shelter Management Plan December 2025
80 Shelter Shift Inspection Form
Date: ___________ Incident/DR#: _____________ Shelter Name/Location: _________________ Shift: □ Day □ 2nd □ Night Inspection Time:
Shift Supervisor:
Inspector:
General Condition
□ Yes □ No Are all areas free of excessive wear and tear? Entrances, Exits, and Access to Shelter
□ Yes □ No Are all entrances and exits visible and unobstructed? □ Yes □ No Are all entrances and exits marked with a visible sign that is properly illuminated? □ Yes □ No Are accessible entrances clearly marked?
□ Yes □ No □ N/A Are controls in place for any restricted areas requiring limited access? Exterior of Shelter
□ Yes □ No Are all walkways clear of trip or fall hazards? □ Yes □ No □ N/A In inclement weather, are all walkways clear of snow and ice? □ Yes □ No □ N/A Are all accessible ramps and handrails maintained? □ Yes □ No Are there appropriate containers for disposal of cigarettes and trash? □ Yes □ No Is there an appropriate area for service and assistance animals to relieve themselves?
Interior of Shelter
□ Yes □ No Are the routes between service delivery areas and restrooms at least 36” wide, free of protruding objects, and accessible to all clients and workers? □ Yes □ No Are all areas and floors clean, dry, sanitary, and free of hazards? □ Yes □ No Is floor protection adequately secured to avoid slips, trips, and falls? □ Yes □ No Are all service delivery areas sanitized and clean of debris? □ Yes □ No Is signage for designated areas legible and large enough for all clients and workers to see?
□ Yes □ No Does signage reflect all languages spoken by the shelter resident population? □ Yes □ No Are restrooms clean, orderly and free of standing water, trip and fall hazards, and chemicals?
□ Yes □ No □ N/A Are diaper-changing areas sanitized with available hand wipes? □ Yes □ No Is there an adequate power supply for clients with durable medical equipment and portable electronic device charging stations?
□ Yes □ No Are electrical cables and outlets routed and covered safely? □ Yes □ No Are doors and windows secured?
□ Yes □ No Are reception workers appropriately controlling access to the shelter and securing the shelter entrance?
□ Yes □ No Are dormitory registration workers appropriately controlling access to the dormitory and securing the dormitory entrance?
Shelter Management Plan December 2025
81 Resolution of Issues Identified Above
NOTE ANY ISSUES ON THE SHELTER LOG
Shelter Management Plan December 2025
82 Unaccompanied Minor/Separated Child Report Form Instructions The shelter worker completes the Unaccompanied Minor and Separated Child Report Form as completely as possible after an unaccompanied minor or separated child is found at a shelter.
This job tool should be used in conjunction with the following doctrine:
Sheltering Standards and Procedures
Safe and Well Linking Handbook
Complete this form following the guidance below:
(*) – Boxes that include an asterisk are required, as they align with the required fields for the National Center for Missing and Exploited Children (NCMEC). If time does not allow the completion of all fields, focus on completing the required fields, and return to the form when able.
Information entered onto the form should be factual and clearly communicated.
Opinions and judgments should not be included in the narrative. This form should be sent (email or paper copy) to the division disaster executive at the applicable division and to the national headquarters Reunification liaison for record-keeping, in case there is a request for follow-up.
Administrative:
Date/time - Enter the first date the form was used.
Incident/DR# - Consult with the shelter manager, if unknown. Shelter name and phone number – Enter the name of the shelter where the form was used.
Consult with the shelter manager, if unknown.
Type:
Unaccompanied minor - An unaccompanied minor is an un-emancipated child younger than 18 who has been separated from both parents, legal guardians, other relatives, schools, and child care providers and are not being cared for by an adult who, by law or custom, is responsible for doing so.
Separated child - A separated child is a child who is separated from both parents or from his or her previous legal guardian or customary primary caregiver, but not necessarily from other family members.
Clarifying Definitions:
Emancipated minor - An emancipated minor is a minor who is legally entitled to be treated as an adult through a court order, marriage, military service, or being a parent. (NOTE: Laws vary by state on this definition).
Shelter Management Plan December 2025
83 Family member - A family member is a person related to another person by blood, adoption, or marriage.
Legal guardian - A legal guardian is an adult with the legal right to physical custody of a minor, as bestowed by court order or state law.
Parent - A parent refers to the birth parent or adoptive parent of a minor.
Minor’s information:
Name - Enter the minor’s name.
Date of birth – If unknown, enter an approximate age. This information will be helpful if multiple minors have the same name.
Gender – Enter the minor’s gender.
Phone number/email address – Enter the minor’s phone number and email address.
Is the minor non-verbal or unable to self-identify? – If the minor is of nonspeaking age, speaks a different language, or chooses not to speak, enter “Yes.” Home address – Enter the minor’s home address.
Primary language spoken/secondary language – This information will help to ensure that those working with the minor are aware that an interpreter might be needed.
Location where the minor was found or separated from parent/guardian – If an exact location is not known, provide as many descriptive details as possible. If the minor is unable to articulate a location, ask guiding questions to probe for additional details.
Date/time when the minor was found or separated from parent/guardian – If an exact time is not known, provide as many descriptive details as possible. If the minor is unable to articulate a time, ask guiding questions to probe for additional details.
Minor’s physical description:
Enter as much detail as possible.
Red Cross workers responsible for supervising the minor (unaccompanied minors ONLY):
Enter the name and contact information of those who have agreed to supervise the minor. The act of entering this information will serve as a record and ensure that the shelter manager is aware of the staff allocation.
Presumed parent/guardian information:
Enter the name and contact information for the presumed parent/guardian provided by the minor. This information is taken as presumed, since law enforcement must verify a custodial relationship.
Shelter Management Plan December 2025
84 Law enforcement:
Has law enforcement been notified? – Check “yes” or “no.” Law enforcement must be contacted. If the form is marked as “no,” ensure that the shelter manager is aware of this pending task, so this can be completed as soon as possible. Date/time law enforcement was notified – This information will be important for understanding previous actions and the case timeline.
Law enforcement contact information – During the discussion with law enforcement, a contact should be provided for who will investigate the case. Name/phone number of Red Cross worker that contacted law enforcement – This information is important in case the shelter worker or shelter manager would like to follow-up with the caller. Depending on the timeline of the case, the caller could have already been out-processed.
Notes – Provide any information from engagement with law enforcement (e.g. local procedures for unaccompanied minors or separated children, topics of follow-up discussions, follow-up tasks, etc.). Use an additional piece of paper for notes that do not fit on the form, and staple together.
National Center for Missing and Exploited Children (NCMEC) Has the unaccompanied minor been registered on the Unaccompanied Minor Registry (UMR)?
o Check “Yes” or “No.” Registry on NCMEC’s UMR is required. Registry may occur through one of the following methods:
o Cell phone, tablet, or computer - http://umr.missingkids.org o If encountering trouble on cell phone, tablet, or laptop, please call NCMEC Call Center - 1-800-THE-LOST
If the form is marked as “no,” ensure that the shelter manager is aware of this pending task so this can be completed as soon as possible. Has the separated child been reported to NCMEC?
o Call NCMEC Call Center - 1-800-THE-LOST
Date/time of NCMEC contact –This information will be important for understanding previous actions and timeline that have occurred.
NCMEC contact information – If registry occurred over the phone and NCMEC call center provides a contact phone number, list it in this box. Name/phone number of Red Cross Worker that contacted NCMEC – This information is important in case the shelter worker or shelter manager would like to follow-up with the caller. Depending on the timeline of the case, the caller could have already been out processed.
Shelter Management Plan December 2025
85 Notes – Provide any information from engagement with NCMEC (e.g. local procedures for unaccompanied minors or separated children, topics of follow-up discussions, follow-up tasks, etc.). Use an additional piece of paper for notes that do not fit on the form and staple it to the form, as needed.
Transfer/reunification plan:
Name/agency and phone number to transfer/reunify minor to –This information requires the approval of law enforcement.
Anticipated date/time of transfer/reunification – This date could be subject to change but is important for planning purposes.
Actual date/time of transfer/reunification –This will serve as a record for the case. Name of law enforcement officer that approved plan – A law enforcement officer is required to approve the plan. This approval process ensures that the minor is being transferred/reunited with the appropriate party. If any future questions arise regarding the transfer/reunification, this contact information is critical for the record. Notes – Enter any notes regarding the transfer/reunification process on a separate piece of paper and stable to the report. Examples: delays, issues, why the transfer occurred, mode of transportation, location of transfer, follow-up action, etc.
Shelter Management Plan December 2025
86 Unaccompanied Minor/Separated Child Report Form
Date/time: ________________________________ Incident/DR#:_______________________ *Shelter Name:____________________ *Shelter Phone Number:_______________________ Type of Child
□ Unaccompanied Minor
□ Separated Child
Minor’s Information
*Name (Last, First, Nickname): * Date of birth (or approx age): * Gender:
Home number: Cell
number:
Email address: Is the minor nonverbal/unable to selfidentify? Home address:
Primary language spoken:
Secondary language:
*Location where minor was found or
separated from parent/guardian:
*Date/time minor
was found or
separated from
parent/guardian:
Minor’s Physical Description
*Clothing: *Hair color: Eye color:
Weight: Height: Build:
Race: Complexion: Hair style:
Shelter Management Plan December 2025
87 Distinguishing marks (moles, scars,
tattoos):
Items carried: Eyeglasses?
Red Cross Workers Responsible for Supervising Minor (Unaccompanied Minor ONLY) Red Cross disaster worker #1
Name:
Cell phone:
Red Cross disaster worker #2
Name:
Cell phone:
Presumed Parent/Guardian Information
Name #1: Home phone:
Cell phone:
Email:
Name #2: Home phone:
Cell phone:
Email:
Law Enforcement
Has local law enforcement been notified?
□ Yes
□ No
Law enforcement contact
information:
Date/time law enforcement notified: Name of Red Cross disaster worker who contacted law enforcement:
Cell phone number:
Notes:
National Center for Missing and Exploited Children (NCMEC) Has the unaccompanied minor been registered on
NCMEC’s UMR?:
□ Yes
□ No
Has the separated child been
reported to NCMEC?:
□ Yes
□ No
Shelter Management Plan December 2025
88 Date/time of NCMEC contact:
NCMEC contact information:
Name of Red Cross disaster worker
who contacted NCMEC:
Cell phone number:
Notes:
Transfer/Reunification Plan
Name/agency to transfer/reunify minor to:
Phone number:
Anticipated date/time of transfer/reunification: Actual date/time of transfer/reunification:
Name of law enforcement officer that approved plan:
Badge number:
Shelter Management Plan December 2025
89 APPENDIX D – SHELTER STAFFING MATRIX
The following ARC staffing matrices provide an analysis of minimum and ideal shelter staffing showing manager, supervisor, and worker counts; Table A provides the staffing levels for two, twelve-hour shelter operation shifts while.
These tables should be used in combination to establish shelter operations assignments based on availability of resources and shelter population figures.
Table D.1: Staffing Level for Two, 12-Hour Shifts
Manager Supervisor Shelter Worker Staff per Shift Staff Total
Clients per
Staff per shift
50 Clients
Minimum Staff Day 1 - 1 2
4 25
Night - 1 1 2 25
Ideal Staff Day 1 - 2 3
6 17
Night - 1 2 3 17
100
Clients
Minimum Staff Day 1 - 1 2
4 50
Night - 1 1 2 50
Ideal Staff Day 1 - 3 4
7 25
Night - 1 2 3 33
200
Clients
Minimum Staff Day 1 1 2 4
8 50
Night - 1 3 4 50
Ideal Staff Day 1 1 7 915 22
Night - 1 5 6 33
500
Clients
Minimum Staff Day 1 2 7 10 20 50
Night - 2 8 10 50
Ideal Staff Day 1 3 18 22 39
23 Night - 3 14 17 29
Shelter Management Plan December 2025
90 Table D.2: Staffing Level for Three 8-Hour Shifts
Manager Supervisor Shelter Worker Staff per
Shift
Staff
Total
Clients per
Staff per shift
50 Clients
Minimum Staff
Day 1 - 1 2
6 25
2nd - 1 1 2 25
Night - 1 1 2 25
Ideal Staff
Day 1 - 2 3
6 17
2nd - 1 2 3 17
Night - 1 2 3 25
100
Clients
Minimum Staff
Day 1 - 1 2
6 50
2nd - 1 1 2 50
Night - 1 1 2 50
Ideal Staff
Day 1 - 2 3
10 33
2nd - 1 3 4 25
Night - 1 2 3 33
200
Clients
Minimum Staff
Day 1 1 2 4
12 50
2nd - 1 3 4 50
Night - 1 3 4 50
Ideal Staff
Day 1 1 4 6
18 33
2nd - 1 6 7 29
Night - 1 4 5 40
500
Clients
Minimum Staff
Day 1 2 7 10
30 50
2nd - 2 8 10 50
Night - 2 8 10 50
Ideal Staff
Day 1 3 12 16
49 31
2nd - 4 15 19 26
Night - 3 11 14 36
Shelter Management Plan December 2025
91 Table D.3: Minimum Shelter Position Staffing Assignments for Two Shifts Minimum Shelter Staffing - 2 Shifts 50 Clients 100 Clients 200 Clients 500 Clients Role Day Night Day Night Day Night Day Night
Shelter Manager 1 1 1 1
Shift Supervisor 1 1 1 1 2 2
Administrative Support 1 1
Registration 1 1 1 1 2 2
Dormitory 1 1 1 2 2
Feeding/Canteen 1 1 2
Information/Help Desk 1 1 1
Other 1
TOTAL 2 2 2 2 5 4 10 10
Table D.4: Ideal Shelter Position Staffing Assignments for Two Shifts Ideal Shelter Staffing – 2 Shifts 50 Clients 100 Clients 200 CLIENTS 500 CLIENTS Role Day Night Day Night Day Night Day Night
Shelter Manager 1 1 1 1
Shift Supervisor 1 1 1 1 3 3
Administrative Support 1 1
Registration 1 1 1 1 2 2 5 5
Dormitory 1 1 1 1 2 2 5 5
Feeding/Canteen 1 1 1 3 3
Information/Help Desk 1 3 1
Other 1
TOTAL 3 3 4 3 9 6 22 17
Shelter Management Plan December 2025
92 Table D.5: Minimal Shelter Position Staffing Assignments for Three Shifts Minimum Shelter Staffing – 3 Shifts 50 Clients 100 Clients 200 Clients 500 Clients Role Day 2nd Night Day 2nd Night Day 2nd Night Day 2nd Night Shelter Manager 1 1 1 1
Shift Supervisor 1 1 1 1 1 1 1 2 2 2
Administrative Support
Registration 1 1 1 1 1 1 3 3 2
Dormitory 1 1 1 1 2 2 2 4
Feeding/Canteen 1 1 1 1
Information/Help Desk 1 2 1
Other
TOTAL 2 2 2 2 2 2 4 4 3 10 10 10
Table D.6: Ideal Shelter Position Staffing Assignments for Three Shifts Ideal Shelter Staffing – 3 Shifts 50 Clients 100 Clients 200 Clients 500 Clients Role Day 2nd Night Day 2nd Night Day 2nd Night Day 2nd Night Shelter Manager 1 1 1 1
Shift Supervisor 1 1 1 1 1 1 1 3 4 3
Administrative Support 1 1
Registration 1 1 1 2 1 2 2 1 5 5 3
Dormitory 1 1 1 1 2 2 2 4
Feeding/Canteen 1 1 1 1
Information/Help Desk 1 2 1
Other
TOTAL 3 3 2 3 4 3 6 7 5 16 19 14
Shelter Management Plan December 2025
93 APPENDIX E – SHELTER STAFFING ROSTER
Name Organization Email
Sharon Dalleske CERT [email protected]
Jennie Comstock Hayward Animal Services [email protected] Debbie Kearns CERT [email protected]
Paula Simas CERT [email protected]
Maricela Munoz CERT [email protected]
Gabriel de la Pena CERT [email protected]
Melissa Burkley City of Hayward - Library [email protected] Cindy Nguyen City of Hayward - Revenue [email protected] Justin Johnson CERT [email protected]
Lisa Baskett CERT [email protected]
Vincent Perez City of Hayward - Revenue [email protected] Rosalinda Romero City of Hayward - HR [email protected] Jayanti Addleman City of Hayward - Library [email protected] Sandra Stewart City of Hayward - Library [email protected] Melesha Owen City of Hayward - Library [email protected] Linda Cardott CERT [email protected]
Brandon Welton HARD [email protected]
Grace D'Silva CERT [email protected]
James Hernandez Red Cross [email protected] Frank Saiz HFD [email protected]
Darrin Pelkey HFD [email protected]
*Contact current Public Education Officer/Staff Captain for more volunteers and CERT contacts.
Draft Final
Shelter Management Plan December 2025
94 APPENDIX F – SHELTER RESOURCE MATRIX
Resources 3,000
People
10,000
People Comment
Shelter sites 6 20 Assumes an average shelter population of 500 persons per shelter Meals per day at shelters and
other service delivery sites 12,900 43,000
Assumes at least 2 hot meals per day for 500 persons per shelter multiplied by 2 to account for meals at other sites plus 8% to account for staff
Cots or sleeping mats 3,000 10,000 Assumes 1 cot or sleeping mat per person in shelter Blankets 6,000 20,000 Assumes 1 blanket per person in shelter (may need to upgrade to 2 per person in cold weather)
Cambros (specialized storage
containers for hot hood) 108 359 2 cambros can generally serve 240 meals per day assuming liners are used (entrée and one side; average 5-oz serving sizes) Emergency response vehicles
(ERVs) to carry food/beverages 26 86 Based on 500 meals per ERV per day (box trucks can also be used to transport food cambros, leaving ERV to support mobile feeding) Cargo trucks 6 20 For bulk distribution of shelter support; 1 cargo truck per 500 persons Passenger vans 2 6 For staff transport; 1 van for every 1,500 persons sheltered Meals ready to eat (MREs) 42,000 138,600 For the first 3 weeks Bottled water 3,000 10,000 Standard gallon containers for bulk distribution Comfort kits 9,000 30,000 1 person in shelter sites per week (for 3 weeks) Generators 12 20 Two 15- to 25-kW generators for every shelter with 500 persons Minimum staff per shelter site 264 880 See Table X for suggested staff for individual shelters Food preparation staff 13 43 10 food prep staff persons for every 10,000 meals Fixed feeding staff 26 86 Number of meals per day ÷ 1,000 meals per vehicle/day × 2-person crew Mobile Feeding Staff 51 172 Number of meals per day ÷ 500 meals per day, per vehicle, each with a 2- person crew
Shelter Management Plan December 2025
95 APPENDIX G – DHHS FEDERAL MEDICAL STATION GUIDANCE
Overview
The Federal Medical Station (FMS) is a deployable federal asset designed to provide beds and medical equipment to support non-acute care, special needs care, or quarantine operations during large-scale disasters or public health threats. It is intended to supplement local healthcare infrastructure in mass casualty incidents.
The FMS concept was developed by the DHHS to address potential deficits in treatment bed capacity at state and local levels after a catastrophic event.
A full FMS consists of 250 beds and three core modules: Pharmacy, Base Support, and Base Treatment. It also includes an initial three-day supply of pharmaceuticals, medical equipment, and supplies. The FMS can be broken down into 50-bed units for situations where a full FMS cannot be fully deployed.
FMS Site Selection
FMS is scalable, transportable, and designed to accommodate all age populations. It can be quickly installed in available buildings and adapted to meet a range of mass medical care needs.
FMS sites should be selected based on their size, proximity to supporting hospitals, existing communications links and electrical capacity, parking and loading dock availability, material handling equipment, backup generator capability, and other factors.
Possible FMS sites include National Guard armories, gymnasiums, civic sports centers, schools, large hotel ballrooms, convention centers, warehouses, and community centers.
The building should provide 40,000 square feet of space for a 250-bed FMS and 15,000 square feet of space for a 40-bed FMS. Facility space should be designated for administration, waiting area(s), medical support, pharmacy, treatment area(s) to accommodate a fully functional FMS.
The facility should also have adequate security, storage areas, climate control equipment, and communications and IT support.
Existing structures such as National Guard armories, school gymnasiums, and airport hangars may provide sufficient space, while convention centers and warehouses may provide more open floor space for shelter and mass care operations.
Staffing
Staffing the FMS is the responsibility of the requesting jurisdiction. However, assistance with mass care services may be provided through the National Disaster Medical System (NDMS), US Public Health Service, and the Veterans Administration, among other partners. Positions required to staff an FMS include physicians, nurses, pharmacists, laboratory personnel, and support staff.
Shelter Management Plan December 2025
96 Wraparound Services
Ancillary support services are essential to sustain the operation of an FMS. Each FMS arrives with 72 hours’ worth of equipment and supplies. However wraparound services are the responsibility of the local jurisdiction and includes waste removal, site security, electrical power and distribution, potable water and ice, emergency transportation services, food service, laundry services, mortuary support, accommodations for pets and service animals, and support staff for set-up and tear-down.
CITY OF HAYWARD Hayward City Hall
777 B Street
Hayward, CA 94541
www.Hayward-CA.gov
File #: CONS 25-552
DATE: December 16, 2025
TO: Mayor and City Council
FROM: City Manager
SUBJECT
Adopt a Resolution: (1) Declaring a City Council Recess from December 22, 2025 through January 2, 2026; (2) Cancelling the Regular City Council Meetings Scheduled for December 23, 2025, and January 6, 2026; and (3) Authorizing the City Manager, or their Designee, to take Action on Administrative Matters as Necessary During the Recess
RECOMMENDATION
That the City Council adopts a resolution (Attachment II): (1) Declaring a City Council recess from December 22, 2025 through January 2, 2026 (“winter recess”); (2) Cancelling the regular City Council Meetings scheduled for December 23, 2025, and January 6, 2026; and (3) Authorizing the City Manager, or their Designee, to take action on administrative matters as necessary during the recess.
SUMMARY
Staff recommends declaration of a City Council recess from December 22, 2025 through January 2, 2026 to allow the council members’ time to rejuvenate and spend time with family and loved ones during the winter holiday period. In order to facilitate the winter recess, the regular City Council meetings currently scheduled for December 23, 2025, and January 6, 2026, must be cancelled. The cancellation does not preclude the Mayor from calling a special or emergency meeting during the recess if necessary. Any meetings scheduled during the recess will comply with Brown Act noticing requirements.
Although the City Council will be taking a winter recess, there may still be matters that require administrative action in a timely manner, which cannot be deferred until after the winter recess. Staff requests that the City Council authorize the City Manager, or their designee, to take action on administrative matters as necessary during the recess. This would involve authority to execute documents, such as contracts, and authority to submit or file documents, that would normally require City Council action. Following the winter recess, the City Manager or their designee will report to the City Council any administrative approvals made during the recess.
ATTACHMENTS
CITY OF HAYWARD Page 1 of 2 Printed on 12/12/2025
powered by Legistar™
File #: CONS 25-552
Attachment I Staff Report
Attachment II Resolution
CITY OF HAYWARD Page 2 of 2 Printed on 12/12/2025
powered by Legistar™