Comprehensive Emergency
Management Plan
2025
Prepared by:
In collaboration with:
Attachment III
Comprehensive Emergency Management Plan – Part I December 2025 ii
PROMULGATION AND ADOPTION
Approval Date: December 16, 2025
To: Officials, Employees, and Residents of the City of Hayward The preservation of life, property and the environment is an inherent responsibility of local, state, and federal governments. Disaster preparedness is part of the City of Hayward’s Local Resilience Plan, which serves as a guiding document for the City’s hazard mitigation activities and is in alignment with the City Council’s “Safe” priority. The City of Hayward, in cooperation with the Hayward Fire Department, has prepared this Comprehensive Emergency Management Plan (CEMP or the “Plan”) to ensure the most effective response to emergencies.
While no plan can completely prevent loss and property destruction, plans carried out by knowledgeable and well-trained personnel can and will minimize damages. This plan establishes emergency support by assigning tasks, specifying policies, and establishing general procedures while providing for the coordination of planning efforts of various emergency and response staff.
This CEMP was prepared utilizing the Incident Command System, the Standardized Emergency Management System, and the National Incident Management System.
The objective of this Plan is to incorporate and coordinate City personnel into an efficient support role capable of coordinating response efforts of an all-hazards emergency. It will be reviewed annually, exercised periodically, and revised as necessary to meet changing conditions.
The Hayward City Council gives its full support to this Plan and urges all officials, employees, and residents individually and collectively, to do their share by being personally prepared thus supporting emergency efforts in the City of Hayward. This letter promulgates the updated City of Hayward’s CEMP and formalizes adoption of the City of Hayward’s CEMP. This Plan becomes effective on approval by the City Manager.
___________________________________
City Manager
Comprehensive Emergency Management Plan – Part I December 2025 iii
CONCURRENCE OF HAYWARD FIRE DEPARTMENT
The following members of the City of Hayward Disaster Council concur with the content of the updated (2025) City of Hayward Comprehensive Emergency Management Plan. As needed, future revisions will be submitted to the Hayward Fire Department for approval.
Jennifer Ott (signature), City Manager Date Signed
Eric Vollmer (signature), Fire Chief Date Signed
Ryan Hamre (signature), Deputy Fire Chief Date Signed
Frank Saiz (signature), Staff Captain Date Signed
Comprehensive Emergency Management Plan – Part I December 2025 iv
RECORD OF DISTRIBUTION
The following individuals received a copy of this CEMP either in electronic or paper format.
Date Recipient City Department Number of
Copies
Comprehensive Emergency Management Plan – Part I December 2025 v
RECORD OF CHANGES
Each update or change to the plan should be tracked. When changes are made to the plan, document the page number, the date of the revision, description of the change, and the name of the person who completed the change.
For additional details, see Section 3.8, Plan Maintenance.
Date of
Revision Page No. Description of Change Author
Comprehensive Emergency Management Plan – Part I December 2025
vi
TABLE OF CONTENTS
PROMULGATION AND ADOPTION ......................................................................................... II CONCURRENCE OF HAYWARD FIRE DEPARTMENT ...........................................................III RECORD OF DISTRIBUTION .................................................................................................. IV RECORD OF CHANGES ........................................................................................................... V TABLE OF CONTENTS ........................................................................................................... VI ACRONYMS AND ABBREVIATIONS ...................................................................................... IX
1.0 INTRODUCTION ...........................................................................................................11
2.0 SCOPE AND SITUATION OVERVIEW .........................................................................13
2.1 SCOPE........................................................................................................................13
2.1.1 Phases of Emergency Management ..................................................................13
2.2 CITY OF HAYWARD PROFILE .........................................................................................14
2.3 HAZARD ASSESSMENT .................................................................................................14
2.3.1 Earthquake ........................................................................................................14
2.3.2 Wildfire ...............................................................................................................15
2.3.3 Landslide ...........................................................................................................15
2.3.4 Flood ..................................................................................................................16
2.3.5 Dam Failure Inundation ......................................................................................16
2.3.6 Hazard Material Vulnerability Threat Summary ..................................................17
2.3.7 Drought ..............................................................................................................17
2.3.8 Cybersecurity Incident .......................................................................................17
2.3.9 Hazard Mitigation ...............................................................................................18
2.4 PLANNING ASSUMPTIONS .............................................................................................20
3.0 PROGRAM ADMINISTRATION ....................................................................................21
3.1 ROLE OF FEDERAL GOVERNMENT ................................................................................21
3.2 NIMS .........................................................................................................................21
3.3 ICS ............................................................................................................................21
3.4 SEMS ........................................................................................................................22
3.4.1 SEMS Functions ................................................................................................22
3.4.2 SEMS Organizational Levels .............................................................................23
3.5 EMERGENCY PROCLAMATIONS .....................................................................................24
3.5.1 Purpose .............................................................................................................25
3.6 ALERT, WARNING, AND NOTIFICATION...........................................................................25
3.7 CONTINUITY OF GOVERNMENT .....................................................................................26
3.7.1 Alternate Seat of Government ............................................................................26
3.7.2 Succession ........................................................................................................27
3.7.3 Vital Records Retention .....................................................................................28
3.7.4 Protection of Critical Infrastructure .....................................................................28
3.8 PLAN MAINTENANCE ....................................................................................................29 Comprehensive Emergency Management Plan – Part I December 2025
vii
3.9 TRAINING AND EXERCISE .............................................................................................29
4.0 CONCEPT OF OPERATIONS.......................................................................................31
4.1 ROLES AND RESPONSIBILITIES .....................................................................................31
4.2 EMERGENCY OPERATIONS CENTER (EOC) ...................................................................33
4.2.1 EOC Activation Levels .......................................................................................33
4.2.2 Activation ...........................................................................................................34
4.3 DEPARTMENT OPERATIONS CENTER ............................................................................35
4.4 MUTUAL AID ................................................................................................................35
4.5 RESOURCE REQUESTS ................................................................................................36
4.6 DIRECTION AND CONTROL ...........................................................................................36
4.7 INFORMATION COLLECTION, ANALYSIS, AND DISSEMINATION ..........................................37
4.8 RECOVERY .................................................................................................................37
5.0 EMERGENCY COMMUNICATIONS .............................................................................39
5.1 COMMUNICATION SYSTEM VULNERABILITIES .................................................................39
5.2 EXPECTATIONS OF USE ...............................................................................................39
5.3 FEDERAL COMMUNICATIONS SYSTEMS EMERGENCY ALERT SYSTEM (EAS)....................40
5.3.1 National Warning System (NAWAS) ..................................................................40
5.3.2 State Communications Systems ........................................................................40
5.3.3 Local Communications Systems ........................................................................41
5.4 TELEPHONE SYSTEMS .................................................................................................42
6.0 LAWS AND AUTHORITIES ..........................................................................................43
6.1 ALAMEDA COUNTY ADMINISTRATIVE CODE ...................................................................43
6.2 STATE OF CALIFORNIA .................................................................................................43
6.3 FEDERAL ....................................................................................................................43
7.0 GLOSSARY ..................................................................................................................45
8.0 REFERENCES ..............................................................................................................51
PART II: FUNCTIONAL ANNEXES (SEMS ELEMENTS)……………………………….PART II - 2
1.0 MANAGEMENT SECTION………………………………………………………….PART II - 2
2.0 OPERATIONS SECTION…………………………………………………………..PART II - 26
3.0 PLANS & INTELLIGENCE SECTION……………………………………………PART II - 28
4.0 LOGISTICS SECTION……………………………………………………………PART II - 51
5.0 FINANCE AND ADMINISTRATION SECTION…………………………………PART II - 74
Comprehensive Emergency Management Plan – Part I December 2025
viii
PART III: SUPPORT ANNEXES ………………………………………………………….PART III - 1 PUBLIC ALERT & WARNING SUPPORT ANNEX…………………………...PART III - 3 PROTECTIVE ACTIONS EMERGENCY EVACUATION SUPPORT ANNEX………PART III - 12 FINANCIAL MANAGEMENT SUPPORT ANNEX………………………………………PART III - 19 PRIVATE SECTOR COORDINATION SUPPORT ANNEX……………………………PART III - 20 VOLUNTEER AND DONATIONS MANAGEMENT SUPPORT ANNEX…………….PART III - 22 PART IV: HAZARD, THREAT, OR INCIDENT SPECIFIC ANNEXES
EARTHQUAKE INCIDENT ANNEX………………………………………………………PART IV - 1 HAZARDOUS MATERIALS INCIDENT ANNEX………………………………………PART IV - 4 EVACUATION ANNEX…………………………………………………………………….PART IV - 18 CYBERSECURITY ANNEX……………………………………………………………….PART IV - 32
Comprehensive Emergency Management Plan – Part I December 2025
ix
ACRONYMS AND ABBREVIATIONS
AC Alert Alameda County Alert
ACS Auxiliary Communications Service
ARES Amateur Radio Emergency Service
CAL FIRE California Department of Forestry and Fire Protection Cal OES California Governor’s Office of Emergency Services CCR California Code of Regulations
CEMP Comprehensive Emergency Management Plan
CFR Code of Federal Regulations
DOCs Department Operations Centers
DSW Disaster Service Worker
DSWVP Disaster Service Worker Volunteer Program
EAS Emergency Alert System
EOC Emergency Operations Center
EOCD EOC Director
EOP Emergency Operations Plan
EVC Emergency Volunteer Center
FCO Federal Coordinating Officer
FEMA Federal Emergency Management Agency
HFD City of Hayward Fire Department
ICS Incident Command System
JFO Joint Field Office
LHMP Hayward Local Hazard Mitigation Plan
LRP Hayward Local Resilience Plan
MHz megahertz
Mw magnitude
NAWAS National Warning System
NDRF National Disaster Recovery Framework
NIMS National Incident Management System
Comprehensive Emergency Management Plan – Part I December 2025
x
OA Operational Area
P3 Public-Private Partnership
RACES Radio Amateurs Civil Emergency Services
REOC Regional Emergency Operations Center
ROG Response Operations Group
SCC State Coordinating Center
SEMS California Standardized Emergency Management System USGS U.S. Geological Survey
Comprehensive Emergency Management Plan – Part I December 2025
11 1.0 INTRODUCTION
The City of Hayward, California (the “City”)’s Comprehensive Emergency Management Plan (CEMP or “the Plan”) is intended to act as a guidance document for all-hazards response and recovery activities. The CEMP is designed to be scalable to the magnitude and nature of any incident that threatens or negatively impacts residents, visitors, the built environment, or natural environment of Hayward.
The City’s Plan was prepared in accordance with the Laws and Authorities listed in Section 6. The Plan meets the requirements of Alameda County's policies on emergency response and planning, and the California Standardized Emergency Management System (SEMS) operational area (OA) response level requirements, and defines the primary and support roles of City agencies and departments in after-incident damage assessment and reporting requirements.
The Plan conforms to SEMS and effectively structures emergency response at all levels in compliance with the Incident Command System (ICS), a standard management hierarchy and procedures for managing temporary incident(s), which has been incorporated into the National Incident Management System (NIMS). The Plan is composed of the following elements:
Part I: EMERGENCY OPERATIONS PLAN
The Emergency Operations Plan (EOP) provides the City with clear guidance for planning purposes and describes and details procedural steps necessary to protect lives and property. The EOP also provides a basis for unified training and response exercise to maintain compliance. This Plan maintains consistency with the concepts and structures defined by the Alameda County’s EOP. Alameda County may periodically review local government EOPs to ensure consistency of disaster response efforts throughout the OA.
Part II: FUNCTIONAL ANNEXES (SEMS ELEMENTS)
The SEMS Functional Annexes address the performance of a particular broad task or function. The functional annexes include a Management Section, Operations Section, Planning Section, Logistics Section, and Finance and Administration Section.
Part III: SUPPORT ANNEXES
During an incident, numerous administrative functions are required to support incident management. The support annexes include Public Alert and Warning, Protective Actions Emergency Evacuation Support, Financial Management, and Volunteer and Donations Management.
Comprehensive Emergency Management Plan – Part I December 2025
12 Part IV: HAZARD, THREAT, OR INCIDENT SPECIFIC ANNEXES Incident annexes describe the concept of operations to address specific hazard situations or an element of an incident requiring specialized application of the EOP, which includes an Earthquake Incident Annex, Hazardous Materials Incident Annex, Cybersecurity Annex, and Evacuation Annex.
PROCEDURES, PROTOCOLS, AND PLANS
Procedures, protocols and plans for disaster response activities are developed by each organizational element to guide operations in the field, within Department Operations Centers (DOCs), and within the Emergency Operations Center (EOC) and are maintained as separate but related documents which are meant to be complementary to the EOP.
This includes recently prepared Shelter Management Plan and Debris Management Plan.
Comprehensive Emergency Management Plan – Part I December 2025
13 2.0 SCOPE AND SITUATION OVERVIEW
The purpose of the CEMP is to establish a framework for all-hazards response and recovery within the City and ensure the public safety of residents, employees, and visitors.
This section describes the scope of the CEMP and provides a situation overview – a summary of the setting and disaster hazard assessment in the City of Hayward. Planning assumptions utilized in development of this Plan are also provided in this section.
2.1 SCOPE
The CEMP addresses emergencies, ranging from relatively minor incidents to large-scale disasters that could occur in the City. The CEMP was developed through a series of meetings with various City departments, non-profit organizations, and private sector entities. The Hayward Fire Department (HFD) is responsible for preparing and maintaining the CEMP, identifying agencies that are instrumental to the construction of the Plan, and facilitating the documentation of those agencies’ concepts of operation as they relate to emergency and disaster situations. The Plan applies to all City emergency management organizational elements during all phases of emergency management.
2.1.1 Phases of Emergency Management
Emergency management operations are typically categorized into four phases: 1) prevention or mitigation of an emergency, 2) preparedness, 3) response, and 4) recovery.
PREVENTION/MITIGATION
Prevention/mitigation operations are intended to eliminate hazards and vulnerabilities, reduce the probability of hazards causing an emergency, or lessen the consequences of unavoidable hazards and vulnerabilities. Examples of prevention/mitigation activities include hazard identification and elimination, communicating emergency preparedness information, and establishing emergency preparedness training programs.
PREPAREDNESS
Preparedness activities, programs and systems are those that exist prior to an emergency incident and are used to support and enhance response to an emergency incident.
Planning, training, exercising, and communications are among the activities conducted under this phase.
RESPONSE
Response activities and programs are designed to address the immediate and short-term effects of the onset of an emergency incident. Response operations are designed to reduce casualties and damage and to speed recovery back to normal business Comprehensive Emergency Management Plan – Part I December 2025
14 operations. Response activities include direction and control, warning, evacuation, other similar operations, and appropriate communications.
RECOVERY
Recovery is the phase that involves restoring systems to normal status. Short-term recovery actions are undertaken to assess the damage and return vital systems to minimum operating standards. Long-term recovery actions may continue indefinitely, but are intended to restore facilities and systems to full capacity.
2.2 CITY OF HAYWARD PROFILE
Hayward is a mid-sized, culturally diverse community that is centrally located within the East San Francisco Bay Area. The City is located in Alameda County approximately 25- miles southeast of San Francisco, 14-miles south of Oakland, 26-miles north of San Jose, and 10-miles west of the Livermore Valley. The City covers an area of approximately
63.7 square miles ranging from the shore of the Bay to the west to the Hayward Hills in the east. The Hayward Fault traverses through the City along the base of the hillside.
According to the U.S. Census Bureau, the City has a total population of 162,954 individuals, with a median age of just 34.6 years, younger than the national median by
3.9 years. The City is the second most diverse city in the State of California, with approximately 9% identifying as Black or African American, 30% Asian ethnicities, and 40% identifying as Hispanic or Latino. Approximately 60% of residents speak a primary language other than English, higher than the state average of 44.2%. The percentage of residents with a bachelor’s degree or higher (27.7%) is below the Alameda County average. Between 2015-2019, the City’s median household income was $86,744 and the median value of owner-occupied housing units was $581,200.
2.3 HAZARD ASSESSMENT
The City is vulnerable to the effects of such hazards as earthquakes, wildfires, severe storms, landslide, flooding, drought, exotic pest and pandemic disease outbreaks, hazardous materials incidents, civil disturbance, and terrorism. The City’s Local Resilience Plan (LRP) (2021) was adopted by the City and approved by U.S. Federal Emergency Management Agency (FEMA) in March of 2022. The following subsections provide a summary of the hazards the City is most likely to experience and describes how the community will organize its efforts to respond and recover.
2.3.1 Earthquake
The City is situated in the heart of earthquake country with the eponymous Hayward Fault running directly through the City from North to South, and a multitude of smaller faults branch from the main fault line. In addition to the Hayward Fault, the City is less than 30 Comprehensive Emergency Management Plan – Part I December 2025
15 miles from the San Gregorio and San Andreas faults to the West, and the Calaveras and Greenville faults to the East.
Earthquakes are of particular concern in the City due to their high likelihood of occurrence within the city and its extensive development. Due to its location directly beneath a highly populated urban center, the Hayward Fault is considered the most dangerous in the Bay Area. All 160,000 residents in the City, and the City’s housing stock, industry, and infrastructure are endangered by the Hayward Fault system, and the neighboring San Andreas and San Gregorio Faults. The most vulnerable areas of the City to earthquake hazards include housing and other buildings near the Hayward Fault rupture zone.
Secondary effects of an earthquake in the City include shaking, liquefaction, landslide, and tsunami. For additional information on these scenarios, see Section 5 of the City’s Local Resilience Plan (LRP) (2021).
2.3.2 Wildfire
Wildfires can be caused by human activities or by natural events. Wildfires can cause significant property damage and threaten public health and safety.
According to the California Department of Forestry and Fire Protection (CAL FIRE), fire hazard severity zones in the Hayward Hills have been mapped as high to very high. The central, lowland areas of the City are not within the CAL FIRE responsibility zone.
According to the National Risk Index Annualized Frequency Wildfire ArcGIS Tool (https://www.arcgis.com/apps/mapviewer/index.html?layers=a21028953f93448e956bc6 ac93f49701), the annualized frequency of a wildfire occurrence in the City was estimated at <0.0015 between San Francisco Bay and the Hayward Hills. In the Hayward Hills the annualized frequency of a wildfire occurrent is between 0.0056 and 0.0136. These values represent the modeled frequency of wildfire hazard events per year as of March 2023.
Although these frequencies are low, the probability of wildfire increases in the eastern hills and is expected to increase with climate change.
Hayward is at particular risk of a Wildland Urban Interface fire in the Hayward Hills, a fire following an earthquake compounded by numerous ignitions and constrained resources, and, in the industrial areas of the City, of fire complicated by hazardous materials.
2.3.3 Landslide
Landslides typically occur as a result of either earthquakes or during heavy and sustained rainfall events. A given area can be at risk for both earthquake-induced landslides as well as landslides caused by rain-saturated soils, but the variables that contribute to each landslide risk are different. Typically, an earthquake-induced landslide occurs when Comprehensive Emergency Management Plan – Part I December 2025
16 seismic energy at the top of a slope gets concentrated and breaks off shallow portions of rock. In rainfall-induced landslides, the slide can begin much deeper in the slope, in very- saturated layers of soil.
Though specific probability data for landslides in the City are not available, the high-risk area for a landslide is the Hayward Hills. Vegetation loss caused by drought conditions and wildfires has likely contributed to the degradation of slope stability in the Old Highlands neighborhood, increasing landslide hazard. Additionally, wet-dry cycles, such as those produced by the combination of ongoing severe drought and a period of intense rainfall (similar to wet El Niño events), can exacerbate soil creep, an early sign of landslide. The possibility of strong shaking from earthquakes within the steep topography of the Hayward Hills makes those parts of the City most vulnerable to landslide threats.
Landslides in the Hayward Hills could cause damage to structures, primarily residences, ranging from inundation with some mud and/or debris to complete destruction or relocation. Landslides may also result in the rupture of gas lines, water lines, and other utilities, and the destruction or displacement of roads, compounding the hazard and interfering with evacuation and response.
2.3.4 Flood
The City is susceptible to both riverine and nuisance flooding. The local watershed is comprised of numerous small creeks leading from the Hayward Hills down across the western part of the City to San Francisco Bay. In the event of severe storm surge combined with abnormally heavy rainfall, these creeks may flood the adjacent bayside flatlands, particularly in the downstream stretches of Ward Creek in South Hayward.
Though the City’s stormwater drainage system is robust and equipped with debris screens, abnormally heavy rainfall, or a buildup of debris in storm drains or other parts of the stormwater management system could cause nuisance flooding in any part of the City. Floods can result to loss or damage to community buildings, roads, and other critical infrastructure, and can result in loss of life. Coastal flooding can also result in loss of marshes, shoreline habitat and recreational opportunities.
2.3.5 Dam Failure Inundation
Four dams pose relatively minor threats to the City if they were to fail. The California Governor’s Office of Emergency Services (Cal OES) and the Association of Bay Area Governments has compiled data on inundation potential for the areas in the event of a failure of Cull Creek, South, or San Lorenzo in the Northern area of the City and Ward Creek in the Southern portion of the City. The damage areas are relatively small and isolated.
Comprehensive Emergency Management Plan – Part I December 2025
17 2.3.6 Hazard Material Vulnerability Threat Summary
The City’s economically robust industrial sector is also a source of potential hazardous materials release. The Hayward Executive Airport, railroad tracks transecting the city, and interstate highway I-880, the only major highway connecting the East Bay with the South Bay, are also potential sources of hazardous materials releases from vehicles transporting hazardous materials.
The City is also near large U.S. Department of Energy facilities in Berkeley and Livermore, and therefore has a unique risk to public safety from the transportation of quantities of various radioactive materials. In case of an accident, small amounts of radioactive materials can be dislodged from their protective containers and become extremely difficult to locate necessitating evacuation of large areas.
The area is home to numerous businesses and industries that manufacture, store, use, and dispose of hazardous materials and hazardous waste. Some of these businesses are neighbors to residential areas. The HFD Hazardous Materials Business Plan addresses specific issues regarding hazardous materials incidents and their potential for contributing to or causing a disaster.
2.3.7 Drought
Drought is not localized, but occurs simultaneously across the region, and may extend statewide or across states. Drought is a cyclic part of the climate of California, with an average recurrence interval of 3 to 10 years as identified in the Alameda County Draft EOP (2023). California’s Fourth Climate Change Assessment (California Office of Planning and Research, 2018) suggests the possibility of longer and more destructive droughts with climate change. Therefore, drought conditions are likely to occur in the City at least every decade.
2.3.8 Cybersecurity Incident
On July 9, 2023, the City proclaimed a local emergency due to a cyber-attack, which attempted to disrupt and hold hostage parts of the City’s networks and computer systems.
According to the Alameda County Draft EOP, a cybersecurity incident is described as an event, act or omission which gives, or may give, rise to one or more of the following:
Unauthorized access to any information system, data, or electronic communications network.
Breach of an applicable security policy.
Reduced integrity of an information system, data, or electronic communications network.
Comprehensive Emergency Management Plan – Part I December 2025
18 Unauthorized use of any information system or electronic communications network for the processing of data.
Disruption or change of the operation of an information system or electronic communications network.
2.3.9 Hazard Mitigation
The City LRP provides an assessment of the City’s capabilities related to hazard mitigation. In general, the City’s plans and policies include a list of projects under consideration for mitigating threats. Additionally, Hayward Development Services, Maintenance Services, Public Works, Utilities & Environmental Services, and HFD all focus on risk reduction activities in their day-to-day operations. A more detailed description of those plans, policies and activities can be found in Section 3 of the LRP.
The City’s 2021 LRP includes a prioritized list of mitigation strategies. This CEMP update addresses organizational preparedness as a very high priority strategy group. The organizational preparedness process includes employee education, emergency management plan update, and tabletop and field exercise. Table 1 depicts mitigation strategies identified in the City’s 2021 LRP.
Comprehensive Emergency Management Plan – Part I December 2025
19 Table 1. Mitigation Strategies by Priority Level (Source: Hayward LRP 2021) Priority
Level Strategy Group Strategies
Very High Organizational Preparedness
Employee Education
Emergency Management Plan Update
Tabletop & Field Exercises
High
Fragile Housing Retrofits Single-Family Home Retrofits
Soft Story Retrofits
Public Programs
Public Education
Community Emergency Response Teams
Defensible Space Programs
Organizational Preparedness
Communications redundancy
Diversify partnerships & MOUs
Acquire Equipment
Participate in the ABAG Regional Lifelines
Council
Collaboration to Mitigate Sea
Level Rise
Implement Adapting to Rising Tides
Multiagency Support
SR-92 Study
Planning
Recovery Plan
Shoreline Realignment Plan
Hayward Executive Airport Seismic
Evaluation
Moderate
Hazardous Materials
Programs
Hazardous Materials Response Team
Hazardous Materials Fee Study
Fragile Housing Retrofits Mobile Home Retrofits
Environmental Programs
Expand Hayward Area Shoreline Protection
Agency (HASPA)
Renewable Emergency Energy Sources
Watershed Analysis
Hillside Landslide Mitigation
Organizational Preparedness Mobile Command Center
Low Administrative Programs
Building Occupancy Resumption Program
911 Registry
Priority Inspection List
Comprehensive Emergency Management Plan – Part I December 2025
20 2.4 PLANNING ASSUMPTIONS
This Plan does not guarantee a perfect response to all situations. The following planning assumptions were known to be true during the development of this Plan including:
Identified hazards will occur.
The City will utilize all available personnel as Disaster Service Workers. The City will organize its response and recovery efforts in alignment with the SEMS and the NIMS.
Mutual aid assistance is requested when disaster relief requirements exceed the City’s ability to meet them.
Private sector and non-profit organizations will be incorporated into the City’s response and recovery efforts.
Training and exercises will be designed and delivered to support the implementation of this plan.
It is the desire of the City to understand and conform to the ideals contained within the National Response Framework and the National Disaster Recovery Plan to ensure both horizontal and vertical alignment with response and recovery partners.
Comprehensive Emergency Management Plan – Part I December 2025
21 3.0 PROGRAM ADMINISTRATION
The following section provides an overview of the foundational guidelines, the process and authority for proclaiming emergencies, and additional elements that sustain the City’s emergency management program before, during, and after a disaster.
3.1 ROLE OF FEDERAL GOVERNMENT
The Robert T. Stafford Act gives the Federal government its authority to provide response and recovery assistance in a major disaster. The Stafford Act identifies and defines the types of occurrences and conditions under which disaster assistance may be provided.
Under the law, the declaration process remains a flexible tool for providing relief where it is needed.
When a disaster is declared, the Federal government, led by FEMA, responds at the request of, and in support of, States, Tribes, Territories, and Insular Areas and local jurisdictions impacted by a disaster. Response actions are organized under the National Disaster Recovery Framework (NDRF).
FEMA appoints a Federal Coordinating Officer (FCO) to establish a Joint Field Office (JFO) and lead the response. Short- and long-term recovery actions are organized under the NDRF. FEMA appoints a Federal Disaster Recovery Coordinator as a deputy to the FCO to lead the recovery effort from the JFO.
3.2 NIMS
The NIMS is a comprehensive, national approach to incident management that is applicable at all jurisdictional levels and across functional disciplines. NIMS establishes common terminology that allows diverse incident management and support organizations to work together across a variety of functions and hazard scenarios. The City utilizes NIMS ICS organization to provide direction and control during incidents. The use of this organizational framework also supports and conforms to SEMS.
3.3 ICS
The City responds to disasters using ICS, which is a primary component of both SEMS and NIMS. ICS is a standardized on-scene emergency management concept that defines the operating characteristics, management components, and structure of incident management organizations throughout the life cycle of an incident. ICS provides a common framework that allows individuals from other areas to work together during emergency response and recovery, reducing the potential for miscommunication.
Comprehensive Emergency Management Plan – Part I December 2025
22 3.4 SEMS
SEMS is the system required by California Government Code §8607(a) for managing response to multi-agency and multi-jurisdiction emergencies. SEMS incorporates the use of the ICS, the Master Mutual Aid Agreement, existing mutual aid systems, the operational area concept, and multi-agency or inter-agency coordination. The SEMS organizational structure consists of five functions and five organizational levels. SEMS functions and organizational levels will be described in the following subsections.
3.4.1 SEMS Functions
SEMS consists of five functions that may be activated during a response based on need:
Management Section.
Operations Section,
Planning/Intelligence Section.
Logistics Section.
Finance/Administration Section.
MANAGEMENT SECTION
The management section coordinates the City’s emergency response, including establishing emergency policies, and is responsible for activation and deactivation of emergency response. The management section is also responsible for notifying personnel of their EOC assignment. The management section may include a safety officer, public information officer, and a liaison.
OPERATIONS SECTION
The operations section coordinates the City’s support of the emergency response through implementation of the City’s action plan (See Planning/Intelligence Section). The City has identified four key functions to accomplish during an emergency and has assigned personnel dedicated to the following four branches :
Fire & Rescue
Law Enforcement
Care and Shelter
Infrastructure
PLANNING/INTELLIGENCE SECTION
The planning and intelligence section is responsible for collecting, evaluating, and disseminating information. The planning/intelligence section is responsible for Comprehensive Emergency Management Plan – Part I December 2025
23 developing an action plan, maintaining documentation, and identifying any potential future emergency response concerns. The planning/intelligence section includes situation status and analysis and documentation branches.
LOGISTICS SECTION
The logistics section is responsible for procuring facilities, personnel, equipment, and materials for the emergency response. The logistics section may include support from the communications, transportation, resource management, personnel and facility support branches.
FINANCE/ADMINISTRATION SECTION
The finance/administration section oversees the financial activities and administrative aspects not assigned to other functions. This section may be supported by timekeeping, cost accounting, and procurement branches.
3.4.2 SEMS Organizational Levels
SEMS consists of the following five organizational levels and response activities are managed at the lowest possible organizational level:
• Field Response
• Local Government
• Operational Area
• Regional
• State
FIELD RESPONSE
The field response level is where emergency response personnel and resources, under the command of an appropriate authority, carry out tactical decisions and activities in direct response to an incident or threat. SEMS regulations require the use of ICS at the field response level of an incident. Organizing tactical operations at the field level will be the direct responsibility of the City.
LOCAL GOVERNMENT
The local government response level is under SEMS is the HFD and the City. The City would manage and coordinate the overall emergency response and recovery activity within city limits. Local governments are required to use SEMS when their EOC is activated, or a local emergency is proclaimed to be eligible for State reimbursement of response-related costs.
Comprehensive Emergency Management Plan – Part I December 2025
24 OPERATIONAL AREA
The operational area (OA) level for the City is Alameda County and is the intermediate level of the State’s emergency management organization. The OA encompasses a county’s boundaries and all subdivisions within the county, including special districts. The OA manages and coordinates information, resources, and priorities among local governments within the OA, and serves as the coordination and communication link between the local government level and the regional level. The City signed the Alameda County Operational Area Agreement, Agreement for Participation in Alameda County Operational Area Emergency Management Organization in 2016. The Alameda County Sheriff/Director of Emergency Services is the OA Coordinator.
REGIONAL AREA
The regional level manages and coordinates information and resources among OA within the mutual aid region and between the OA and the State level. The Regional level coordinates the overall State agency support for emergency response activities within the Region. Because of its size and geography, the state has been divided into three Cal OES administrative regions – Inland, Coastal, and Southern. Hayward lies within the Coastal Region. The regional level operates out of the Regional Emergency Operations Center (REOC).
STATE
The state level of SEMS manages state resources in response to the emergency needs of the other levels and coordinates mutual aid among the mutual aid regions and between the regional level and state level. The state level also serves as the coordination and communication link between the state and the federal disaster response system.
3.5 EMERGENCY PROCLAMATIONS
A local emergency may be proclaimed by the City Council or by the City Manager as specified by ordinance adopted by the City Council. A local emergency declared by the City Manager must be ratified by the City Council within seven days. The governing body must review the need to continue the declaration at least every 14 days until the local emergency is terminated. An emergency proclamation must be issued within 10 days following a disaster if assistance is requested through the California Disaster Assistance Act.
The local emergency must be terminated by resolution as soon as conditions warrant.
Declarations are normally made when there is a threat or an actual disaster or extreme peril to the safety of persons and property within the city, caused by natural or man-made situations.
Comprehensive Emergency Management Plan – Part I December 2025
25 3.5.1 Purpose
The purpose of a local emergency declaration provides the governing body with the legal authority to:
Request that the Governor declare a State of Emergency. Promulgate or suspend orders and regulations necessary to provide for the protection of life and property, including issuing orders or regulations imposing a curfew within designated boundaries.
Exercise full power to provide mutual aid to any affected area in accordance with local ordinances, resolutions, emergency plans, or agreements. Request state agencies and other jurisdictions to provide mutual aid. Require the emergency services of any local official or employee. Requisition necessary personnel and materials from any local department or agency.
Obtain vital supplies and equipment and, if required, immediately commandeer the same for public use.
Impose penalties for violation of lawful orders.
Conduct emergency operations without incurring legal liability for performance, or failure to perform. (Note: Article 17 of the Emergency Services Act provides for certain privileges and immunities.)
3.6 ALERT, WARNING, AND NOTIFICATION
The City uses several systems to communicate with their employees and the public after a disaster. This includes maintaining a contract with Dialogic, a real time communications application. The Dialogic system can be leveraged for notification and mobilization of City employees. The system allows for pre-programming/scripting of notification messages and creation of groups which speeds up notification and mobilization.
Dialogic can be activated by the dispatch center and requires local development, maintenance, training, IT support and data updates in order ensure the readiness of the system. Upon recommendation by a field commander, the EOC director, and/or specific department heads authorized to initiate a message, a dispatch supervisor utilize Dialogic to recall personnel, activate teams, and mobilize human resources for the staffing of the EOC. For additional information see Part III, Public Alert and Warning Annex.
Alameda County Alert (AC Alert) is the Mass Notification System used by the City and is used throughout Alameda County to rapidly disseminate emergency alerts to people who live, work in, or visit the area. AC Alert can send alerts by voice, text, and email, as well as messaging Nixle subscribers (private mass-alert system of Everbridge), posting to social media pages, and sending FEMA Wireless Alerts. Alameda County and the City Comprehensive Emergency Management Plan – Part I December 2025
26 strongly encourage all who live, work in, or frequently visit Alameda County to opt-in to the AC Alert system. When you register with AC Alert you can provide multiple methods of contact, including your cell, home and work phones, and email addresses.
The Genasys Protect (formerly Zonehaven) website at https://community.zonehaven.com establishes a shared map with integrated databases that can be relied upon by residents and first responders for communicating and learning about approaching fire and other emergency conditions, and managing evacuations and safe post-disaster return to residences.
Through the combined Genasys Protect website, AC Alert technology, and public participation, the HFD and other Alameda County fire service and first responder agencies are able to target emergency communication and the movement of people more effectively and efficiently during wildfires, earthquakes and other types of natural and human-caused emergencies and disasters.
3.7 CONTINUITY OF GOVERNMENT
Depending on the extent of the emergency, alternative plans may need to be exercised to ensure key government roles are staffed, records are maintained, and meeting facilities are available. Applicable portions of the California Government Code and the Constitution of the State of California provide authority for the continuity and preservation of local government.
3.7.1 Alternate Seat of Government
The City recognizes that normal operations may be disrupted and an alternate location may be needed to perform critical business functions. In general, the seat of the City government is that place where the City Council is sitting and meeting. The primary meeting location for the City Council is:
Hayward City Hall, 777 B Street, Hayward, CA 94541
An alternate meeting location for the City Council is:
Hayward Fire Station 6 and Regional Fire Training Center, 1401 W. Winton Ave., Hayward, CA 94545
The City Manager may designate alternate or temporary seats of city government should that be necessary. The seat of the City government may be the EOC, or its alternate location, during an emergency and/or large-scale disaster.
Comprehensive Emergency Management Plan – Part I December 2025
27 The following actions are being considered for the alternate facility:
Pre-positioning minimum essential equipment at the alternate facility; and Signing cooperative or mutual aid agreements with other agencies and/or virtual office technologies.
3.7.2 Succession
Under California’s concept of mutual aid, local officials remain in control of their jurisdiction’s emergency. California Government Code permits a local governing body to appoint up to three standby officers for each member of the governing body and up to three standby officers for the political subdivision’s chief executive. It also authorizes that should all members of the governing body, including all standby members, be unavailable, temporary officers shall be appointed by the Chairman of the Board of Alameda County or by the mayor of any city within 150 miles of the political subdivision.
The City requires that the order of succession for the position of the Director of Emergency Services be as follows:
1. HFD Chief, Director of Emergency Services;
2. HFD Deputy Fire Chief, Assistant Director of Emergency Services; and,
3. As designated by the HFD Chief.
The Lines of Succession for various City Officials have been designated and are listed in Table 2.
Table 2. Lines of Succession
Function/Department Title/Position
City Manager Assistant City Manager
City Attorney Assistant City Attorney
Police Chief Deputy Police Chief
Fire Chief Deputy Fire Chief
Director of Community Economic
Development Planning Manager
Public Works Director Deputy Director Public Works Engr.
City Clerk Deputy City Clerk
Comprehensive Emergency Management Plan – Part I December 2025
28 3.7.3 Vital Records Retention
The preservation of vital records is of high importance to the City. The City has an established Records Management Program that is tasked to manage City records efficiently and economically by:
Reducing the number of unnecessary records being stored. Creating a City-wide Records Retention Program.
Setting up standards and procedures for storing records. Administering salvage paper programs.
Maintaining historical records of the City.
Vital records are important because they help describe a reasonably complete compilation of damage, death, physical and mental trauma, and allocation of public and private resources, making it possible to learn from the disaster experience. It is recommended that the City consider identifying a safe, secure facility outside of hazard areas to store vital records. Records currently stored by City departments/agencies are shown in Table 3.
Table 3. Vital Record Storage Locations
Types of Records Stored
Birth, Death and Marriage
Certificates Maintained by Alameda County
Property tax Maintained by Alameda County
Reimbursable projects City Clerk’s Office – 4th Floor City Hall Real property City Clerk’s Office – 4th Floor City Hall Historical archives City Clerk’s Office – 4th Floor City Hall Licenses and permits Business Revenue Department
City-employed personnel and
contractors Human Resources Department
Plans and drawings Public Works/Engineering Department
Police and Police-related Records
Police Personnel Files Hayward Police Department – Winton Site
3.7.4 Protection of Critical Infrastructure
During a disaster, public and private facilities will play varying roles in terms of importance for the protection of critical infrastructure during an emergency. Their importance may be based on their day-to-day role and their expansion during an emergency, or upon unique Comprehensive Emergency Management Plan – Part I December 2025
29 circumstances common to the requirements of a particular emergency response. Critical infrastructure includes telecommunications, water supply, and public safety.
3.8 PLAN MAINTENANCE
The Plan is a living document that should be adjusted as current conditions within the City evolve. This plan is subject to an annual review on or around the anniversary of adoption.
The HFD is authorized and responsible for plan maintenance; all parties with a role in the plan are responsible for recommending revisions that reflect evolving standards and city conditions.
Recommendations for revisions should be communicated formally and in writing, citing affected plan page and line number(s), purpose and/or issue. The HFD, in coordination with partner agency representatives, was delegated authority to make minor and moderate modifications to this plan without City Council approval. Those revisions will be tracked and documented, and the HFD will ensure that all iterations of the plan are updated to reflect those changes. If significant changes to the plan are recommended, those changes will be formally promulgated through the City Council.
3.9 TRAINING AND EXERCISE
Just as the plan will undergo continuous updates and improvements, the individuals and City Departments tasked with carrying out the components of the Plan will need to undergo training and exercise activities to ensure preparedness. The goal of emergency preparedness training at all levels of government is the preparation of individuals for effective and coordinated response to emergencies. All agencies and personnel described within the contents of this plan must receive preparatory training and participate in exercises of the plan to maximize the plan's effectiveness. The City’s Emergency Management Training and Exercise Plan identifies specific “public safety” entities that participate in disaster related training and exercise.
The City’s operational personnel, both EOC leaders and field commanders, have identified the following areas of concern as being of high priority for ongoing planning, training, and exercise towards capability building:
Critical facilities and infrastructure.
Planning to ensure a common operating picture through situational awareness. Damage assessment teams.
Unified command among departments with delegated authority to control the many resources owned by the City.
Staff assessments.
Establishing legal and financial authorities.
Establishment and agreement regarding common geographic branches.
Comprehensive Emergency Management Plan – Part I December 2025
30 Strengthening relationships with PG&E.
ICS/EOC interface.
Comprehensive Emergency Management Plan – Part I December 2025
31 4.0 CONCEPT OF OPERATIONS
This section details how the City intends on fulfilling their SEMS organizational structure, including roles and responsibilities, the EOC staffing assignments, EOC activation levels, and additional details.
4.1 ROLES AND RESPONSIBILITIES
The City’s intends to fulfill its role, and follow the concepts outlined in SEMS for any multiagency emergency response activities. According to Title I, Section 3100 of the California Government Code, all government employees are declared Disaster Service Workers who can be called upon in any emergency. City employees are expected to and will have a responsibility to help in a disaster.
The City plans on staffing the five SEMS functions within the EOC as shown in Table 4.
Table 4. Hayward SEMS Functions Staffing Plan
Management Operations Planning &
Intelligence Logistics Finance and
Administration
HFD
Hayward Police
Department
Development
Services
City Attorney’s
Office
HFD
Hayward Police
Department
Public Works
Maintenance
Services
Development
Services
Community
Services
Library Services
HFD
Hayward Police
Department
Development
Services
City Clerk’s Office
Information
Technology
Maintenance
Services
Public Works
HFD
Hayward Police
Department
Information
Technology
Human
Resources
Housing
Finance
Human
Resources
HFD has identified and recommended specific individuals and positions for assignment to ICS/SEMS positions. HFD maintains an excel spreadsheet which acts as a dynamic “roster”, EOC ROSTER and ORG. CHART Current.xlsx and provides details for the temporary reorganization of the Hayward workforce.
For initial response and short-term recovery phases, the City established the Hayward Emergency Operations Center Organization Chart as depicted on the following Figure 1.
Comprehensive Emergency Management Plan – Part I December 2025
32 Figure 1. Hayward EOC Organizational Chart
Hayward Emergency Operations Center Org. Chart
Finance/ Admin. Section ChiefTimekeeping Unit LeaderCost Accounting Unit LeaderPurchasing Unit LeaderCompensation / Claims Unit LeaderCost Recovery Unit LeaderE OC CoordinatorPublic Information OfficerManagement SectionLegal Affairs OfficerLiaison OfficerSafety & Security OfficerPrivate Sector CoordinatorPolicy GroupOperations Section ChiefFire & Rescue Branch DirectorE mergency Medical Services CoordinatorCare & Shelter Branch DirectorS heltering CoordinatorMass Feeding CoordinatorAnimal Services CoordinatorHaz. Mat. & E nviromental Health CoordinatorPublic Works CoordinatorS afety Assessment CoordinatorDebris Management CoordinatorUtilities CoordinatorLaw E nforcement Branch DirectorInfrastructure Branch DirectorPlanning Section ChiefS ituation Unit LeaderResource S tatus Unit LeaderDocumentation Unit LeaderG.I.S. Unit LeaderAdvance Planning Unit LeaderDemobilization Unit LeaderS upply & Procurement Unit LeaderCommunications & InformationTechnology Unit LeaderTransporation Unit LeaderFacilities Unit LeaderPersonnel Unit LeaderVolunteer Management Unit LeaderFood Unit LeaderLogistics Section Chief E OC Director
E lected Officals
S ocial Media Unit
Call Center Unit
Joint Information Center
Donations Management Unit Leader
Policy Group "Guiders "
Management "Deciders "
Operations "Doers "
Planning "Thinkers"
Logistics "Getters "
Finance"Payers"Functions:
E OCE mergencyOperations C enter
S cribe
Comprehensive Emergency Management Plan – Part I December 2025
33 4.2 EMERGENCY OPERATIONS CENTER (EOC)
Coordination in support of a local field response will be accomplished through the activation and management of the City’s EOC. As a place, the EOC differs greatly from one organization to another, but the functions are much less variable. The EOC is responsible not only for assembling and directing local government response, but also for communicating with all other levels of government, with the private sector, and the public (both the public at large and the public at risk). EOC readiness is the responsibility of HFD. It is recommended the City and HFD develop an EOC Management Plan that reflects how the EOC will operate during an activation at the City’s new EOC location at Fire Station 6 and the Regional Fire Training Center.
The City’s EOC primary location is:
Hayward Fire Station 6 and Regional Fire Training Center 1401 W. Winton Avenue
Hayward, CA 94545
And the alternate location for the City’s EOC is:
Hayward City Hall
777 B Street
Hayward, CA 94541-5007
4.2.1 EOC Activation Levels
Activation criteria are as follows according to the Cal OES:
Comprehensive Emergency Management Plan – Part I December 2025
34 Table 5. EOC Activation Levels
EOC Activation Levels
Activation
Level Conditions Activation Steady State Normal
Operations/Monitoring -
Green
Duty officer status
Steady-state operation
California State Warning Center
maintains situational awareness
None
Level 3 - Yellow Small to moderate disaster or
pre-planned event. Some
functions staffed.
Only basic support staff or as
determined by director Level 2 - Orange Large-scale disaster requiring high amount of state
involvement. Most functions
staffed.
Staffed as situation warrants
and liaison to other agencies
Primary EOC personnel will
be available and check-in
regularly Level 1 - Red Catastrophic disaster requiring comprehensive state-level
response and/or assistance.
All functions staffed.
The EOC is activated and
all or most of the positions
are filled. A full activation
occurs for the most
significant events involving
the use of the full scope of
the City resources and the
need for mutual aid
assistance.
4.2.2 Activation
Activation of the City’s EOC means that at least one City official implements SEMS as appropriate to the scope of the emergency and the City's role in response to the emergency. The City official implementing SEMS may function from the EOC or from other locations depending on the situation. Activated EOCs may be partially or fully staffed to meet the demands of the situation. EOC readiness is the responsibility of HFD.
When to Activate
The City’s EOC is activated when routine use of resources needs support and/or augmentation and when any of the following events occur:
An event is, or may, occur within the City that will significantly impact the life, health, safety, and/or environment of the community resulting in a local emergency declaration.
The Alameda County OA EOC requests the City EOC to activate.
Comprehensive Emergency Management Plan – Part I December 2025
35 When the Governor has proclaimed a State of Emergency in an area that includes the City.
Presidential declaration of a National Emergency.
Automatically, on the proclamation of a State of War Emergency, as defined by the California Emergency Services Act.
EOC’s are not generally activated for routine events that law, fire, and city services can handle according to their day-to-day operations.
4.3 DEPARTMENT OPERATIONS CENTER (DOCS)
The City uses a hierarchical approach to organizing response to major incidents. This approach has the intent to link the field to DOCs which act to support field responders using department-specific tools and resources which are resident in their day-to-day headquarters. This intermediary structure (between the field and an activated EOC) can more fully enable individual agencies’ response. DOCs are useful for those agencies that are managing incident types that are related to their field of expertise. Based on the nature of the incident, the City will further organize support to the field through DOCs, which provide functional support to field operations.
Personnel assigned to field command(s), the DOC(s), and the EOC throughout each operational period will be rostered, tracked, and accounted for with ICS 204 documents.
Those documents will be established by the Finance and Administration Section’s Cost Recovery Unit.
4.4 MUTUAL AID
State level mutual aid efforts for the provision of resources, coordination, and communication with state and federal disaster response and recovery systems, processes, and professionals will be anticipated and addressed through the City’s emergency management system. The mutual aid system is an extension of the concept of “neighbor helping neighbor.” The California Disaster and Civil Defense Master Mutual Aid Agreement (“Master Mutual Aid Agreement”) was signed in 1950 by the Governor of California, all State agencies, political subdivisions, including Alameda County, and fire districts. The Master Mutual Aid Agreement was designed to ensure that additional resources are provided to another agency/political subdivision whenever their own resources are overwhelmed or inadequate. Statewide, both Law Enforcement and Fire Rescue maintain systems for the delivery of mutual aid under this agreement.
The City would request mutual aid from the OA, or Alameda County Mutual Aid Coordinator. Should the event require assistance from outside the county, the region will provide requested assistance to Alameda County.
Comprehensive Emergency Management Plan – Part I December 2025
36 Any future or additional mutual aid agreements developed by the City should be included in this section.
4.5 RESOURCE REQUESTS
The City uses standardized approaches to managing emergencies and disasters. In the field, personnel establish command at the site of incidents which threaten the community.
Based on their assessment, they apply available resources and communicate the need for additional resources from other departments in the City. Activation of the EOC establishes a single ordering point for all agencies operating within the framework of the emergency or disaster; its intent is to support the field.
According to the Alameda County Draft EOP (2023), all resource requests made to the OA or to the Region should include the following information:
Clearly describe the current situation;
Describe the requested resources;
Specify the type or nature of the service the resources are providing; Provide delivery location with a familiar map reference; Provide local contact at delivery location with primary and secondary means of contact;
Provide the name and contact information for the requesting agency or Mutual Aid Coordinator;
Indicate the time the resource is needed and include an estimate of the duration of use; and
For resource requests involving personnel and equipment with operators, indicate if logistical support is required (i.e., food shelter, fuel, and reasonable maintenance).
4.6 DIRECTION AND CONTROL
The City utilizes the ICS organization to provide direction and control during incidents.
The use of this organizational framework supports and conforms to the State of California’s use of SEMS.
The organization, legal authorities, policy decisions, and strategies of the City Council and the appointed officials assigned to the EOC act to provide a broad framework for interactions between the City’s response and that of surrounding jurisdictions in conjunction with or in support of incident management.
Tactical and operational control of response assets are the responsibility of the Operations Section within each Command. Field level responders will organize and coordinate with the City’s DOC or EOC. In the event of an incident of such magnitude Comprehensive Emergency Management Plan – Part I December 2025
37 that competition for resources compromises response, Area Command may be established for the purpose of prioritizing the use of response assets among various field commands.
When activated, the Alameda County EOC will coordinate with the City EOC to facilitate the request and acquisition of resources and to share information. When the Alameda County EOC is not activated, the City will coordinate their request through Cal OES, Operational Area Mutual Aid Coordinators, or through the County Dispatch Center.
4.7 INFORMATION COLLECTION, ANALYSIS, AND DISSEMINATION In the field, personnel establish command at the site of incidents which threaten the community. They initiate response using a prioritized approach that addresses life safety, incident stabilization and property preservation, in that order. Based on assessment (size up), they apply available resources and communicate the need for additional resources via:
Cell phones and other mobile devices for voice, text and email for connectivity to a variety of DOCs; and,
Handheld and vehicle mounted public safety radio systems operating in the 800 megahertz (MHz) band for connectivity to the City’s emergency dispatch center.
This approach to requesting resources blends the use of a many-to-many and a many- to-one ordering point. Internal phone systems, cellular voice systems, public safety radios and other information technologies can be disrupted and impacted by disasters.
Activation of the City’s EOC provides support to the field for resource acquisition and other critical functions that allow field responders to focus on the needs of the community.
In times of disaster, information regarding disaster recovery and mitigation opportunities is provided to the public through press releases, door to-door contact, placement of information on bulletin boards and in businesses, bulk mailings, strategically placed information packets, and public briefings. The City’s Public Information Officer is responsible for the formulation and release of information about the event to the community, news media, emergency workers, and other appropriate agencies and organizations.
4.8 RECOVERY
The City’s post-disaster recovery plan will be developed in a future CEMP update and will include the following points:
An overview of recovery operations;
A description of the recovery organization along with a diagram; Comprehensive Emergency Management Plan – Part I December 2025
38 A description of the damage assessment organization and responsibilities; A description of the documentation process;
An After Action Report process
A description of different disaster assistance programs, their purpose, restrictions, and application process, including public assistance, individual assistance, and hazard mitigation grant programs.
Comprehensive Emergency Management Plan – Part I December 2025
39 5.0 EMERGENCY COMMUNICATIONS
Essential to all emergency organizations is an effective communications capability to support emergency operations. The magnitude of a particular emergency will determine the degree to which communications systems are used. Communications systems are relied upon to be used for direction/coordination of emergency operations, alerting and warning government and the public, and provide advice and instructions to the public.
While generally adequate communications capability exists between the various Cal OES facilities, the communications systems available between Cal OES and local facilities may not be adequate.
5.1 COMMUNICATION SYSTEM VULNERABILITIES
Telecommunications systems are composed of many subsystems, each may be interdependent or interconnected. A radio network, for example, may use a combination of telephone lines, microwave circuits, satellite interfaces, underground and overhead cables, and secondary radio paths. The failure of any one link in this chain can effectively disable or severely limit a large portion of the system.
Communications systems may be overloaded or even rendered inoperable in an emergency. Telephone communications may be overloaded by calls within or into affected areas. The situation may be further complicated by physical damage to equipment, loss of electrical power and subsequent failure of some auxiliary sources.
Loss of emergency power has been the primary cause of communications failure in past disasters. Poor installation practices and inadequate preventative maintenance of backup power sources contribute to the high failure rate. Scarcity of primary fuels for backup systems (gasoline, natural gas, and diesel) may limit viability of surviving communications sites.
In situations arising from a radiological incident or detonation, high intensity, short duration electromagnetic pulses may cause damage or malfunctions to unprotected electrical and electronic systems. Damage from these electromagnetic pulses can occur instantaneously over very large areas. All communications equipment is s susceptible to damage or destruction by electromagnetic pulses, including broadcast stations, radios, televisions, car radios, and battery-operated portable radios.
5.2 EXPECTATIONS OF USE
Generally, in a wide-spread calamity, communications used daily by most agencies, particularly public safety agencies, will be used as well for intra-jurisdictional communications. These agencies will also be expected, at least initially, to operate from their day-to-day offices and headquarters. Departments requiring personnel Comprehensive Emergency Management Plan – Part I December 2025
40 augmentation to properly staff their facilities should request assistance through the Logistics Section/Human Resources Unit at City EOC. Emergency procurements of communications-related equipment/supplies should also be handled through the Logistics Section/Supply Unit of the EOC.
All communications personnel must familiarize themselves with protective measures and countermeasures to employ that minimize the risk of outages or failures caused by elements of a catastrophe.
5.3 FEDERAL COMMUNICATIONS EMERGENCY ALERT SYSTEM (EAS) The Federal Communications Emergency Alert System (EAS) is a network of public broadcast stations and interconnecting facilities that have been authorized by the Federal Communications Commission to operate in a controlled manner during a state of public peril or disaster, or other large- scale emergency. The system’s main purpose is to provide the President and Federal Government Officials the means by which to transmit emergency communications to the public. It may also be used for local, state and other national programming for public information on situations posing a threat to life and/or property. EAS is activated by requesting assistance through the State Office of Emergency Services via the OA EOC. The EAS should be used to the maximum extent possible for the dissemination of emergency information, advice, and action instructions to the public.
5.3.1 National Warning System
The National Warning System (NAWAS) is a nationwide wire-line communications 2-way voice system connecting subscribing emergency management organizations and designed primarily to warn of a nationwide attack. It may also be used for coordination and communications for major peacetime emergencies.
5.3.2 State Communications Systems
CALIFORNIA LAW ENFORCEMENT RADIO SYSTEM
This system serves all Cal OES facilities and interconnects law enforcement agencies of all counties and numerous cities. The system is connected by microwave to provide statewide coverage. This system is the State’s radio backup to NAWAS.
CALIFORNIA OES SYSTEM
This is a local government system that serves all Cal OES facilities, a number of state agencies, and county-level operational area EOCs participating in the system. It is microwave-interconnected for statewide coverage.
Comprehensive Emergency Management Plan – Part I December 2025
41 CALIFORNIA OES FIRE NETWORK
This system serves Cal OES facilities and fire support facilities and equipment. Radio equipment on this network is located with fire service agencies in all 58 counties. The network employs mountain-top mobile relays and interconnections to the State Microwave System to provide state-wide coverage.
CALIFORNIA NATIONAL GUARD
The California National Guard has an assortment of communications capabilities with limited day-to-day in-place systems. Most communications are designed to serve their own operating forces but have been used for local reserve communications.
5.3.3 Local Communications Systems
EOC COMMUNICATIONS
Communications systems installed at or controlled from the City EOC will normally be used to support the field activities of the various City emergency services. The City Emergency Operations Radio System consists of radios that are necessary to gather information required to stay informed of the situation and to control the activities of services within the City.
Those services that have the capability to control their operating elements by radio will continue to exercise that control. The respective EOC Section Chief will be kept informed, by radio, of ongoing activities and the extent of commitment of available resources. This information will serve two purposes at the City EOC, (1) Provide the basis for the Section Chief to make decisions on use of limited resources and (2) Provide the basis for performing continuing situation analysis of conditions in the City.
The following radio systems are available in the City EOC:
Law Enforcement Network – This network operates on several channels.
Channels are used for the Hayward dispatch and control of Law Enforcement service mobile units based on area. These channels will be used by the Law Enforcement Unit in the EOC to keep the EOC informed on developments. Main dispatch will remain with Hayward Police Dispatch. The EOC will have radio contact to a dispatch operator.
Radio Amateurs Civil Emergency Services (RACES) – RACES provides a variety of communications services in the Amateur Radio Frequency Bands. They provide communications from cities to the county, to the state and regional offices as well as to hospitals and other places as needed. This service is provided by Comprehensive Emergency Management Plan – Part I December 2025
42 amateur radio volunteers, using their own equipment and affords flexibility not available with established radio networks.
RACES is generally assigned to back up any of several services in case regular communications paths become inoperative. Special considerations should be given to RACES to support disaster medical care and emergency public information operations.
Table 6. Communications Frequency Matrix
Assigned To Designation Frequency
Hayward Police Department
COM 1
COM 2
COM 3
483.1125 MHz
482.6625 MHz
482.6375 MHz
Hayward Fire Department Yellow Channel 460.000 MHz
Public Works Department 158.895 MHz
RACES
145.3 MHz
147.015 MHz
146.94 MHz
5.4 TELEPHONE SYSTEMS
LANDLINES
Common carrier telephone landline service is available to support all emergency systems.
The City EOC has dedicated lines available for activation when the EOC is staffed. Note that inter-building and local system-wide switching systems may be affected by power outages and fluctuations.
CELLULAR AND MICROWAVE
Cellular and microwave telephone services are in use by nearly all agencies in the Bay Area. These systems are fairly reliable in localized emergency situations but may quickly become overloaded in a wide-spread disaster. Also, ground movement in seismic events may cause network failures.
SATELLITE TELEPHONE SYSTEMS
Satellite telephone systems have become more widely available and more economical to use over the last few years. Satellite systems are generally a highly reliable form of communications during disasters.
Comprehensive Emergency Management Plan – Part I December 2025
43 6.0 LAWS AND AUTHORITIES
The following laws and authorities provide direction and guidance for conducting the City’s emergency operations.
6.1 CITY OF HAYWARD MUNICIPAL CODE
The following City of Hayward policy directs the City’s emergency services organization and function.
Hayward, California Municipal Code, Chapter 3 – Public Safety, Article 2 – Emergency Services Organization and Function.
6.2 ALAMEDA COUNTY ADMINISTRATIVE CODE
The following Alameda County policies direct the City’s emergency management program:
County of Alameda Administrative Code, Title 2, Chapter 2.118, “Civil Defense,” June 30, 2002.
County of Alameda Resolution No. R-87-465, “Adopt Multihazard Functional Plan” – October 1986, June 2, 1987.
County of Alameda Resolution No. 58748, “Adopting the California Master Mutual Aid Agreement,” November 28, 1950.
County of Alameda, Agreement for Participation in Alameda County Operational Area Emergency Management Organization, dated May 10, 2016.
6.3 STATE OF CALIFORNIA
The following State of California policies direct the City’s emergency management program:
State of California Emergency Services Act, Chapter 7 of Division 1 of Title 2 of the Government Code.
California Code of Regulations Title 19, Chapter 2, Subchapter 3, §2620 et seq. SEMS Regulations, Chapter 1 of Division 2 of Title 21 of the California Code of Regulations; and California Government Code §8607.
State of California Emergency Plan, State of California, Cal OES, 2009. Disaster Assistance Act Regulations, CCR, Title 19, Division 2, Chapter 6. California Disaster and Civil Defense Master Mutual Aid Agreement.
6.4 FEDERAL
The following Federal plans and policies direct the City’s emergency management program:
Comprehensive Emergency Management Plan – Part I December 2025
44 Robert T. Stafford Emergency Disaster Relief and Emergency Assistance Act (42 United States Code 5121 et seq., and Related Authorities). Federal Disaster Relief Regulations: 44 Code of Federal Regulations (CFR) Part 206.
Federal Civil Defense Act of 1950 (Public Law 920, as amended). NIMS.
Homeland Security Presidential Directive 5, Management of Domestic Incidents. Presidential Policy Directive 8, National Preparedness. Homeland Security Presidential Directive 21, Public Health and Medical Preparedness.
Comprehensive Emergency Management Plan – Part I December 2025
45 7.0 GLOSSARY
Aerial Reconnaissance: An aerial assessment of the damaged area that includes gathering information on the level and extent of damage and identifying potential hazardous areas for on-site inspections.
Aerosol: Fine liquid or solid particles suspended in a gas, for example, fog or smoke.
All Hazards: Refers to a policy or program that is designed to deal with a variety of natural and technological hazards.
Annex: A document that supplements the Emergency Operations Plan, which provides further planning information for a specific aspect of emergency management.
Appendix: A separate portion of the Emergency Operations Plan that contains guidance and information specific to actions required in emergency management.
Biological Agents: Living organisms or the materials derived from them that cause disease in or harm to humans, animals, or plants or cause deterioration of material. Biological agents may be used as liquid droplets, aerosols, or dry powders.
Chemical Agent: A chemical substance that is intended to kill, seriously injure, or incapacitate people through physiological effects. Generally separated by severity of effect: lethal, blister, and incapacitating.
Comprehensive Emergency Management Plan: A document required by state regulation that consists of a Basic Plan, Appendices, Supplemental Annexes, and Standard Operating Procedures for the purpose of providing effective mitigation, response to and recovery from disasters.
Consequence Management: Measures to protect public health and safety, restore essential government services, and provide emergency relief to governments, businesses, and individuals affected by the consequences of terrorism. State and local governments exercise primary authority to respond to the consequences of terrorism. (Source: Federal Response Plan Terrorism Incident Annex, page TI-2, April 1999). The Federal Emergency Management Agency (FEMA) has been designated the Lead Federal Agency (LFA) for consequence management to ensure that the Federal Response Plan is adequate to respond to terrorism. Additionally, FEMA supports the Federal Bureau of Investigation (FBI) in crisis management.
Continuity of Government: Includes measures to – ensure continued leadership and preservation of vital records, thereby maintaining a viable system of government supported by law; establish emergency authorities legally vested in government leaders so Comprehensive Emergency Management Plan – Part I December 2025
46 that they have prescribed powers to act; ensure survivability of mechanisms and systems for direction and control so that actions directed by leaders can be communicated and coordinated; sustain essential emergency services and resources so that critical response and recovery actions can achieve widest possible implementation.
Crisis Management: This is the law enforcement aspect of an incident that involves measures to identify, acquire, and plan the resources needed to anticipate, prevent, and/or resolve a threat of terrorism. The FBI is the LFA for crisis management for such an incident. (Source: FBI) During crisis management, the FBI coordinates closely with local law enforcement authorities to provide successful law enforcement resolution to the incident. The FBI also coordinates with other Federal authorities, including FEMA. (Source: Federal Response Plan Terrorism Incident Annex, April 1999) Critical Areas: Environmentally sensitive areas which include wetlands fish and wildlife habitat conservation areas; geologically hazardous areas; areas with a critical recharging effect on aquifers used for potable water; and frequently flooded areas. Critical areas have measurable characteristics which, when combined, create a value for or potential risk to public health, safety and welfare.
Damage Assessment: The appraisal or determination of the actual damage resulting from a disaster.
Decontamination: The process of making people, objects, or areas safe by absorbing, destroying, neutralizing, making harmless, or removing the HazMat.
Disaster: The occurrence or imminent threat of widespread or severe damage, injury or loss of life or property resulting from any natural or manmade cause including fire, flood, earthquake, air contamination, blight, drought, infestation, explosion, riot, hostile military or paramilitary action, other public calamity requiring emergency action.
Disaster Assistance Center: A location established in a disaster area that houses all federal, state, and local agencies that deal directly with the needs of the individual victim.
DACs are established only after a Presidential Declaration.
Disaster Declaration: A document executed by an elected government for the purpose of obtaining assistance from a higher level of government.
Disaster Service Workers: All public employees in California are subject to such emergency or disaster activities as may be assigned by their supervisors or by law.
Drill: A supervised instruction period aimed at testing, developing, and maintaining skills in a particular operation. A drill is often a component of an exercise.
Comprehensive Emergency Management Plan – Part I December 2025
47 Drop Cover, and Hold: Shelter position under tables or desks or other protected places away from overhead fixtures, windows, high cabinets, and bookcases, for immediate individual protection during an emergency.
Emergency: An event, the effects of which cause loss of life, human suffering, property damage (both public and private), and severe economic and social disruption.
Emergency Alert System: A program of the Federal Communications Commission to coordinate the dissemination of emergency information via commercial broadcasters.
Emergency Coordinator: A position called for in the Emergency Organization to carry out emergency management functions on a day-to-day basis at the local level.
Emergency Manager: A position called for in the Emergency Organization to oversee the implementation of the City Comprehensive Emergency Management Plan at the local level.
Emergency Operations Center: A centralized location where individuals responsible for responding to a large scale emergency can have immediate communication with each other and with City management for the purpose of enhancing coordination in exercising direction and control of emergency response and recovery efforts.
Emergency Organization: Organization to direct and control operations of the City during a period of emergency with assigned responsibilities and tasks for planning, response, and recovery in emergency situations.
Emergency Powers: Special authority granted to a chief local official during times of emergency. The State delegates emergency powers to designated local officials through an executive order.
Erosion: The process whereby the land surface is worn away by the action of water, wind, ice or other processes, and by geologic events such as gravitational creep or landslides Federal Response Plan: The Federal Response Plan establishes a process and structure for the systematic, coordinated, and effective delivery of Federal assistance to address the consequences of any major disaster or emergency declared under the Robert T. Stafford Disaster Relief and Emergency Assistance Act, as amended (42 U.S. Code [USC], et seq.). The Federal Response Plan Terrorism Incident Annex defines the organizational structures used to coordinate crisis management with consequence management. (Source:
Federal Response Plan Terrorism Incident Annex, April 1999) Floodplain: Areas inundated with water that are typically adjacent to streams, rivers, lakes, and coastlines and are susceptible to strong winds.
Comprehensive Emergency Management Plan – Part I December 2025
48 Flood Way: An area of land immediately adjacent to a stream or river channel that, in times of flooding, becomes an enlarged stream or river channel and carries the floodwater with the highest velocity.
Hazard Mitigation: Any action taken to reduce or permanently eliminate the long-term risk to human life and property and the environment posed by a hazard.
Hazard Mitigation Grant Program: Authorized Under Section 404 of the Stafford Act.
Provides funding for Hazard Mitigation projects that are cost-effective and comply with existing post-disaster mitigation programs and activities. These projects cannot be funded through other programs to be eligible
Landslide Hazard Areas: Areas potentially subject to landslides, based on a combination of geologic, topographic, and hydrologic factors. This includes areas with any combination of bedrock, soil, slope, structure, hydrology.
Lead Agency: The Federal department or agency assigned lead responsibility under U.S. law to manage and coordinate the Federal response in a specific functional area. The FBI is the lead agency for crisis management and FEMA is the lead agency for consequence management. Lead agencies support the overall Lead Federal Agency (LFA) during all phases of the response.
Lead Federal Agency (LFA): The agency designated by the President to lead and coordinate the overall Federal response is referred to as the LFA and is determined by the type of emergency. In general, an LFA establishes operational structures and procedures to assemble and work with agencies providing direct support to the LFA in order to provide an initial assessment of the situation, develop an action plan, monitor and update operational priorities, and ensure each agency exercises its concurrent and distinct authorities under U.S. law and supports the LFA in carrying out the President’s relevant policy. Specific responsibilities of an LFA vary according to the agency’s unique statutory authorities.
Level I Emergency: Minor to moderate emergency, such as major power outage, bomb threat, air pollution alert, isolated fire, or minor earthquake (no injuries or significant damage).
Level II Emergency: Moderate to severe emergency, such as major fire, moderate earthquake, bomb explosion (with injuries and/or structural damage) Level III Emergency: Major emergency or disaster, such as a major earthquake or nuclear explosion.
Comprehensive Emergency Management Plan – Part I December 2025
49 LIDAR: Light Detection and Ranging Airborne Laser Mapping. compliments other remote sensing such as orthophotography and traditional topographic mapping. LIDAR is able to sense through vegetation (remove the trees) and produce a map of the actual topography.
Liquefaction: Liquefaction occurs in areas that have certain soils which lack cohesion and where the water table is close to the surface. Such soils can lose shear strength and flow like a liquid even during earthquakes originating beyond City .
Local Emergency Responder: Safety services provided by outside agencies, such as police, fire, medical or rescue services.
Mitigation: Those actions (including threat and vulnerability assessments) taken to reduce the exposure to and detrimental effects of a WMD incident.
Mitigation Phase: Phase of emergency management for site-specific action to minimize hazards and reduce the potential for injury or damage in an emergency.
Nonpersistent Agent: An agent that, upon release, loses its ability to cause casualties after 10 to 15 minutes. It has a high evaporation rate, is lighter than air, and will disperse rapidly.
It is considered to be a short-term hazard; however, in small, unventilated areas, the agent will be more persistent.
Persistent Agent: An agent that, upon release, retains its casualty-producing effects for an extended period of time, usually anywhere from 30 minutes to several days. A persistent agent usually has a low evaporation rate and its vapor is heavier than air; therefore, its vapor cloud tends to hug the ground. It is considered to be a long-term hazard. Although inhalation hazards are still a concern, extreme caution should be taken to avoid skin contact as well.
Plume: Airborne material spreading from a particular source; the dispersal of particles, gases, vapors, and aerosols into the atmosphere.
Preparation (Preparedness) Phase: Phase of emergency management for employee in- service training in emergency responsibilities, such as prevention of injuries and property damage, first-aid and other response and rescue operations, and for acquisition of adequate supplies and equipment required to respond to an emergency.
Radiation: High-energy particles or gamma rays that are emitted by an atom as the substance undergoes radioactive decay. Particles can be either charged alpha or beta particles or neutral neutron or gamma rays.
Comprehensive Emergency Management Plan – Part I December 2025
50 Recovery Phase: Phase of emergency management for the initiation of short-range and long-range recovery plans at each effected site to return to normal operations following an emergency.
Response Phase: Phase of emergency management in which all employees take appropriate steps in an emergency situation to put the emergency plan into action.
Seismic Hazard Areas: Areas subject to severe risk of damage because of earthquake- induced ground shaking, slope failure, settlement, soil liquefaction, or surface faulting.
Settlement can occur in areas with loose, unconsolidated soil, which can either slide or suddenly drop when shaken.
Terrorism: The unlawful use of force or violence against persons or property to intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of political or social objectives. Domestic terrorism involves groups or individuals who are based and operate entirely within the United States and U.S. territories without foreign direction and whose acts are directed at elements of the U.S. government or population.
Toxicity: A measure of the harmful effects produced by a given amount of a toxin on a living organism.
Weapons-Grade Material: Nuclear material considered most suitable for a nuclear weapon.
It usually connotes uranium enriched to above 90 percent uranium-235 or plutonium with greater than about 90 percent plutonium-239.
Weapons of Mass Destruction: Any explosive, incendiary, or poison gas, bomb, grenade, rocket having a propellant charge of more than 4 ounces, or a missile having an explosive incendiary charge of more than 0.25 ounce, or mine or device similar to the above; poison gas; weapon involving a disease organism; or weapon that is designed to release radiation or radioactivity at a level dangerous to human life. (Source: 18 USC 2332a as referenced in 18 USC 921
Wildfire Urban Interface: Wildland vegetation and forest areas adjacent to or intermingled with residential developments
Comprehensive Emergency Management Plan – Part I December 2025
51 8.0 REFERENCES
Acgov.org. Emergencies. https://www.acgov.org/emergencysite/ Alameda County Sheriff’s Office of Homeland Security and Emergency Services. 2012.
Alameda County Emergency Operations Plan.
https://www.acgov.org/ready/documents/EmergencyOperationsPlan.pdf Alameda County Sheriff’s Office of Homeland Security and Emergency Services. 2023.
DRAFT Alameda County Emergency Operations Plan.
https://www.acgov.org/government/documents/EOP-Draft-8-15-2023-Review- Comment.pdf
Alameda County Operational Area Volunteer Plan. 2008.
California Department of Forestry and Fire Protection (CAL FIRE). Fire Hazard Severity Zones in State Responsibility Area – Alameda County. https://34c031f8-c9fd-4018- 8c5a-4159cdff6b0d-cdn-endpoint.azureedge.net/-/media/osfm-website/what-we- do/community-wildfire-preparedness-and-mitigation/fire-hazard-severity-zones/fire- hazard-severity-zones-map-2022/fire-hazard-severity-zones-maps-2022- files/fhsz_county_sra_11x17_2022_alameda_2.pdf
California Disaster and Civil Defense Master Mutual Aid Agreement. 1950.
California Government Code. Title I, Section 3100.
Cal OES. Dam Safety Planning. https://www.caloes.ca.gov/offic e-of-the-director/op erations/planning-preparedness-prevention/dam-safety-planning/ Cal OES, Standardized Emergency Management System, Approved Course of Instruction Emergency Operation Center Course G611, Local Government, Operations Section, Function Specific Handbook (found at:
https://www.caloes.ca.gov/wp-content/uploads/Preparedness/Documents/SEMS- EOC-Course-Part-III-Supporting-Documents-Local-Government-–- Operations.pdf)
California Office of Planning and Research, 2018. California’s Fourth Climate Assessment. https://climateassessment.ca.gov/
City of Hayward. Hazardous Materials Business Plan. 2023. Updated annually through the California Environmental Reporting System https://cers.calepa.ca.gov/.
City of Hayward Local Resilience Plan. 2021.
Comprehensive Emergency Management Plan – Part I December 2025
52 FEMA, Emergency Management Institute, ICS Forms, 2018, found at:
https://training.fema.gov/icsresource/icsforms.aspx
FEMA. Integrated Public Alert & Warning System. https://www.fema.gov/emergency - managers/practitioners/integrated-public-alert-warning-system FEMA. National Disaster Recovery Framework. Available at: https://www.fema.gov/ emergency-managers/national-preparedness/frameworks/recovery Accessed January, 2024
FEMA. 2017. National Incident Management System, (3rd
ed). https://www.fema.gov/sites/default/files/2020-07/fema_nims_doctrine- 2017.pdf
FEMA. 2021. Stafford Act, as Amended (FEMA P-592 vol.1). https://www.fema.gov/s ites/default/files/documents/fema_stafford_act_2021_vol1.pdf Hayward Fire Department. Know Your Zone - Zonehaven Emergency Evacuation Platform. https://www.hayward-ca.gov/fire-department/disaster-prep aredness/zonehaven-emergency-evacuation-platform
Hayward Fire Department. Power Outage Alerts. https://www.hayward-ca.gov/fire-depa rtment/disaster-preparedness/power-outage-alerts
National Risk Index Annualized Frequency Wildfire ArcGIS Tool. (https://www.arcgis.com/apps/mapviewer/index.html?layers=a21028953f93448e9 56bc6ac93f49701).
Comprehensive Emergency
Management Plan – 2025
Part II – Functional Annexes
(SEMS Elements)
CEMP Part II December 2025
Table of Contents
Part II - 1
TABLE OF CONTENTS
1.0 MANAGEMENT SECTION ................................................................... PART II - 2
2.0 OPERATIONS SECTION ................................................................... PART II - 26
3.0 PLANS & INTELLIGENCE SECTION ................................................. PART II - 59
4.0 LOGISTICS SECTION ....................................................................... PART II - 82
5.0 FINANCE AND ADMINISTRATION SECTION ................................. PART II - 105
CEMP Part II
Management Section December 2025
Part II - 2
PART II: FUNCTIONAL ANNEXES (SEMS ELEMENTS)
1.0 MANAGEMENT SECTION
The Management Section is responsible for overall emergency policy and coordination, including the following:
• Overall management and coordination of emergency response and recovery operations;
• Oversee and manage all Sections in the Emergency Operations Center (EOC); • Coordinate and liaison with appropriate federal, state, local government, private and volunteer entities;
• Establish priorities and resolve demands conflicts; and, • Prepare and disseminate emergency public information and other essential information and data about impacts and damage.
The following charts and tables in Part II reference ICS Forms. These ICS Forms are published by FEMA and are available for download at the following location:
https://training.fema.gov/icsresource/icsforms.aspx
CEMP Part II
Management Section December 2025
Part II - 3
EOC COORDINATOR
POSITION
OVERVIEW
The EOC Coordinator assists and serves as an advisor to the Emergency Operations Center Director (EOCD) and General Staff as needed
Oversees the overall functioning of the emergency operations center
REPORT TO EOC DIRECTOR
PLANS &
REPORTS
ALL PLANS
ALL REPORTS
FORMS & GUIDES FORMS
ALL
POSITION JOBAID
ICS 225 FOR PD CREDENTIALING
GUIDES
ALL
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Facilitate the overall functioning of the EOC.
Assist and serve as an advisor to the EOC Director and General Staff as needed.
Provide information and guidance related to the internal functions of the EOC.
Ensure compliance with operational area emergency plans and procedures.
Assist the Liaison Officer in ensuring proper procedures are in place for directing agency representatives and conducting VIP/visitor tours of the EOC.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over jobaid.
CEMP Part II
Management Section December 2025
Part II - 4
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Assist the EOC Director in determining appropriate staffing for the EOC. (FORM | ICS 207)
Provide assistance and information regarding section staffing to all general staff.
Assist the EOC Director and the General Staff in developing overall strategic objectives as well as section objectives for the EOC Action Plan.
(FORM | ICS 202)
(GUIDE | PLANNING “P” GUIDE)
Aid with shift change activity as required.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure. (GUIDE | LEGAL AUTHORITIES)
Assist the Planning/Intelligence Section in the development, continuous updating, and execution of the EOC Action Plan.
(PLAN | EOC ACTION PLAN)
(GUIDE | PLANNING “P” GUIDE)
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
CEMP Part II
Management Section December 2025
Part II - 5
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Management Section December 2025
Part II - 6
EOC DIRECTOR
POSITION
OVERVIEW
Overall responsibility and authority for the operation of the EOC Will ensure EOC is staffed and operated at a level commensurate with the emergency
REPORT TO
LOCAL GOVERNMENT | CITY COUNCIL or DESIGNEE
OPERATIONAL AREA | BOARD OF SUPERVISORS or DESIGNEE
REGIONAL | OES REGION ADMINISTRATOR or DESIGNEE
STATE | OES DIRECTOR or DESIGNEE
DIRECT REPORT GENERAL STAFF
Operations Section
Chief/Coordinator
Planning/Intelligence Chief
Section Coordinator
Logistics Section
Chief/Coordinator
Finance/Administration
Section Chief/ Coordinator
MANAGEMENT STAFF
EOC Coordinator
Public Information Officer
Liaison Officer/Agency
Representative
Safety Officer
Legal Officer
Private Sector Coordinator
PLANS
& REPORTS
EOC ACTION PLAN
ADVANCE PLAN(S)
DEMOBILIZATION PLAN
PRESS RELEASES
REPORTS
FORMS &
GUIDES
FORMS
POSITION JOBAID
ALL ICS FORMS (IF USING)
ICS 225 FOR PD CREDENTIALING
PROCLAMATION RESOLUTION
GUIDES
PLANNING “P”
RECOVERY PLAN/PROJECT MANAGEMENT
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
CEMP Part II
Management Section December 2025
Part II - 7
Exercise overall management responsibility for the coordination between emergency response agencies in the jurisdiction.
Establish appropriate EOC staffing level.
Continuously monitor organizational effectiveness and make appropriate changes.
Alongside General Staff, set jurisdictional priorities for response.
Ensure all department/agency actions support established EOC priorities.
Ensure that inter-agency coordination is accomplished effectively.
Determine appropriate level of activation based on known situation.
Mobilize/Recall appropriate personnel to the EOC for initial activation.
Respond immediately to EOC site and determine operational status.
Obtain briefing from available sources.
Ensure that EOC is properly set up and ready for operations.
Ensure that EOC check-in procedure is established.
(FORM | ICS 211, FORM | ICS 205A)
Ensure that EOC organization and staffing chart is posted and completed. (FORM | ICS 207)
Determine needed EOC sections, assign Section Chief/Coordinators and ensure sections are adequately staffed.
Operations Section Chief/Coordinator
Logistics Section Chief/Coordinator
Planning/Intelligence Section Chief/Coordinator
Finance/Administration Section Chief/Coordinator
Determine needed Management Staff positions and ensure they are filled as soon as possible. EOC Coordinator
Public Information Officer
Rumor Control Coordinator
Liaison Officer
Agency Representative
Safety Officer
Ensure telephone and/or radio communications with other EOCs/DOCs is established and functioning.
Schedule the initial EOC Action Planning Meeting.
(FORM | ICS 230)
Alongside General Staff, determine what representation is needed at the EOC from other emergency response agencies.
Assign a liaison officer to coordinate outside agency response to the EOC, and if needed, assist in establishing an Inter-Agency Coordination Group.
CEMP Part II
Management Section December 2025
Part II - 8
Monitor general staff activities to ensure appropriate actions are being taken.
Alongside Public Information Officer, conduct news conferences and review media releases for final approval. Follow established procedure for public information. (FORM | PRESS RELEASE)
Ensure Liaison Officer is providing and maintaining effective inter-agency coordination.
Based on status reports, establish initial strategic objectives for the EOC.
Alongside Management Staff, prepare EOC objectives for the initial Action Planning Meeting. (FORM | ICS 202)
(GUIDE | PLANNING “P” GUIDE)
Convene Initial Action Planning meeting.
Ensure that all Section Chief/Coordinators, Management Staff, and key agency representatives are in attendance.
Ensure appropriate Action Planning procedures are followed. (GUIDE | PLANNING “P” GUIDE)
Ensure meeting is facilitated appropriately by the Planning/Intelligence Section, and consensus among EOC Coordinator, PIO, and Section Chiefs/Coordinators on objectives for forthcoming operational period.
Assess the situation, define problems, set priorities, and establish strategic and SMART objectives for the response/recovery period.
Determine the Operational Period time frame (i.e., 6-, 8- or 12-hour shifts).
Review and identify the need for additional staffing and/or other resources.
When Action Plan is completed by the Planning/Intelligence Section, review, approve and authorize its distribution and implementation.
(FORMS | ICS 201, ICS 202, ICS 205A, ICS 207, ICS 208, ICS 211, ICS 213. ICS 215, ICS 215A, ICS 230 OR PLAN | EOC ACTION PLAN)
Conduct periodic briefings with general staff to ensure strategic objectives are current and appropriate.
Conduct periodic briefings for elected officials or their representatives. (FORM | ICS 209 OR REPORT | SITUATION STATUS)
If appropriate, issue an Emergency Proclamation, and coordinate local government proclamations with other emergency response agencies.
(FORM | PROCLAMATION RESOLUTION)
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Ensure next shift’s staff are accounted for.
CEMP Part II
Management Section December 2025
Part II - 9
Ensure the safety and well-being of staff being dismissed for the operational period.
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out. (FORM | ICS 211, FORM | ICS 205A)
Authorize demobilization of sections, branches, and units when they are no longer required informally or via a plan.
(PLAN | DEMOBILIZATION PLAN)
Notify higher level EOCs and other appropriate organizations of planned demobilization, as appropriate.
Ensure that open actions not completed will be handled after demobilization.
Ensure that all required forms or reports are completed prior to demobilization.
Prepare to provide input to the after-action report.
Proclaim termination of the emergency response and proceed with recovery operations.
Alongside Public Information Officer, make emergency termination notifications to City Council, Response Partners, Community and Operational Area.
Provide a final emergency briefing of the event to EOC personnel to include:
Date/time of termination.
Requests all documentation developed during the event response. Instructions for support of recovery operations or assembly of the final report. Time and date of formal debrief to identify issues, lessons learned, and corrective actions.
Instructions for resumption of normal operations.
Determine if a formal Recovery Plan is required based on a review of the technical criteria by:
Length and resources required for investigating and fact-finding activities. Assessment of property damage efforts require substantial and prolonged coordination and communications with off-site governments, agencies, and/or response organizations.
Number of personal injuries or illnesses requiring protracted follow-up treatment, analysis, and public information.
Supervise the transition of the EOC from response to recovery operations, as necessary.
Appoint a recovery manager; the recovery manager will establish a recovery organization and recovery plan.
(GUIDE | RECOVERY PLAN/PROJECT MANAGEMENT)
Proclaim EOC Deactivate.
Approve deactivation of other emergency facilities that were opened because of the emergency.
CEMP Part II
Management Section December 2025
Part II - 10
Assist with recovery objectives, as requested for Recovery Plan. (GUIDE | RECOVERY PLAN/PROJECT MANAGEMENT)
Turn over command to Recovery Manager.
Schedule Incident Debriefing.
Assist with the development of a Final AAR.
Approve final AAR.
(REPORT | LOCAL GOVERNMENT AFTER ACTION REPORT)
Turn in completed job aids, forms, and notes to Documentation Unit.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Management Section December 2025
Part II - 11
LEGAL COUNSEL
POSITION
OVERVIEW
Provides legal counsel to the Emergency Services Director/EOC Director and all City/Agency Staff in legal matters pertaining to emergency response and recovery
Assists in the preparation of proclamations, ordinances, and other legal documents; and maintains the City’s/Agency’s legal records and reports
REPORT TO EOC DIRECTOR
PLANS
& REPORTS
SHARES WITH RELEVANT STAKEHOLDERS.
NOT RESPONSIBLE FOR DEVELOPMENT.
FORMS &
GUIDES
FORMS
POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
PROCLAMATION RESOLUTION
GUIDES
LEGAL AUTHORITIES
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Advise the Multi-Agency Coordination/Policy Group and/or EOC Director, and the Management and General Staff, as needed, on the legality and/or legal implications of contemplated emergency actions and policies (reference the California Emergency Services Act, Stafford Act, etc., as necessary).
Establish areas of legal responsibility and/or potential liabilities.
As needed, prepare documents relative to evacuations, curfews, and demolition of hazardous structures or conditions.
CEMP Part II
Management Section December 2025
Part II - 12
Develop emergency rules, regulations and laws required for acquisition and/or control of critical resources.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available/appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Obtain assistance for position through the Personnel Unit in Logistics, as required.
Assist as necessary with Emergency Proclamation Resolution Process and Forms. (FORM | PROCLAMATION RESOLUTION)
Provide technical knowledge of jurisdictional authorities. (GUIDE | LEGAL AUTHORITIES)
Develop emergency rules, regulations and laws required for acquisition and/or control of critical resources.
Prepare documents relative to evacuations, curfews, and demolition of hazardous structures or conditions.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
CEMP Part II
Management Section December 2025
Part II - 13
Release agency representatives that are no longer required in the EOC when authorized by the EOC Director.
Ensure that you collect any documentation from them that would be relevant for after-action report.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Management Section December 2025
Part II - 14
LIAISON OFFICER
POSITION
OVERVIEW
Responsible for serving as the point of contact to all internal and external individuals, organizations, agencies, and customers
Oversee all special events, dignitary visits and field liaison positions
REPORT TO
EOC DIRECTOR
PLANS
& REPORTS
SHARES WITH RELEVANT STAKEHOLDERS. NOT RESPONSIBLE
FOR DEVELOPMENT.
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 209 INCIDENT STATUS SUMMARY
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Oversee all liaison activities, including coordinating outside agency representatives assigned to the EOC.
Handle requests from other EOCs for EOC agency representatives.
Establish and maintain a central location for incoming agency representatives, providing workspace and support as needed.
Ensure that position specific guidelines, policy directives, situation reports, and a copy of the EOC Action Plan is provided to Agency Representatives upon check-in.
In conjunction with the EOC Coordinator, provide orientations for VIPs and other visitors to the EOC.
Ensure that demobilization is accomplished when directed by the EOC Director.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
CEMP Part II
Management Section December 2025
Part II - 15
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available/appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Obtain assistance for position through the Personnel Unit in Logistics, as required.
Contact Agency Representatives already on-site, ensuring that they:
Have signed into the EOC
Understand their role in the EOC
Know their work locations
Understand the EOC organization and floor plan
Determine if additional representation is required from:
Community based organizations
Private organizations
Utilities not already represented
Other agencies
Alongside EOC Director and EOC Coordinator, establish and maintain Interagency Coordination Group made up of outside agency representatives and executives not assigned to specific sections within the EOC.
Assist the EOC Director and EOC Coordinator in conducting regular briefings for the Inter- Agency Coordination Group.
Assist with distribution of the current EOC Action Plan and Situation Report. (PLAN | EOC ACTION PLAN)
(FORM | ICS 209) or (REPORT | SITUATION STATUS)
Request that Agency Representatives maintain communications with their agencies and obtain situation status reports regularly.
With the approval of the EOC Director, provide agency representatives from the EOC to other EOCs as required and requested.
Maintain active roster of agency representatives located at the EOC.
Roster should be distributed internally on a regular basis. (FORM | ICS 211 JUST FOR AGENCY REPRESENTATIVES)
(FORM | ICS 205A JUST FOR AGENCY REPRESENTATIVES)
Provide turnover briefing to position replacement.
CEMP Part II
Management Section December 2025
Part II - 16
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Release agency representatives that are no longer required in the EOC when authorized by the EOC Director.
Ensure that you collect any documentation from them that would be relevant for after-action report.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
Provide Public Information officer with agency roster for final termination notification. (FORM | ICS 211 JUST FOR AGENCY REPRESENTATIVES)
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Management Section December 2025
Part II - 17
PUBLIC INFORMATION OFFICER
POSITION
OVERVIEW
Responsible for providing news and information on the emergency/disaster to the media, the public, all departments and required agencies.
REPORT TO EOC DIRECTOR
PLANS
& REPORTS PRESS RELEASES
FORMS
& GUIDES
FORMS
POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
MEDIA CALL
PUBLIC CALL
DISASTER ASSISTANCE DIRECTORY
PRESS RELEASE
MEDIA BRIEFING SCHEDULE
ICS 225 FOR PD CREDENTIALING
GUIDES
MEDIA CENTER/JOINT INFORMATION CENTER EMERGECY ALERT
SYSTEM NOTIFICATION
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Serve as the central coordination point for the agency or jurisdiction for all media releases.
Ensure that the public within the affected area receives complete, accurate, and consistent information about life safety procedures, public health advisories, relief and assistance programs and other vital information.
Coordinate media releases with Public Information Officers at incidents or representing other affected emergency response agencies as required.
CEMP Part II
Management Section December 2025
Part II - 18
Develop the format for press conferences, in conjunction with the EOC Director.
Maintain a positive relationship with the media representatives.
Supervise the Public Information Branch.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over jobaid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Determine staffing requirements and make required personnel assignments for the Public Information function to the Personnel Unit in Logistics, as required.
Obtain policy guidance from the EOC Director regarding press releases.
Keep the EOC Director advised of all unusual requests for information and of all major critical or unfavorable media comments.
Recommend procedures or measures to improve media relations.
Coordinate with the Situation Analysis Unit and identify the method for obtaining and verifying significant information as it is developed.
Develop and publish a media-briefing schedule, to include location, format, and preparation and distribution of handout materials.
(FORM | MEDIA BRIEFING SCHEDULE)
Implement and maintain an overall information release program.
Establish a Media or Joint Information Center, as required, providing necessary space, materials, telephones, and electrical power.
(GUIDE | MEDIA CENTER/JOINT INFORMATION CENTER)
Maintain up-to-date status boards and other references at the Media or Joint Information Center.
Provide adequate staff to answer questions from members of the media.
Interact with other EOC PIOs and obtain information relative to public information operations.
CEMP Part II
Management Section December 2025
Part II - 19
Develop content for state Emergency Alert System (EAS) releases if available. Monitor EAS releases as necessary.
(GUIDE | EMERGENCY ALERT SYSTEM NOTIFICATIONS)
In coordination with other EOC sections and as approved by the EOC Director, issue timely and consistent advisories and instructions for life safety, health, and assistance for the public.
At the request of the EOC Director, prepare media briefings and press releases for members of the agencies or jurisdiction policy groups.
Provide other assistance as necessary to facilitate their participation in media briefings and press conferences.
(FORM | PRESS RELEASE)
Ensure that a rumor control function is established to correct false or erroneous information.
Ensure that adequate staff is available at incident sites to coordinate and conduct tours of the affected areas.
Provide appropriate staffing and telephones to efficiently handle incoming media and public calls.
(FORM | MEDIA CALL)
(FORM | PUBLIC CALL)
Prepare, update, and distribute to the public a Disaster Assistance Information Directory, which contains locations to obtain food, shelter, supplies, health services, etc. (FORM | DISASTER ASSISTANCE DIRECTORY)
Ensure that announcements, emergency information and materials are translated and prepared for special populations (non-English speaking, hearing impaired etc.).
Monitor broadcast media, using information to develop follow-up press releases and rumor control.
(FORM | PRESS RELEASE)
Ensure that file copies are maintained of all information released.
Provide copies of all press releases to the EOC Director for approval. (FORM | USE CURRENT PRESS RELEASES)
Prepare final press releases and advise media representatives of points-of-contact for follow- up stories.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
CEMP Part II
Management Section December 2025
Part II - 20
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
Alongside EOC Director and Liaison Officer, make emergency termination notifications to City Council, Response Partners, Community and Operational Area.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Management Section December 2025
Part II - 21
SOCIAL MEDIA SPECIALIST
POSITION
OVERVIEW
Support position to Public Information Officer. Can be assigned to various work location and conduct a diverse group of tasks, including gathering photos/videos, monitoring social media, conducting rumor control etc.
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Social media monitoring.
Rumor identification and management.
Intelligence gathering.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Monitor social media.
CEMP Part II
Management Section December 2025
Part II - 22
Identify and manage rumors.
Gather and share intelligence from media platforms.
Take picture and video.
If approved by Section Coordinator, assist PIO with information dissemination.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Management Section December 2025
Part II - 23
SAFETY OFFICER
POSITION
OVERVIEW
Responsible for identifying and mitigating safety hazards and situations of potential City/Agency liability during EOC operations Ensuring that all facilities used in support of EOC operations have safe operating conditions (building, parking lots, etc.)
REPORT TO EOC DIRECTOR
PLANS
& REPORTS
EOC ACTION PLAN
ADVANCE PLANS + REPORTS (DEMO, RECOVERY ETC.)
FORMS
POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 208 SAFETY MESSAGE
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 215A SAFETY ANALYSIS
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Ensure that all buildings and other facilities used in support of the EOC are in a safe operating condition.
Monitor operational procedures and activities in the EOC to ensure they are being conducted in a safe manner, considering the existing situation and conditions.
Stop or modify all unsafe operations outside the scope of the EOC Action Plan, notifying the EOC Director of actions taken.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
CEMP Part II
Management Section December 2025
Part II - 24
Receive situation, section, and position briefing from available/appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Tour the entire EOC facility and evaluate conditions.
Advise the EOC Director of any conditions and actions that might result in liability (unsafe layout or equipment set-up, etc.).
Study the EOC facility and document the locations of all fire extinguishers, emergency pull stations, and evacuation routes and exits.
(FORM | ICS 215a)
Be familiar with particularly hazardous conditions in the facility; act when necessary.
Prepare and present safety briefings for the EOC Director and General Staff at appropriate meetings.
(FORM | ICS 208)
If the event that caused activation was an earthquake, provide guidance regarding actions to be taken in preparation for aftershocks.
Ensure that the EOC facility is free from any environmental threats - e.g., radiation exposure, air purity, water quality, etc.
Keep the EOC Director advised of unsafe conditions; act when necessary.
Coordinate with the Finance/Administration Section in preparing any personnel injury claims or records necessary for proper case evaluation and closure.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure.
CEMP Part II
Management Section December 2025
Part II - 25
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 26
2.0 OPERATIONS SECTION
The Operations Section positions will vary depending on the need. The Operations Section acts as the primary point of contact between the EOC and the DOC, and may be linked directly to field Incident Commands. The Operations Section is supported by branch directors managing the following main disciplines:
Fire: Fire/Rescue, Hazardous Materials, Emergency Medical Services, Environmental Preservation
Law: Coroner, Law Enforcement, Investigations, Security Care & Shelter: Care and Shelter
Public Works: Street, Traffic, Utilities, Solid Waste, Wastewater, Parking, Facility and Vehicle Maintenance
Construction & Engineering: Building Safety, Building Damage, and Safe Access
Additional information regarding the roles and responsibilities of Operations Section positions can be found in the Cal OES, Standardized Emergency Management System, Approved Course of Instruction Emergency Operation Center Course G611, Local Government, Operations Section, Function Specific Handbook (found at: https://www.caloes.ca.gov/wp- content/uploads/Preparedness/Documents/SEMS-EOC-Course-Part-III-Supporting- Documents-Local-Government-–-Operations.pdf). Additional details regarding the Operations Section may be incorporated during subsequent updates of the CEMP.
CEMP Part II
Operations Section December 2025
Part II - 27
OPERATIONS SECTION CHIEF
POSITION
OVERVIEW
Responsible for the management and coordination of all EOC related operational functions. The Operations Section Coordinator will ensure, based on the emergency, that all necessary operational functions have been activated and are appropriately staffed
REPORT TO MANAGEMENT
EOC DIRECTOR
SUPERVISION OF Fire & Rescue Branch
Law Branch
Medical/Health Branch
Care & Shelter Branch
Construction & Engineering
Branch
Debris Management Unit
Public Works Unit
Utilities Unit
PLANS EOC ACTION PLAN - SUPPORTS DEVELOPMENT FORMS &
REPORTS
FORMS
POSITION JOBAID
RESOURCE REQUEST
EOC-205A
COMMUNICATION
LIST
EOC-209 INCIDENT
STATUS SUMMARY
EOC-211 CHECK-IN
LIST
EOC-213 RESOURCE
REQUEST
EOC-214 ACTIVITY
LOG
EOC-215 RESOURCE
PLANNING
WORKSHEET
EOC-225 FOR PD
CREDENTIALING
REPORT
AGRICULTURAL STATUS
ENERGY STATUS
FIREFIGHTING STATUS
HAZMAT STATUS
MASS CARE STATUS
PUBLIC SAFETY STATUS
PUBLIC WORKS STATUS
SEARCH & RESCUE STATUS
TRANSPORTATION STATUS
UTILITY STATUS
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RADIO(S)
RESOURCES WORKSTATION
BINDER
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
CEMP Part II
Operations Section December 2025
Part II - 28
Ensure that the Operations Function is carried out including coordination of activities for all operational functions assigned to the EOC.
Ensure that operational objectives and assignments identified in the EOC Action Plan are carried out effectively.
Establish the appropriate level of branch and unit organizations within the Operations Section, continuously monitoring the effectiveness and modifying accordingly.
Exercise overall responsibility for the coordination of Branch and Unit activities within the Operations Section.
(FORM | EOC-215)
Ensure that the Planning/Intelligence Section is provided with Status Reports and Major Incident Reports.
Conduct periodic Operations briefings for the EOC Director as required or requested.
Supervise the Operations Section.
Check in at the EOC.
(FORM | EOC-211, FORM | EOC-205A)
Assist with EOC Set-up (If not already fully set-up).
Check workstation to ensure readiness.
Wear identification vest and review all job aids.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | EOC-214)
Ensure that the Operations Section is set up properly and that appropriate personnel, equipment, and supplies are in place, including maps and status boards.
Meet with Planning/Intelligence Section Coordinator; obtain a preliminary situation briefing.
Based on the situation, activate positions/branch within the section as needed:
Fire Branch
Law Branch
Medical/Health Branch
Care & Shelter Branch
Construction & Engineering Branch
Damage/Safety Assessment
Debris Management Unit
Public Works Unit
Utilities Unit
Determine if there are mutual aid requests for these functional areas. Initiate coordination with appropriate mutual aid systems as required.
Request additional personnel for the section as necessary for 24-hour operation. Obtain a current communications status briefing from the Communications Branch Coordinator in Logistics.
CEMP Part II
Operations Section December 2025
Part II - 29
Ensure that there is adequate equipment and radio frequencies available as necessary for the section.
Determine estimated times of arrival of section staff from the Personnel Branch in Logistics.
Confer with the EOC Director to ensure that the Planning/Intelligence and Logistics Sections are staffed at levels necessary to provide adequate information and support for operations.
Coordinate with the Liaison Officer regarding the need for Agency Representatives in the Operations Section.
Coordinate with the Planning/Intelligence Section Coordinator to determine the need for any Technical Specialists.
Establish radio or phone communications with Department Operations Centers (DOCs), and/or with Incident Commander(s) as directed and coordinate accordingly.
Determine activation status of other EOCs in the Operational Area or adjacent areas and establish communication links with their Operations Sections if necessary.
Based on the situation known or forecasted, determine likely future needs of the Operations Section.
Identify key issues currently affecting the Operations Section; meet with section personnel and determine appropriate section objectives for the first operational period.
Review responsibilities of branches in section; develop an Operations Plan detailing strategies for carrying out Operational objectives.
Adopt a pro-active attitude. Think ahead and anticipate situations and problems before they occur.
Ensure Operations Section position logs and other necessary files are maintained.
Ensure that situation and resources information is provided to the Planning/Intelligence Section on a regular basis or as the situation requires, including Status Reports and Major Incident Reports. (FORM | EOC-209 OR OPTIONS BELOW)
(REPORT | AGRICULTURAL STATUS)
(REPORT | COMMUNICATION STATUS)
(REPORT | ENERGY STATUS)
(REPORT | FIREFIGHTING STATUS)
(REPORT | HAZMAT STATUS)
(REPORT | MASS CARE STATUS)
(REPORT | PUBLIC SAFETY STATUS)
(REPORT | PUBLIC WORKS STATUS)
(REPORT | SEARCH & RESCUE STATUS)
(REPORT | TRANSPORTATION STATUS)
(REPORT | UTILITY STATUS)
Ensure that all media contacts are referred to the Public Information Officer.
Conduct periodic briefings and work to reach consensus among staff on objectives and work assignments for forthcoming operational periods.
(FORM | EOC-215)
Attend and participate in EOC Director's Action Planning meetings.
CEMP Part II
Operations Section December 2025
Part II - 30
Provide the Planning/Intelligence Section Coordinator with the Operations Section's objectives prior to each Action Planning meeting.
Work closely with each Branch Coordinator to ensure that the Operations Section objectives, as defined in the current Action Plan, are being addressed.
Ensure that the branches coordinate all resource needs through the Logistics Section. (FORM | RESOURCE REQUEST OR EOC-213)
Ensure that intelligence information from Branch Coordinators is made available to the Planning/ Intelligence Section in a timely manner.
Ensure that fiscal and administrative requirements are coordinated through the Finance/Administration Section (notification of emergency expenditures and daily time sheets).
Brief the EOC Director on all major incidents.
Complete a Major Incident Report for all major incidents; forward a copy to the Planning / Intelligence Section.
Brief Branch Coordinators periodically on any updated information you may have received.
Share status information with other sections as appropriate.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
CEMP Part II
Operations Section December 2025
Part II - 31
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 32
FIRE AND RESCUE BRANCH DIRECTOR
POSITION
OVERVIEW
Responsible for coordinating personnel, equipment and resources committed to fire, field medical, search and rescue, and hazardous materials elements of the incident.
REPORT TO OPERATIONS CHIEF/COORDINATOR PLANS EOC ACTION PLAN - SUPPORTS DEVELOPMENT FORMS &
REPORTS
FORMS
POSITION JOBAID
EOC-205A COMMUNICATION LIST
EOC-209 INCIDENT STATUS SUMMARY
EOC-211 CHECK-IN LIST
EOC-214 ACTIVITY LOG
EOC-225 FOR PD CREDENTIALING
FIRE DEPLOYED RESOURCES
REPORTS
FIREFIGHTING STATUS
SEARCH & RESCUE STATUS
HAZMAT STATUS
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Coordinate fire, emergency medical, hazardous materials, and urban search and rescue operations in the jurisdictional area.
Assist Fire & Rescue Mutual Aid System Coordinator in acquiring mutual aid resources, as necessary.
Coordinate the mobilization and transportation of all resources through the Logistics Section.
Complete and maintain status reports for major incidents requiring or potentially requiring operational area, state and federal response, and maintains status of unassigned fire & rescue resources.
Coordinate with the Law Enforcement Branch Coordinator on jurisdiction Search & Rescue activities.
Implement the objectives of the EOC Action Plan assigned to the Fire & Rescue Branch.
Supervise the Fire & Rescue Branch.
Check in at the EOC
(FORM | EOC-211, FORM | EOC-205A)
Assist with EOC Set-up (If not already fully set-up)
CEMP Part II
Operations Section December 2025
Part II - 33
Check work station to ensure readiness
Wear identification vest and read over job aid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities (FORM | EOC-214)
Based on the situation, activate the necessary Units within the Fire & Rescue Branch:
Fire & Rescue Unit
Emergency Medical Unit
HazMat Unit
If the mutual aid system is activated, coordinate use of fire resources with the Operational Area Fire & Rescue Mutual Aid Coordinator.
(FORM | FIRE DEPLOYED RESOURCES)
Prepare and submit a preliminary status report and major incident reports as appropriate to the Operations Section Coordinator.
(REPORT | FIREFIGHTING STATUS)
(REPORT | SEARCH & RESCUE STATUS)
(REPORT | HAZMAT STATUS)
Prepare objectives for the Fire & Rescue Branch; provide them to the Operations Section Coordinator prior to the first Action Planning meeting.
Ensure that Branch and Unit position logs and other necessary files are maintained.
Obtain and maintain current status on Fire & Rescue missions being conducted in the jurisdictional area.
Provide the Operations Section Coordinator and the Planning/Intelligence Section with an overall summary of Fire & Rescue Branch operations periodically or as requested during the operational period.
(FORM | EOC-209) OR
(REPORT | FIREFIGHTING STATUS)
(REPORT | SEARCH & RESCUE STATUS)
(REPORT | HAZMAT STATUS)
On a regular basis, complete and maintain the Fire & Rescue Status Report.
Refer all contacts with the media to the Public Information Branch.
Ensure that all fiscal and administrative requirements are coordinated through the Finance/ Administration Section (notification of any emergency expenditures and daily time sheets).
Prepare objectives for the Fire & Rescue Branch for the subsequent operational period; provide them to the Operations Section Coordinator prior to the end of the shift and the next Action Planning meeting.
Provide your relief with a briefing at shift change; inform him/her of all on going activities, branch objectives for the next operational period, and any other pertinent information.
Provide turnover briefing to position replacement.
CEMP Part II
Operations Section December 2025
Part II - 34
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure. Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 35
EMERGENCY MEDICAL SERVICES COORDINATOR
POSITION
OVERVIEW
Provides oversight and management for Emergency Medical and Public Health services activities. Coordinate operations with Hospitals, Clinics and County Public Health officials.
REPORT TO
OPERATIONS
FIRE & RESCUE BRANCH DIRECTOR
PLANS EOC ACTION PLAN
SUPPORT DEVELOPMENT
COUNTY PUBLIC HEATH
FORMS POSITION JOBAID
EOC-205A COMMUNICATION LIST
EOC-211 CHECK-IN LIST
EOC-214 ACTIVITY LOG
EOC-225 FOR PD CREDENTIALING
PATIENT CARE AND TRACKING DOCUMENTATION
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RADIO(S)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(EOC-225) to CALOES | [email protected]
Medical/Health operations are coordinated by the Medical/Health Branch in the Operations Section.
Check in at the EOC
(FORM | EOC-211, FORM | EOC-205A)
Assist with EOC Set-up (If not already fully set-up)
Check work station to ensure readiness
Wear identification vest and read over job aid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities (FORM | EOC-214)
Manages and supervises the Medical/Health Branch.
Continuously monitors the organizational effectiveness and modifies as necessary.
Ensures coordination of hospitals, health units, continuing care, mental health, and environmental health within the jurisdiction.
Ensures all Medical/Health Branch resources are tracked and accounted for in cooperation with the Planning Section Resource Unit, as well as resources ordered through Mutual Aid.
CEMP Part II
Operations Section December 2025
Part II - 36
Ensures the Medical/Health Branch function is carried out Meets regularly with Medical/Health Branch staff and works to reach consensus on Operations Section objectives for forthcoming operational periods and ensures they are carried out effectively as per the EOC Action Plan.
Based on the situation, activates and directs appropriate Groups or Units within the Branch. Designates Group Supervisors or Unit Leaders as necessary.
Examples:
o Environmental Management Group Supervisor/Unit Leader o Emergency Medical Services Group Supervisor/Unit Leader o Healthcare Facilities Group Supervisor/Unit Leader
o Public Health Group Supervisor/Unit Leader
o Mental Health Group Supervisor/Unit Leader
o Medical/Health DOC Director (if DOC activated)
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure. Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 37
LAW ENFORCEMENT BRANCH DIRECTOR
POSITION
OVERVIEW
Responsible for coordinating personnel, equipment and resources committed to fire, field medical, search and rescue, and hazardous materials elements of the incident
REPORT TO
OPERATIONS
CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
SUPPORTS DEVELOPMENT
FORMS &
REPORT
FORMS
POSITION JOBAID
EOC-205A COMMUNICATION LIST
EOC-211 CHECK-IN LIST
EOC-214 ACTIVITY LOG
EOC-225 FOR PD CREDENTIALING
REPORT
PUBLIS SAFETY STATUS
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Coordinate movement and evacuation operations during an emergency.
Alert and notify the public of the impending or existing emergency.
Coordinate law enforcement, search and rescue, and traffic control operations during the emergency.
Coordinate site security at incidents.
Coordinate with the Law Enforcement Branch Coordinator on jurisdiction Search & Rescue activities.
Coordinate Law Enforcement Mutual Aid requests from emergency response agencies through the Law Enforcement Mutual Aid Coordinator at the Operational Area EOC.
Supervise the Law Enforcement Branch.
Check in at the EOC
(FORM | EOC-211, FORM | EOC-205A)
Assist with EOC Set-up (If not already fully set-up)
Check work station to ensure readiness
Wear identification vest and read over jobaid.
CEMP Part II
Operations Section December 2025
Part II - 38
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities (FORM | EOC-214)
Based on the situation, activate the necessary Units within the Law Enforcement Branch:
Law Enforcement Operations Unit
Coroner/Fatalities Management Unit
Search and Rescue Unit
Contact and assist the Operational Area EOC Law Enforcement and Coroner's Mutual Aid Coordinators as required or requested.
Based on the initial EOC strategic objectives, prepare objectives for the Law Enforcement Branch and provide them to the Operations Section Coordinator prior to the first Action Planning meeting.
Ensure that Branch and Unit position logs and other necessary files are maintained.
Maintain status on Law Enforcement missions being conducted.
Provide the Operations Section Coordinator and the Planning/Intelligence Section with an overall summary of Law Enforcement Branch operations periodically or as requested during the operational period.
(REPORT | PUBLIC SAFETY STATUS)
On a regular basis, complete and maintain the Law Enforcement Status Report.
Refer all contacts with the media to the Public Information Branch.
Ensure that all fiscal and administrative requirements are coordinated through the Finance/ Administration Section (notification of any emergency expenditures and daily time sheets).
Prepare objectives for the Law Enforcement Branch for the subsequent Operational period; provide them to the Operations Section Coordinator prior to the end of the shift and the next Action Planning Meeting.
Provide your relief with a briefing at shift change, informing him/her of all ongoing activities, branch objectives for the next operational period, and any other pertinent information.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure.
CEMP Part II
Operations Section December 2025
Part II - 39
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 40
ANIMAL SERVICE COORDINATOR
POSITION
OVERVIEW
Responsible for all coordination of mass care services to provide for the safety, feeding, veterinary services, tracking and well-being of any household pets and service animals during evacuations and sheltering operations. Also responsible for coordination of livestock or large animal wrangling, transportation, care, and feeding.
REPORT TO
OPERATIONS
LAW ENFORCEMENT BRANCH DIRECTOR
PLANS EOC ACTION PLAN - SUPPORTS DEVELOPMENT
ANIMAL SHELTERING OPERATIONS PLAN - SUPPORTS
DEVELOPMENT
FORMS &
REPORT
FORMS
POSITION JOBAID
EOC-205A COMMUNICATION LIST
EOC-211 CHECK-IN LIST
EOC-214 ACTIVITY LOG
EOC-225 FOR PD CREDENTIALING
ANIMAL TRACKING FORMS
REPORT
PUBLIC & ANIMAL SAFETY STATUS
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RADIOS
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Ensure your EOC contact information (e-mail, desk line, etc.) is provided to partners such as:
o Volunteer Agencies with Mass Care Support (SPCA, Animal rescuers, etc.) o City Mass Care Coordinators
o Shelter Contacts (if in use)
o County Animal Services
Ensure that the resource requesting procedure and tracking processes are understood by the unit.
Determine if there are any new resource requests from the Field ICP’s or DOC Ensure that resource statuses and requests are forwarded to the logistics section on a regular basis.
Ensure that situation and resource information is provided to the Planning and Intelligence Section on a regular basis.
Share information with other sections as appropriate
CEMP Part II
Operations Section December 2025
Part II - 41
Maintain unit/activity log
Develop and manage an animal tracking and reunification system Check in at the EOC
(FORM | EOC-211, FORM | EOC-205A)
Assist with EOC Set-up (If not already fully set-up)
Check work station to ensure readiness
Wear identification vest and read over jobaid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities (FORM | EOC-214)
Provide EOC contact information (i.e. e-mail, desk line, etc.) to all partners, agencies such as volunteer agencies with mass care support (Red Cross, United Way, etc.), city mass care coordinators, shelter contacts (if in use), and county animal services.
Make sure the unit understands the proper resource requesting procedure and tracking process.
Determine if there are any new resource requests from the Field ICP’s or DOC Forward all resource statuses and requests to the Logistics Section on a regular basis.
Provide all situation and resource information to the Planning and Intelligence Section on a regular basis.
Share information with other sections as appropriate
Maintain unit/activity log
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure. Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
CEMP Part II
Operations Section December 2025
Part II - 42
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 43
INFRASTRUCTURE BRANCH DIRECTOR
POSITION
OVERVIEW
Supports emergency response operations under the Operations Section and provides guidance for initial size-up, rapid needs, and preliminary disaster safety reports on the areas affected, damaged, and destroyed during an emergency event
REPORT TO
OPERATIONS SECTION CHIEF
SUPERVISON OF Damage/Safety Assessment Unit
Debris Management Unit
Public Works Unit
Utilities Unit
PLANS EOC ACTION PLAN - SUPPORTS DEVELOPMENT
DEBRIS MANAGEMENT PLAN
FORMS &
REPORTS
FORMS
POSITION JOBAID
EOC-205A
COMMUNICATION LIST
EOC-211 CHECK-IN
LIST
EOC-214 ACTIVITY LOG
EOC-225 FOR PD
CREDENTIALING
WINDSHIELD SURVEY
INITIAL DAMAGE
ESTIMATE
REPORTS
PUBLIC WORKS &
ENGINEERING STATUS
ENERGY STATUS
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RADIO
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Survey all utility systems, and restore systems that have been disrupted, including coordinating with utility service providers in the restoration of disrupted services.
Survey all public and private facilities, assessing the damage to such facilities, and coordinating the repair of damage to public facilities.
Survey all other infrastructure systems, such as streets and roads within the jurisdictional area.
Assist other sections, branches, and units as needed.
Supervise the Construction/Engineering Branch.
CEMP Part II
Operations Section December 2025
Part II - 44
Check in at the EOC.
(FORM | EOC-211, FORM | EOC-205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over jobaid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | EOC-214)
Based on the situation, activate the necessary Units within the Construction & Engineering Branch:
Utilities Unit
Public Works Unit
Damage/Safety Assessment Unit
Contact and assist the Operational Area Public Works Mutual Aid Coordinator with the coordination of mutual aid resources as necessary.
Provide an initial situation report to the Operations Section Coordinator. (REPORT | PUBLIC WORKS & ENGINEERING STATUS)
Based on the initial EOC strategic objectives, prepare objectives for the Construction/ Engineering Branch.
Provide them to the Operations Section Coordinator prior to the first Action Planning meeting.
Ensure that Branch and Unit position logs and other necessary files are maintained.
Maintain current status on all construction/engineering activities being conducted.
Ensure that damage and safety assessments are being carried out for both public and private facilities.
(FORM | WINDSHIELD SURVEY)
Request mutual aid as required through the Operational Area Public Works Mutual Aid Coordinator.
Determine and document the status of transportation routes into and within affected areas.
Coordinate debris removal services as required.
Provide the Operations Section Coordinator and the Planning/Intelligence Section with an overall summary of Construction/Engineering Branch activities periodically during the operational period or as requested.
(REPORT | PUBLIC WORKS & ENGINEERING STATUS)
Ensure that all Utilities and Construction/Engineering Status Reports, as well as the Initial Damage Estimation are completed and maintained.
(REPORT | PUBLIC WORKS & ENGINEERING STATUS)
(REPORT | ENERGY STATUS)
(FORM | INITIAL DAMAGE ESTIMATE)
CEMP Part II
Operations Section December 2025
Part II - 45
Refer all contacts with the media to the Public Information Branch.
Ensure that all fiscal and administrative requirements are coordinated through the Finance/ Administration Section (notification of any emergency expenditures and daily time sheets). Prepare objectives for the Construction/Engineering Branch for the subsequent operations period.
Provide them to the Operations Section Coordinator prior to the end of the shift and the next Action Planning meeting.
Provide your relief with a briefing at shift change, informing him/her of all ongoing activities, branch objectives for the next operational period, and any other pertinent information.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure. Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 46
PUBLIC WORKS GROUP SUPERVISOR
POSITION
OVERVIEW
Evaluates and assesses the safety and condition of roadways, bridges, and other public works infrastructure. Coordinate operations with Streets, Traffic CalTrans, CHP & Damage Assessment Units. Keep other Branches of the EOC apprised of road closures.
REPORT TO
OPERATIONS
INFRASTRUCTURE BRANCH DIRECTOR
PLANS EOC ACTION PLAN | SUPPORT DEVELOPMENT
FORMS &
REPORTS
FORMS
POSITION JOBAID
EOC-205A COMMUNICATION LIST
EOC-211 CHECK-IN LIST
EOC-214 ACTIVITY LOG
EOC-225 FOR PD CREDENTIALING
REPORT
PUBLIC WORKS STATUS
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RADIO
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Assist other Operation Section Branches by providing construction equipment and operators as necessary.
Provide heavy equipment assistance to the Damage/Safety Assessment Unit as required.
Provide emergency construction and repair to damaged roadways. Assist with the repair of utility systems as required.
Providing flood-fighting assistance, such as sandbagging, rerouting waterways away from populated areas, and river, creek, or streambed debris clearance.
Supervise the Public Works Unit.
Check in at the EOC
(FORM | EOC-211, FORM | EOC-205A)
Assist with EOC Set-up (If not already fully set-up)
Check work station to ensure readiness
Wear identification vest and read over job aid.
Receive situation, section and position briefing from available and appropriate personnel.
CEMP Part II
Operations Section December 2025
Part II - 47
Ensure readiness to maintain concise records of position activities (FORM | EOC-214)
Establish and maintain a position log and other necessary files.
Ensure that appropriate staff are available to assist other emergency responders with the operation of heavy equipment, in coordination with the Logistics Section.
Ensure that engineering staff are available to assist the Damage/Safety Assessment Unit in inspecting damaged structures and facilities.
As requested, direct staff to provide flood fighting assistance, clear debris from roadways and water ways, assist with utility restoration, and build temporary emergency structures as required.
Work closely with the Logistics Section to provide support and material as required.
Keep the Construction/Engineering Branch Coordinator informed of unit status. (REPORT | PUBLIC WORKS STATUS)
Refer all contacts with the media to the Public Information Officer.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure. Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 48
SAFETY ASSESSMENT COORDINATOR
POSITION
OVERVIEW
Provides communication with the field level and/or coordinates the Initial Damage Estimate (IDEs); coordinates with public and private sector representatives to identify damages
REPORT TO
INFRASTRUCTURE BRANCH DIRECTOR
PLANS EOC ACTION PLAN - SUPPORT DEVELOPMENT
FORMS POSITION JOBAID
EOC-205A COMMUNICATION LIST
EOC-211 CHECK-IN LIST
EOC-214 ACTIVITY LOG
EOC-225 FOR PD CREDENTIALING
INITIAL DAMAGE ESTIMATE
WINDSHIELD SURVEY
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RADIO
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Collect initial damage/safety assessment information from other branches/units within the Operations Section.
If the emergency is storm, flood, or earthquake related, ensure that inspection teams have been dispatched to assess the condition of the dam.
Provide detailed damage/safety assessment information to the Planning/Intelligence Section, with associated loss damage estimates.
Maintain detailed records on damaged areas and structures.
Initiate requests for Engineers, to inspect structures and/or facilities.
Supervise the Damage/Safety Assessment Unit.
Check in at the EOC.
(FORM | EOC-211, FORM | EOC-205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities.
CEMP Part II
Operations Section December 2025
Part II - 49
(FORM | EOC-214)
Establish and maintain a position log and other necessary files.
Obtain initial damage/safety assessment information from Fire & Rescue Branch, Law Enforcement Branch, Utilities Unit and other branches/units as necessary.
Coordinate with the American Red Cross, utility service providers, and other sources for additional damage/safety assessment information.
Prepare detailed damage/safety assessment information, including estimate of value of the losses, and provide to the Planning/Intelligence Section. (FORM | INITIAL DAMAGE ESTIMATE)
(FORM | WIND SHIELD SURVEY)
Clearly label each structure and/or facility inspected in accordance with ATC-20 standards and guidelines.
Maintain a list of structures and facilities requiring immediate inspection or engineering assessment.
Initiate all requests for engineers and building inspectors through the Operational Area EOC.
Keep the Construction/Engineering Branch Coordinator informed of the inspection and engineering assessment status.
Refer all contacts with the media to the Public Information Officer.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure. Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
CEMP Part II
Operations Section December 2025
Part II - 50
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 51
DEBRIS MANAGEMENT COORDINATOR
POSITION
OVERVIEW
Responsible for debris management and removal.
REPORT TO
SUPERVISION OF
OPERATIONS SECTION CHIEF
DEBRIS OPERATIONS OFFICER
DEBRIS PLANNING OFFICERS
DEBRIS SUPERVISOR
DEBRIS TECHNICAL SPECIALIST PLANS EOC ACTION PLAN - SUPPORTS DEVELOPMENT DEBRIS MANAGEMENT PLAN
FORMS POSITION JOBAID
EOC-205A COMMUNICATION LIST
EOC-211 CHECK-IN LIST
EOC-214 ACTIVITY LOG
EOC-225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RADIO
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Develops and coordinates a response plan for debris management and removal.
Identifies and coordinates debris management and removal criteria to facilitate the FEMA eligibility.
Coordinates procurement and contracts with Logistics and Finance and Administration.
Check in at the EOC.
(FORM | EOC-211, FORM | EOC-205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | EOC-214)
Establish and maintain a position log and other necessary files.
Implementing jurisdiction-specific Debris Management Plan.
CEMP Part II
Operations Section December 2025
Part II - 52
Keep the section informed on the status of debris management.
Refer all contacts with the media to the Public Information Officer.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 53
UTILITIES COORDINATOR
POSITION
OVERVIEW
Coordinates with public and private utilities, including electric, gas, water, waste, and telephone to receive an assessment of the systems, and coordinates with utility companies to develop a restoration plan. Keep other Branches of the EOC apprised of areas experiencing power outages or possible drinking water contamination issues.
REPORT TO OPERATIONS CHIEF/COORDINATOR PLANS EOC ACTION PLAN - SUPPORTS DEVELOPMENT
FORMS &
REPORT
FORMS
POSITION JOBAID
EOC-205A COMMUNICATION LIST
EOC-211 CHECK-IN LIST
EOC-214 ACTIVITY LOG
EOC-225 FOR PD CREDENTIALING
REPORT
UTILITY STATUS
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RADIO
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Assess the status of utilities, provide Utility Status Reports as required.
Coordinate restoration of damaged utilities with utility representatives in the EOC if present, or directly with Utility companies.
Supervise the Utilities Unit.
Check in at the EOC.
(FORM | EOC-211, FORM | EOC-205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over jobaid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | EOC-214)
Establish and maintain a position log and other necessary files.
Establish and maintain communications with the utility providers.
CEMP Part II
Operations Section December 2025
Part II - 54
Determine the extent of damage to utility systems.
Coordinate with the Liaison Officer to ensure that agency representatives from affected utilities are available to respond to the EOC.
Ensure that all information on system outages is consolidated and provided to the Situation Analysis Unit in the Planning/Intelligence Section.
Ensure that support to utility providers is available as necessary to facilitate restoration of damaged systems.
Keep the Infrastructure Branch Coordinator and the Safety Assessment Coordinator informed of any damage to sewer and sanitation systems, as well as possible water contamination problems.
Keep the Construction/Engineering Branch Coordinator informed of the restoration status.
Complete and maintain the Utilities Status Report.
(REPORT | UTILITY STATUS)
Refer all contacts with the media to the Public Information Officer.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
CEMP Part II
Operations Section December 2025
Part II - 55
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Operations Section December 2025
Part II - 56
CARE AND SHELTER BRANCH DIRECTOR
POSITION
OVERVIEW
Responsible for managing the opening and operating evacuation centers, Shelters and mass care facilities in the City until, and if, the American Red Cross assumes responsibility; coordinating mass feeding of the public, coordinating efforts with the Animal Services Group, the American Red Cross, food/water vendors and other volunteer agencies. Also responsible for supporting the Personnel Unit in the care and sheltering of employees and their families
REPORT TO
SUPERVISION OF
OPERATIONS SECTION CHIEF
SHELTERING COORDINATOR
MASS FEEDING COORDINATOR
PLANS EOC ACTION PLAN - SUPPORTS DEVELOPMENT
CARE & SHELTER PLAN
FORMS &
REPORT
FORMS
POSITION JOBAID
EOC-205A COMMUNICATION LIST
EOC-211 CHECK-IN LIST
EOC-214 ACTIVITY LOG
EOC-225 FOR PD CREDENTIALING
VARIOUS SHELTER MANAGEMENT FORMS
REPORT
MASS CARE STATUS
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RADIO
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Coordinate directly with the American Red Cross and other volunteer agencies to provide food, potable water, clothing, shelter and other basic needs as required to disaster victims.
Assist the American Red Cross with inquiries and registration services to reunite families or respond to inquiries from relatives or friends.
Assist the American Red Cross with the transition from mass care to separate family/individual housing.
Supervise the Care & Shelter Unit including Mass Feeding & Sheltering Check in at the EOC.
(FORM | EOC-211, FORM | EOC-205A)
CEMP Part II
Operations Section December 2025
Part II - 57
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | EOC-214)
Establish and maintain a position log and other necessary files. Coordinate with the Liaison Officer to request an Agency Representative from the American Red Cross.
Work with the Agency Representative to coordinate all shelter and congregate care activity.
Establish communications with other volunteer agencies to provide clothing and other basic life sustaining needs.
Ensure that each activated shelter meets the requirements as described under the Americans With Disabilities Act.
Assist the American Red Cross in staffing and managing the shelters to the extent possible.
In coordination with the American Red Cross, activate an inquiry registry service to reunite families and respond to inquiries from relatives or friends.
Assist the American Red Cross with the transition from operating shelters for displaced persons to separate family/individual housing.
Complete and maintain the Care and Shelter Status Report Form. (REPORT | MASS CARE STATUS)
Refer all contacts with the media to the Public Information Officer.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT EOC-214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | EOC-211, FORM | EOC-205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
CEMP Part II
Operations Section December 2025
Part II - 58
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Planning Section December 2025
Part II - 59
3.0 PLANNING SECTION
The Planning Section is responsible for compiling, assembling, and reporting all safety/damage assessment information, including the following:
• Collect, evaluate, analyze, display, and disseminate incident information and status of all assigned and available resources;
• Function as the primary support for decision-making to the overall emergency organization; and,
• Provide anticipatory appraisals and develop plans necessary to cope with changing events.
CEMP Part II
Planning Section December 2025
Part II - 60
PLANNING SECTION CHIEF
POSITION
OVERVIEW
Responsible for managing the collection, documentation evaluation, forecasting, dissemination, and use of information about the development of the incident and status of resources
REPORT TO
MANAGEMENT
EOC DIRECTOR
DIRECT REPORT STAFF
Situation Analysis Unit
Documentation Unit
Advanced Planning Unit
Resource Status/Tracking
Unit
Demobilization Unit
Technical Specialist
AFN Specialist
GIS Specialist
Social Media Specialist
PLANS &
REPORTS
PLANS
EOC ACTION PLAN
ADVANCE PLANS
REPORTS
OPERATION SECTION REPORTS
LOCAL GOVERNMENT AFTER ACTION REPORT
FORMS POSITION JOBAID
ICS 201 INCIDENT
BRIEFING
ICS 202 INCIDENT
OBJECTIVES
ICS 205A
COMMUNICATION LIST
ICS 207 ORGANIZATION
CHART
ICS 209 INCIDENT
STATUS SUMMARY
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 215 RESOURCE PLANNING
WORKSHEET
ICS 215A SAFETY ANALYSIS
ICS 225 FOR PD CREDENTIALING
ICS 230 DAILY MEETING
SCHEDULE
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
CEMP Part II
Planning Section December 2025
Part II - 61
Establish the appropriate level of staffing and organization for the Section.
Exercise overall responsibility for the coordination of unit activities within the section.
Supervise the Planning/Intelligence Section.
Ensure that the following responsibilities of the Section are addressed as required:
Collect, analyze, and display situation information.
Prepare periodic Situation Report.
Prepare and distribute the EOC Action Plan and facilitating the Action Planning meeting.
Conduct advance Planning activities and report.
Provide technical support services to the various EOC sections and branches, and document and maintain files on all EOC activities.
In coordination with the other Section Coordinators, ensure that Status Reports are completed and utilized as a basis for Situation Analysis Reports, and the EOC Action Plan.
Keep the EOC Director informed of significant issues affecting the P&I Section.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Ensure that the Planning/Intelligence Section is set up properly and that appropriate personnel, equipment, and supplies are in place, including maps and status boards.
Based on the situation, activate positions/unit within the section as needed:
Situation Analysis Unit
Documentation Unit
Advanced Planning Unit
Action Planning Unit
Resource Status/Tracking Unit
Demobilization Unit
Technical Specialists
AFN Specialist
GIS Specialist
Social Media Specialist
CEMP Part II
Planning Section December 2025
Part II - 62
Request additional personnel for the section as necessary to maintain a 24-hour operation.
Establish contact with the Operational Area EOC when activated.
Coordinate Situation Analysis Reports with their Planning/Intelligence Section. (FORM | ICS 209 OR REPORT | SITUATION STATUS)
Meet with Operations Section Coordinator; obtain and review any major incident reports. (REPORT |OPS ________ STATUS REPORT)
Review responsibilities of units in the section; develop plans for carrying out all responsibilities.
Make a list of key issues to be addressed by Planning/Intelligence, in consultation with section staff.
Identify objectives to be accomplished during the initial Operational Period. (FORM | ICS 202)
Keep the EOC Director informed of significant events.
Adopt a proactive attitude, thinking ahead and anticipating situations and problems before they occur.
Ensure that Planning/Intelligence Section position logs and other necessary files are maintained.
Ensure that The Situation Analysis Unit is maintaining current information for the situation analysis report.
Ensure that major incidents reports and status reports are completed by the Operations Section and are accessible by Planning/Intelligence.
Ensure that a situation analysis report is produced and distributed to EOC Sections and the Operational Area EOC at least once, prior to the end of the operational period. (FORM | ICS 209 OR REPORT | SITUATION STATUS)
Ensure that all status boards and other displays are kept current, and that posted information is neat and legible.
Ensure that the Public Information Branch has immediate and unlimited access to all status reports and displays.
Conduct periodic briefings with section staff and work to reach consensus among staff on section objectives for forthcoming operational periods. (FORM | ICS 201)
Facilitate the EOC Director's Action Planning meetings approximately two hours before the end of each operational period.
(FORM | ICS 230)
Ensure that objectives for each section are completed, collected, and posted in preparation for the next Action Planning meeting.
CEMP Part II
Planning Section December 2025
Part II - 63
Ensure that the EOC Action Plan is completed and distributed prior to the start of the next operational period.
(FORMS | ICS 201, ICS 202, ICS 205A, ICS 207, ICS 208, ICS 211, ICS 213. ICS 215, ICS 215A, ICS 230 OR PLAN | EOC ACTION PLAN)
Work closely with each unit within the Planning/Intelligence Section to ensure the section objectives, as defined in the current EOC Action Plan, are being addressed.
Ensure that the Advance Planning Unit develops and distributes a report which highlights forecasted events or conditions likely to occur beyond the forthcoming operational period; particularly those situations which may influence the overall strategic objectives of the EOC. (PLAN | ADVANCE PLAN)
Ensure that the Documentation Unit maintains files on all EOC activities and provides reproduction and archiving services for the EOC, as required.
Provide technical specialists to all EOC sections as required.
Ensure that fiscal and administrative requirements are coordinated through the Finance/ Administration Section.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input and/or facilitate the after-action report. (REPORT | LOCAL GOVERNMENT AFTER ACTION REPORT)
CEMP Part II
Planning Section December 2025
Part II - 64
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Planning Section December 2025
Part II - 65
ACTION PLANNING UNIT
POSITION
OVERVIEW
Responsible for driving the EOC Action Planning process and supporting the development of the EOC Action Plan.
REPORT TO PLANNING & INTELLIGNCE | CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
ADVANCE PLANS
FORMS POSITION JOBAID
ICS 202 INCIDENT OBJECTIVES
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
BINDER
VEST
PROFESSIONAL
CREDENTIAL To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Responsible for driving the EOC Action Planning process and supporting the development of the EOC Action Plan.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Establish and maintain a position log and other necessary files.
Establish an EOC Action Planning process & meeting schedule for the operational period with the Planning & Intelligence Section Chief.
CEMP Part II
Planning Section December 2025
Part II - 66
Coordinate the calling of EOC Action Planning meetings and remind Section Chiefs to bring summaries of their issues and needs, along with updates on the existing Action Plan.
Ensure EOC Action Plan is developed for each operational period, based on objectives developed by each section.
(FORM | ICS 202 or PLAN | EOC ACTION PLAN)
Ensure the Planning and Intelligence Section Chief has everything that will be needed to facilitate the Action Planning meetings.
Ensure that each section provides an update on their objectives at least 30 minutes prior to each Action Planning meeting. This includes those completed, and the status of those not completed, as well as new objectives to be added to the Action Plan.
In preparation for the Action Planning meeting, ensure that all EOC objectives are posted on chart paper and the meeting room is set up with appropriate equipment and materials.
Prepare a draft EOC Action Plan and submit to the Planning & Intelligence Section Chief/EOC Director for approval.
Print and distribute the approved EOC Action Plan, coordinate with the Documentation Unit for reproduction and distribution as necessary.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
CEMP Part II
Planning Section December 2025
Part II - 67
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Planning Section December 2025
Part II - 68
GIS SPECIALIST
POSITION
OVERVIEW
Collects, analyses, and displays critical information obtained from various sources such as field reports, other departments, and agencies, and EOC Sections.
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Determine and establish GIS production priorities.
Convert requests into GIS products quickly and effectively.
Anticipate requirements and needs and assemble or prepare supporting referential data.
Locate and secure needed database information to support production goal.
Operate specialized GIS production equipment.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Develop a system to post to the significant events log casualty information, health concerns, property damage, fire status, size of risk area, scope of the hazard to the public, number of evacuees, etc.
CEMP Part II
Planning Section December 2025
Part II - 69
Develop sources of information and assist the Planning/Intelligence Section Coordinator/Chief in collecting, organizing, and analyzing data from the other EOC sections.
Provide for an authentication process in case of conflicting status reports.
Meet with the Planning/Intelligence Section Coordinator/Chief and the EOC Director (Director of Emergency Services) to determine needs for planning meetings and briefings.
Determine if there are any special information needs.
Map specific zones or areas that detail damage surveys in conjunction with state and federal agencies.
Prepare, set up, and maintain EOC displays.
Keep data current concerning: Availability of personnel, equipment, and supplies; Equipment or personnel out of service.
Continually obtain information from Logistics, other Planning/Intel functions, the EOC Manager, Operations, and the Finance/Admin Section.
Submit verbal and written reports to Planning/Intelligence Section Coordinator/Chief as appropriate or as directed.
Participate in Planning/Intelligence Section Meetings and participate in EOC Action Plan development.
Provide information to be included in the Situation Report (i.e.: mapping).
Obtain data on all impacts to include:
Utilities and infrastructure (i.e., roads, bridges, electric lines, pipelines, buildings, etc.). Number of homes destroyed or damaged.
Public facilities destroyed or damaged.
Critical facilities damaged or destroyed and locations (hospital, power stations, industry or manufacturers, water facilities, etc.).
Financial impacts and costs expended by the County & coordinate with Cost Unit Leader in Finance/Admin Section.
Ensure that necessary maps and data pertinent to the operations are obtained. Map areas that may have to be rezoned, destroyed, reconstructed and/or modified because of the disaster. (Consultation with the Planning Section). Work with the Situation Analysis Unit to create maps, displays, and reports.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
CEMP Part II
Planning Section December 2025
Part II - 70
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Planning Section December 2025
Part II - 71
RESOURCE STATUS & TRACKING UNIT
POSITION
OVERVIEW
Responsible for tracking and documenting all resources.
REPORT TO
PLANNING & INTELLIGENCE | CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 207 ORGANIZATION CHART
ICS 211 CHECK-IN LIST
ICS 213 RESOURCE REQUEST
ICS 214 ACTIVITY LOG
ICS 215 RESOURCE PLANNING WORKSHEET
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Responsible for tracking and documenting resources including personnel, critical resources, transportation, and support equipment.
(FORM | RESOURCE TRACKING)
Responsible for coordinating closely with all units in the Logistics Section, particularly Supply/Procurement Unit, Personnel Unit, and Transportation Unit.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
CEMP Part II
Planning Section December 2025
Part II - 72
Attend the Tactics/Strategy meeting (led by the Operations Section Chief) to complete the Operational Planning Worksheet.
(FORM | ICS 215)
Complete resource request forms (ICS 213 form) for personnel, supplies, services, and equipment-as determined from the Operational Planning Worksheet (ICS 215 form/worksheet) developed during the Tactics/Strategy meeting.
(FORM | ICS 213)
(FORM | ICS 215)
Verify proper check-in and check-out of personnel in the EOC using a Recorder. (FORM | ICS 211)
Provide resource information to the Situation Analysis Unit, Demobilization Unit, and Logistics Section.
(FORM | ICS 209)
Assist in preparation of Organization Chart and post in the EOC. (FORM | ICS 207)
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
CEMP Part II
Planning Section December 2025
Part II - 73
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Planning Section December 2025
Part II - 74
ADVANCED PLANNING UNIT
POSITION
OVERVIEW
Responsible for developing reports and recommendations for future time periods and for preparing reports, development of the EOC Action Plan, and briefings for use in strategy and/or planning meetings.
REPORT PLANNING & INTELLIGNCE CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
ADVANCE PLANS
FORMS POSITION JOBAID
ICS 202 INCIDENT OBJECTIVES
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
BINDER
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Develop an Advance Plan consisting of potential response and recovery related issues likely to occur beyond the next operational period, generally within 36 to 72 hours.
Review all available status reports, Action Plans, and other significant documents.
Determine potential future impacts of the emergency; particularly issues which might modify the overall strategic EOC objectives.
Provide periodic briefings for the EOC Director and General Staff addressing Advance Planning issues.
Supervise the Advance Planning Unit.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
CEMP Part II
Planning Section December 2025
Part II - 75
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Establish and maintain a position log and other necessary files.
Monitor the current situation report to include recent updates.
Meet individually with the general staff and determine best estimates of the future direction & outcomes of the emergency.
Develop an Advance Plan identifying future policy related issues, social and economic impacts, significant response or recovery resource needs, and any other key issues likely to affect EOC operations within a 36-to-72-hour time frame.
(PLAN | ADVANCE PLAN)
Submit the Advance Plan to the Planning/Intelligence Coordinator for review and approval prior to conducting briefings for the General Staff and EOC Director.
Review Action Planning objectives submitted by each section for the next operational period.
In conjunction with the general staff, recommend a transition strategy to the EOC Director when EOC activity shifts predominately to recovery operations. (FORM | ICS 202 or PLAN | EOC ACTION PLAN)
(PLAN | ADVANCE PLAN)
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
CEMP Part II
Planning Section December 2025
Part II - 76
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Planning Section December 2025
Part II - 77
TECHNICAL SPECIALIST UNIT
POSITION
OVERVIEW
Technical Specialists are advisors with special skills needed to support a field or function not addressed elsewhere or by any other discipline. Technical Specialists (may or may not be employees of a public or private agency) may report to the Planning/Intelligence Section Coordinator/Chief.
REPORT TO PLANNING & INTELLIGENCE | CHIEF/COORDINATOR
DIRECT REPORT AFN Specialist
GIS Specialist
Social Media Specialist
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Provide technical observations and recommendations to EOC staff in specialized areas as required.
Advise on legal limitations of the use of resources.
Work with inter-agency coordination groups as necessary providing expertise.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over jobaid.
Receive situation, section, and position briefing from available and appropriate personnel.
CEMP Part II
Planning Section December 2025
Part II - 78
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Provide technical services as required to requesting EOC staff.
Contribute to EOC planning meetings and inter-agency coordination groups as requested.
Ensure that all recommendations are appropriately documented.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Advise Planning/Intelligence Section when duties are completed.
Obtain release from Planning/Intelligence Section Coordinator prior to leaving the EOC.
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Planning Section December 2025
Part II - 79
DEMOBILIZATION UNIT
POSITION
OVERVIEW
Responsible for preparing a Demobilization Plan to ensure an orderly, safe, and cost-effective release of personnel and equipment.
REPORT TO PLANNING & INTELLIGENCE | CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
DEMOBILIZATION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Develop a Demobilization Plan for the EOC based on a review of all pertinent planning documents, and status reports.
Supervise the Demobilization Unit.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Establish and maintain a position log and other necessary files.
Review EOC personnel roster to determine size and scope of any demobilization efforts.
Meet individually with the general staff to determine their need for assistance in any Demobilization Planning.
CEMP Part II
Planning Section December 2025
Part II - 80
Advise Planning/Intelligence Section Coordinator on the need for a formal written Demobilization Plan.
If a Demobilization Plan is required, develop the plan using detailed specific responsibilities, release priorities and procedures.
(PLAN | DEMOBILIZATION PLAN)
Establish with each Section Coordinator which units/personnel should be demobilized first.
Determine if any special needs exist for personnel demobilization (e.g., transportation).
Develop a checkout procedure, if necessary, to ensure all deactivated personnel have cleared their operating position.
Submit any formalized Demobilization Plan to the Planning/Intelligence Section Coordinator for approval.
Meet with each assigned Agency Representative and Technical Specialist to determine what assistance may be required for their demobilization from the EOC.
Monitor the implementation of the Demobilization Plan and be prepared to handle any demobilization issues as they occur.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
CEMP Part II
Planning Section December 2025
Part II - 81
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Logistics Section December 2025
Part II - 82
4.0 LOGISTICS SECTION
The Logistics Section is responsible for providing resources to support the City’s disaster response, including, but not limited to, personnel, vehicles, and equipment.
The logistics section is responsible for the following activities:
• Provide operational and logistical support for emergency response personnel and optimize the use of resources.
• Provide support to the other sections of the EOC and support as directed for field emergency response activities.
• Support the restoration of essential services and systems. • Coordinate with finance section.
CEMP Part II
Logistics Section December 2025
Part II - 83
LOGISTICS SECTION CHIEF
POSITION
OVERVIEW
Responsible for managing and coordinating logistical response efforts and the acquisition, transportation, and mobilization of resources.
REPORT TO MANAGEMENT | EOC DIRECTOR
DIRECT REPORT STAFF
Communications/IT Unit
Transportation Unit
Personnel Unit
Supply/Procurement Unit
Facilities Unit
Food Unit
Donations Management Unit
Volunteer Coordination Unit
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 213 RESOURCE REQUEST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
RESOURCE REQUEST
RESOURCE TRACKING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Ensure the Logistics function is carried out in support of the EOC.
This function includes providing communication services, resource tracking, acquiring equipment, supplies, personnel, facilities, and transportation services; as well as arranging for food, lodging, and other support services as required.
Establish the appropriate level of branch and/or unit staffing within the Logistics Section, continuously monitoring the effectiveness of the organization and modifying as required.
CEMP Part II
Logistics Section December 2025
Part II - 84
Ensure section objectives as stated in the EOC Action Plan are accomplished within the operational period or within the estimated time frame.
Coordinate closely with the Operations Section Coordinator to establish priorities for resource allocation to activated Incident Commands within the affected area.
Keep the EOC Director informed of all significant issues relating to the Logistics Section.
Supervise the Logistics Section.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Ensure the Logistics Section is set up properly and that appropriate personnel, equipment, and supplies are in place, including maps, status boards, vendor references, and other resource directories.
Based on the situation, activate branches/units within section as needed and designate Unit Leaders for each element:
Communications Branch
Transportation Unit
Supply/Procurement Unit
Personnel Unit
Facilities Unit
Resource Tracking Unit
Mobilize sufficient section staffing for 24-hour operations.
Establish communications with the Logistics Section at the Operational Area EOC if activated.
Advise Branches and Units within the section to coordinate with appropriate branches in the Operations Section to prioritize and validate resource requests from DOCs or Incident Command Posts in the field. This should be done prior to acting on the request.
Meet with the EOC Director and General Staff and identify immediate resource needs.
Meet with the Finance/Administration Section Coordinator and determine level of purchasing authority for the Logistics Section.
CEMP Part II
Logistics Section December 2025
Part II - 85
Assist branch and Unit Leaders in developing objectives for the section as well as plans to accomplish their objectives within the first operational period, or in accordance with the Action Plan.
Provide periodic Section Status Reports to the EOC Director.
Adopt a proactive attitude, thinking ahead and anticipating situations and problems before they occur.
Ensure that Logistic Section position logs and other necessary files are maintained.
Meet regularly with section staff and work to reach consensus on section objectives for forthcoming operational periods.
Provide the Planning/Intelligence Section Coordinator with the Logistics Section objectives at least 30 minutes prior to each Action Planning meeting.
Attend and participate in EOC Action Planning meetings.
Ensure that the Supply/Procurement Unit coordinates closely with the Purchasing Unit in the Finance/Administration Section, and that all required documents and procedures are completed and followed.
Ensure that transportation requirements, in support of response operations, are met.
Ensure that all requests for facilities and facility support are addressed.
Ensure that all resources are tracked and accounted for, as well as resources ordered through Mutual Aid.
(FORM | ICS 213 OR FORM | RESOURCE REQUEST)
(FORM | RESOURCE TRACKING)
Provide section staff with information updates as required.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
CEMP Part II
Logistics Section December 2025
Part II - 86
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Logistics Section December 2025
Part II - 87
SUPPLY UNIT LEADER
POSITION
OVERVIEW
Responsible for obtaining and delivering all non-fire and non-law- enforcement mutual aid materials, equipment and supplies to support emergency operations.
REPORT TO LOGISTICS | CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Oversee the procurement and allocation of supplies and materiel not normally provided through mutual aid channels.
Coordinate procurement actions with the Finance/Administration Section.
Coordinate delivery of supplies and materiel as required.
Supervise the Supply/Procurement Unit.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Establish and maintain a position log and other necessary files.
Determine if requested types and quantities of supplies and material are available in inventory.
CEMP Part II
Logistics Section December 2025
Part II - 88
Determine procurement spending limits with the Purchasing Unit in Finance/Administration.
Obtain a list of pre-designated emergency purchase orders as required.
Whenever possible, meet personally with the requesting party to clarify types and amount of supplies and materiel, and verify that the request has not been previously filled through another source.
In conjunction with the Resource Tracking Unit, maintain a status board or other reference depicting procurement actions in progress and their status.
Determine if the procurement item can be provided without cost from another jurisdiction or through the Operational Area.
Determine unit costs of supplies and materiel, from suppliers and vendors and if they will accept purchase orders as payment, prior to completing the order.
Orders exceeding the purchase order limit must be approved by the Finance/Administration Section before the order can be completed.
If vendor contracts are required for procurement of specific resources or services, refer the request to the Finance/Administration Section for development of necessary agreements.
Determine if the vendor or provider will deliver the ordered items.
If delivery services are not available, coordinate pickup and delivery through the Transportation Unit.
In coordination with the Personnel Unit, provide food and lodging for EOC staff and volunteers as required.
Assist field level with food services at camp locations as requested.
Coordinate donated goods and services from community groups and private organizations.
Set up procedures for collecting, inventorying, and distributing usable donations.
Keep the Logistics Section Coordinator informed of significant issues affecting the Supply/ Procurement Unit.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
CEMP Part II
Logistics Section December 2025
Part II - 89
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Logistics Section December 2025
Part II - 90
PERSONNEL UNIT LEADER
POSITION
OVERVIEW
Responsible for obtaining, coordinating, and allocating all non-fire and non- law-enforcement mutual aid personnel support requests; registering and coordinating volunteers as Disaster Services Workers (DSWs); feeding and caring for all emergency workers; and the overall coordination and care of all City/Agency staff, both paid and volunteer.
REPORT TO LOGISTICS | CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 207 ORGANIZATION CHART
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
RESOURCE REQUEST
RESOURCE TRACKING
DSWV REGISTRATION
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Provide personnel resources as requested in support of the EOC and Field Operations.
Identify, recruit, and register volunteers as required.
Develop an EOC organization chart.
(FORM | ICS 207)
Supervise the Personnel Unit.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
CEMP Part II
Logistics Section December 2025
Part II - 91
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Establish and maintain a position log and other necessary files.
Manage check-in.
(FORM | ICS 211, FORM | ICS 205A)
In conjunction with the Documentation Unit, develop a large poster size EOC organization chart depicting each activated position.
Upon check in, indicate the name of the person occupying each position on the chart.
The chart should be posted in a conspicuous place, accessible to all EOC personnel. (FORM | ICS 207)
Coordinate with the Liaison Officer and Safety Officer to ensure that all EOC staff, including volunteers, receive a current situation and safety briefing upon check-in. (FORM | ICS 208)
Establish communications with volunteer agencies and other organizations that can provide personnel resources.
Coordinate with the Operational Area EOC to activate the Emergency Management Mutual Aid System (EMMA), if required.
Process all incoming requests for personnel support.
Identify the number of personnel, special qualifications or training, where they are needed and the person or unit they should report to upon arrival.
Determine the estimated time of arrival of responding personnel, and advise the requesting parties accordingly.
(FORM | RESOURCE REQUEST)
(FORM | RESOURCE TRACKING)
Maintain a status board or other reference to keep track of incoming personnel resources.
Update EOC organization chart for each operational period.
Coordinate with the Liaison Officer and Security Officer to ensure access, badging or identification, and proper direction for responding personnel upon arrival at the EOC.
Assist the Fire Rescue Branch and Law Enforcement Branch with ordering of mutual aid resources as required.
To minimize redundancy, coordinate all requests for personnel resources from the field level through the EOC Operations Section prior to acting on the request.
In coordination with the Safety Officer, determine the need for crisis counseling for emergency workers; acquire mental health specialists as needed.
Arrange for childcare services for EOC personnel as required.
CEMP Part II
Logistics Section December 2025
Part II - 92
Establish registration locations with sufficient staff to register volunteers, and issue them disaster service worker identification cards.
(FORM | DSWV REGISTRATION)
Keep the Logistics Section Coordinator informed of significant issues affecting the Personnel Unit.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Logistics Section December 2025
Part II - 93
FACILITIES UNIT LEADER
POSITION
OVERVIEW
Responsible for ensuring adequate essential facilities are provided for the response effort, including securing access to the facilities; and providing staff, furniture, supplies, and materials necessary to configure the facilities in a manner adequate to accomplish the mission.
REPORT TO LOGISTICS | CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Ensure that adequate essential facilities are provided for the response effort, including securing access to the facilities, and providing staff, furniture, supplies, and materials necessary to configure the facilities in a manner adequate to accomplish the mission.
Ensure acquired buildings, building floors, and or workspaces are returned to their original state when no longer needed.
Supervise the Facilities Unit.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Establish and maintain a position log and other necessary files.
CEMP Part II
Logistics Section December 2025
Part II - 94
Work closely with the EOC Coordinator and other sections in determining facilities and furnishings required for effective operation of the EOC.
Coordinate with branches and units in the Operations Section to determine if assistance with facility acquisition and support is needed at the field level.
Arrange for continuous maintenance of acquired facilities, to include ensuring that utilities and restrooms are operating properly.
If facilities are acquired away from the EOC, coordinate with assigned personnel and designate a Facility Manager.
Develop and maintain a status board or other reference which depicts the location of each facility; a general description of furnishings, supplies and equipment at the site; hours of operation, and the name and phone number of the Facility Manager.
Ensure all structures are safe for occupancy and that they comply with ADA requirements.
As facilities are vacated, coordinate with the facility manager to return the location to its original state. This includes removing and returning furnishings and equipment, arranging for janitorial services, and locking or otherwise securing the facility.
Keep the Logistics Section Coordinator informed of significant issues affecting the facilities unit.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
CEMP Part II
Logistics Section December 2025
Part II - 95
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Logistics Section December 2025
Part II - 96
COMMUNICATIONS UNIT LEADER
POSITION
OVERVIEW
Responsible for managing all computing needs including desktop/laptop computers, network and communications (internet/wireless, telephones, radios, etc.), printing, audio/visual, and other technology needs for the EOC.
REPORT TO LOGISTICS | CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
DEMOBILIZATION PLAN
FORMS &
REPORT
FORMS
POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
REPORT
COMMUNICATION STATUS
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Coordinate with all sections and branches/groups/units on operating procedures for computing, network, and communications systems.
Provide support for all EOC Information Systems and ensures automated information links with partner EOCs/DOCs are maintained including, if applicable, audio, visual, and teleconferencing equipment.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
CEMP Part II
Logistics Section December 2025
Part II - 97
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Develop Communication Plan for all communication modes within the EOC and field ICP’s when needed.
(FORM | ICS 205A)
Determine what communications equipment is necessary.
Provide technical information as required.
Manage data and telephone services for the EOC.
Receive any priorities or special requests.
Provide communications briefings and technology status reports as requested at action planning meetings.
(REPORT | COMMUNICATION STATUS)
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Coordinate with Demobilization Unit to develop check out procedure on Demobilization Plan.
(PLAN | DEMOBILIZATION)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
CEMP Part II
Logistics Section December 2025
Part II - 98
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Logistics Section December 2025
Part II - 99
FOOD UNIT LEADER
POSITION
OVERVIEW
Responsible for coordinating all feeding operations for the EOC, support, and field personnel.
REPORT TO LOGISTICS | CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Establish and disseminate a feeding plan that identifies cost limits, authorized vendors, catering companies, types of food, etc. Be aware of special diets.
Set meal schedules.
Set up and manage eating areas for EOC, staff, and field personnel.
Establish a personnel-feeding account for EOC, support, and field personnel at local restaurants.
Brief all EOC personnel on the location, cost limitations, and incident number used for each restaurant or caterer.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
CEMP Part II
Logistics Section December 2025
Part II - 100
Obtain necessary equipment, supplies, and facilities to establish food service (including hot/cold storage and/or handling).
Ensure food service areas meet appropriate health and safety measures, and are maintained in a clean condition.
Order sufficient food and water from or through the Supply Unit.
Maintain an inventory of food, water, condiments, and supplies.
Coordinate with Procurement Unit to ensure all purchases are pre-approved and paid.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Logistics Section December 2025
Part II - 101
VOLUNTEER COORDINATION UNIT LEADER
POSITION
OVERVIEW
Responsible for coordination of donations management. This includes internal organizational elements and resources as well as external partner agencies.
REPORT TO
LOGISTICS | CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
DSWV REGISTRATION
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Work with the Planning Section Staff to identify volunteer needs. Develop a plan to distribute these volunteers to necessary places.
Coordinate with the Resources Unit to track all volunteer resources.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Staff Volunteer Team in the EOC and support the Planning Section Resource Unit and the Logistics Section Supply Unit.
CEMP Part II
Logistics Section December 2025
Part II - 102
Establish one or more assembly and staging sites for volunteers to report for credential screening and potential assignment (Volunteer Reception Centers).
Manage the Volunteer DSWV process including document management. (FORM | DSWV REGISTRATION)
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Logistics Section December 2025
Part II - 103
DONATIONS MANAGEMENT UNIT LEADER
POSITION
OVERVIEW
Responsible for coordination of donations management. This includes internal organizational elements and resources as well as external partner agencies.
REPORT TO LOGISTICS | CHIEF/COORDINATOR
PLANS EOC ACTION PLAN
FORMS POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Work with the Planning Section Staff to identify donation needs of life-safety supplies and services (e.g., heat, food, water, ice) and develop a plan to receive and quickly distribute these resources to affected community members.
Coordinate with the Resources Unit to track all donation resources.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Communicate and coordinate with external partners and NGOs to support effective donations management.
Serve as point of contact with private sector that want to donate goods and services.
CEMP Part II
Logistics Section December 2025
Part II - 104
Coordinate with Public Information function, including the JIC (if activated) to maintain consistent public messaging about donations.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Finance Section December 2025
Part II - 105
5.0 FINANCE AND ADMINISTRATION SECTION
The Finance and Administration Section is responsible for providing financial support, administrative coordination, including the following:
Relieve the EOC Director of many activities that otherwise cause distraction, Provide continuity of financial support to the City and community, and Document and manage City costs and recovery of those costs as allowable.
CEMP Part II
Finance Section December 2025
Part II - 106
FINANCE AND ADMINISTRATION SECTION CHIEF
POSITION
OVERVIEW
Responsible for the financial support, response, and recovery for the incident.
REPORT TO MANAGEMENT | EOC DIRECTOR
PLANS
& REPORTS
ASSESS, TRACK, AND ORGANIZE COST OF IMPLIMENTATION PER
STATE AND FEDERAL COST RECOVERY GUIDELINES
FORMS,
GUIDES
FORMS
POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
GUIDES
PA DAMAGE CATEGORIES
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Ensure that all financial records are maintained throughout the emergency.
Ensure that all on-duty time is recorded for all emergency response personnel.
Ensure that all on-duty time sheets are collected from EOC staff; Departments are collecting these from DOC staff, and Field Supervisors /Incident Commanders are for their staff.
Ensure there is a continuum of the payroll process for all employees responding to the emergency.
Determine/remind individuals of purchase order limits for the procurement function in Logistics.
Ensure that workers’ compensation claims, resulting from the response are processed within a reasonable time.
Ensure that all travel and expense claims are processed within a reasonable time.
Provide administrative support to all EOC Sections as required, in coordination with the Personnel Unit.
CEMP Part II
Finance Section December 2025
Part II - 107
Activate units within the Finance/Administration Section as required.
Monitor section activities continuously and modify the organization as needed.
Ensure that all recovery documentation is accurately maintained and submitted on the appropriate forms to the Federal Emergency Management Agency (FEMA) and/or the Governor’s Office of Emergency Services.
Supervise the Finance/Administration Section.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Ensure that the Finance/Administration Section is set up properly and that appropriate personnel, equipment, and supplies are in place.
Based on the situation, activate units within section as needed and designate Unit Coordinators for each element:
Time Keeping Unit
Cost Accounting Unit
Compensation & Claims Unit
Purchasing Unit
Recovery Unit
Ensure that sufficient staff are available for a 24-hour schedule, or as required.
Meet with the Logistics Section Coordinator and review financial and administrative support requirements and procedures.
Determine the level of purchasing authority to be delegated to Logistics Section.
Meet with all Unit Leaders and ensure that responsibilities are clearly understood.
In conjunction with Unit Leaders, determine the initial Action Planning objectives for the first operational period.
Notify the EOC Director when the Finance/Administration Section is operational.
Adopt a proactive attitude, thinking ahead and anticipating situations and problems before they occur.
Ensure that Finance/Administration Section position logs and other necessary files are maintained.
CEMP Part II
Finance Section December 2025
Part II - 108
Ensure that displays associated with the Finance/Administrative Section are current, and that information is posted in a legible and concise manner.
Participate in all Action Planning meetings.
Brief all Unit Leaders and ensure they are aware of the EOC objectives as defined in the Action Plan.
Keep the EOC Director, General Staff, and elected/other officials aware of the current fiscal situation and other related matters, on an on-going basis.
Ensure that the Recovery Unit maintains all financial records throughout the emergency.
Ensure that the Time Keeping Unit tracks and records all agency staff time.
In coordination with the Logistics Section, ensure that the Purchasing Unit processes purchase orders and develops contracts in a timely manner.
Ensure that the Compensation & Claims Unit processes all workers’ compensation claims resulting from the emergency, in a reasonable time-frame, given the nature of the situation.
Ensure that the Time-Keeping Unit processes all timesheets and travel expense claims promptly.
Ensure that the Finance/Administration Section provides administrative support to other EOC Sections as required.
Ensure that all recovery documentation is accurately maintained by the Recovery Unit during the response, and submitted on the appropriate forms to Federal Emergency Management Agency (FEMA) and/or the Governor’s Office of Emergency Services.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate appropriate Section Positions when authorized by EOC Director and follow Demobilization Unit Leader directions/plan.
Identify staff to support on-going Recovery Operations and Recovery Plan.
Advise identified staff on their continual support role.
Complete all required forms, reports, and other documentation. Provide all completed documentation to the Documentation Unit, prior to departure.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
CEMP Part II
Finance Section December 2025
Part II - 109
Be prepared to provide input to the after-action report.
Transition over to Recovery Operations and support Recovery Manager in tracking per project costs as directed by FEMA cost recovery and public assistance guidelines.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Finance Section December 2025
Part II - 110
TIME KEEPING UNIT LEADER
POSITION
OVERVIEW
Responsible for working with all Department Liaisons and Sections to ensure field units track hours worked by personnel and volunteers & preparing daily personnel time recording documents.
REPORT TO FINANCE & ADMINISTRATION | CHIEF/COORDINATOR
PLANS
& REPORTS
Supports assessment, tracking, and organization of the cost of implementation per state and federal cost recovery guidelines.
FORMS, GUIDES FORMS
POSITION JOBAID
RESOURCE TRACKING
ICS 205A COMMUNICATION LIST
ICS 210 RESOURCE STATUS CHANGE
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
GUIDES
PA DAMAGE CATEGORIES
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Track, record, and report all on-duty time for personnel working during the emergency.
Ensure that personnel time records, travel expense claims and other related forms are prepared and submitted to budget and payroll office.
Supervise the Time Keeping Unit.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
CEMP Part II
Finance Section December 2025
Part II - 111
Establish and maintain a time keeping system.
(FORM | ICS 211)
(FORM | RESOURCE TRACKING)
(FORM | ICS 210)
Initiate, gather, or update time reports from all personnel, to include volunteers assigned to each shift. Ensure that time records are accurate and prepared in compliance with policy.
Obtain complete personnel rosters from the Personnel Unit.
Rosters must include all EOC personnel as well as personnel assigned to the field level.
Provide instructions for all supervisors to ensure that time sheets and travel expense claims are completed properly and signed by each employee prior to submitting them.
Establish a file for each employee or volunteer within the first operational period.
Maintain a fiscal record for as long as the employee is assigned to the response.
Keep the Finance/Administration Section Coordinator informed of significant issues affecting the Time-Keeping Unit.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by Finance/Administration Section Coordinator and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Finance Section December 2025
Part II - 112
PURCHASING UNIT LEADER
POSITION
OVERVIEW
Responsible for financial matters involving vendor contracts.
REPORT TO FINANCE & ADMINISTRATION | CHIEF/COORDINATOR
PLANS SUPPORTS ASSESSMENT, TRACKING, AND ORGANIZATION OF THE
COST OF IMPLEMENTATION PER STATE AND FEDERAL COST
RECOVERY GUIDELINES
FORMS,
GUIDES
FORMS
POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
GUIDES
PA DAMAGE CATEGORIES
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Coordinate vendor contracts not previously addressed by existing approved vendor lists.
Coordinate with Supply/Procurement Unit on all matters involving the need to exceed established purchase order limits.
Supervise the Purchasing Unit.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
CEMP Part II
Finance Section December 2025
Part II - 113
Establish and maintain a purchasing system.
Review the emergency purchasing procedures.
Prepare and sign contracts as needed, be sure to obtain concurrence from the Finance/ Administration Section Coordinator.
Ensure that all contracts identify the scope of work and specific site locations.
Negotiate rental rates not already established, or purchase price with vendors as required.
Admonish vendors as necessary, regarding unethical business practices, such as inflating prices or rental rates for their merchandise or equipment during emergencies.
Finalize all agreements and contracts, as required.
Complete final processing and send documents to Budget and Payroll for payment.
Verify costs data in the pre-established vendor contracts and/or agreements.
In coordination with the Logistics Section, ensure that the Purchasing Unit processes purchase orders and develops contracts in a timely manner.
Keep the Finance/Administration Section Coordinator informed of all significant issues involving the Purchasing Unit.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and directed by Section Coordinator.
Follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
CEMP Part II
Finance Section December 2025
Part II - 114
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Finance Section December 2025
Part II - 115
COST ACCOUNTING UNIT LEADER
POSITION
OVERVIEW Responsible for collecting and maintaining documentation for the incident to help the planning and recovery efforts.
REPORT TO FINANCE & ADMINISTRATION | CHIEF/COORDINATOR
PLANS SUPPORTS ASSESSMENT, TRACKING, AND ORGANIZATION OF THE
COST OF IMPLEMENTATION PER STATE AND FEDERAL COST
RECOVERY GUIDELINES
FORMS,
TOOLKIT,
GUIDES
FORMS
POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 210 RESOURCE STATUS CHANGE
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
GUIDES
PA DAMAGE CATEGORIES
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Responsible for collecting cost information and performing cost-effectiveness analysis.
Provide cost estimates and cost savings recommendations.
Supervise the Cost Accounting Unit.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Establish and maintain a position log and other necessary files.
CEMP Part II
Finance Section December 2025
Part II - 116
Establish (or implement) an accounting system and special cost codes associated with this emergency.
Monitor all emergency expenditures and resource status change costs. (FORM | ICS 210)
Ensure that all sections and units are documenting cost-related information.
Collect, and compile cost information at the end of each shift.
Obtain and record all cost data to cover:
Personnel
Equipment Rental/Contract Equipment
Supplies from outside vendors
Contracts for special or emergency services
Coordinate with the Documentation Unit on content and format of cost related files to be transferred.
Review existing documentation to determine if there are additional cost items that may have been overlooked.
Prepare cost estimates related to EOC objectives and strategies. Be prepared to discuss these at EOC Planning Meetings if required.
Compile cumulative cost records on a daily basis.
Ensure that departments are compiling cost information using any special agency/jurisdiction cost codes.
Ensure that estimate costs are replaced with actual costs where known.
Provide verbal or written reports to the Finance/Administration Section Coordinator upon request.
Prepare and maintain a cost report to include cumulative analysis, summaries and total expenditures related to the emergency.
Organize and prepare records for audits as necessary.
Act as the liaison for the EOC with county and other disaster assistance agencies to coordinate the cost recovery process.
Prepare all required state and federal documentation as necessary to recover allowable costs.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
CEMP Part II
Finance Section December 2025
Part II - 117
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by Finance/Administration Section Coordinator and follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Finance Section December 2025
Part II - 118
COMPENSATION AND CLAIMS UNIT LEADER
POSITION
OVERVIEW
Responsible for investigating and processing physical-injury and property- damage claims arising from emergency/disaster incident.
REPORT TO FINANCE & ADMINISTRATION | CHIEF/COORDINATOR
PLANS SUPPORTS ASSESSMENT, TRACKING, AND ORGANIZATION OF THE
COST OF IMPLEMENTATION PER STATE AND FEDERAL COST
RECOVERY GUIDELINES
FORMS &
GUIDES
FORMS
POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 208 SAFETY MESSAGE
ICS 211 CHECK-IN LIST
ICS 215A SAFETY ANALYSIS
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
ICS 227 CLAIMS LOG
GUIDES
PA DAMAGE CATEGORIES
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Oversee the investigation of injuries and property/equipment damage claims arising out of the emergency.
Complete all forms required by worker's compensation program.
Maintain a file of injuries and illnesses associated with the emergency which includes results of investigations.
Supervise the Compensation and Claims Unit.
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
CEMP Part II
Finance Section December 2025
Part II - 119
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Establish and maintain a compensation and claims system.
Maintain a chronological log of injuries and illnesses, and property damage reported during the emergency.
(FORM | ICS 227)
Investigate all injury and damage claims as soon as possible.
Prepare appropriate forms for all verifiable injury claims and forward them to Workmen's Compensations within the required time frame consistent with jurisdiction’s policy & procedures.
Coordinate with the Safety Officer regarding the mitigation of hazards. (FORM | ICS 208)
(FORM | ICS 215A)
Keep the Finance/Administration Coordinator informed of significant issues affecting the Compensation and Claims Unit.
Forward all equipment or property damage claims to the Recovery Unit.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and directed by Section Coordinator.
Follow Demobilization Unit Leader directions/plan.
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Be prepared to provide input to the after-action report.
CEMP Part II
Finance Section December 2025
Part II - 120
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
CEMP Part II
Finance Section December 2025
Part II - 121
RECOVERY UNIT LEADER
POSITION
OVERVIEW
Responsible for executing procedures to capture and document costs relating to a disaster/emergency.
REPORT TO FINANCE & ADMINISTRATION | CHIEF/COORDINATOR
PLANS &
REPORTS
SUPPORTS ASSESSMENT, TRACKING, AND ORGANIZATION OF THE
COST OF IMPLEMENTATION PER STATE AND FEDERAL COST
RECOVERY GUIDELINES
REPORTS
AFTER ACTION REPORT
FORMS &
GUIDES
FORMS
POSITION JOBAID
ICS 205A COMMUNICATION LIST
ICS 211 CHECK-IN LIST
ICS 214 ACTIVITY LOG
ICS 225 FOR PD CREDENTIALING
GUIDES
PA DAMAGE CATEGORIES
TECHNOLOGY LAPTOP
PHONE (DESK OR CELL)
RESOURCES WORKSTATION
POSITION BINDER (CAN BE VIRTUAL)
VEST
PROFESSIONAL
CREDENTIAL
To receive professional credit for Emergency Management EOC/Career Credentialing, complete and turn in:
(ICS 225) to CALOES | [email protected]
Determine impacts of the emergency requiring recovery planning.
Initiate recovery-planning meetings with appropriate individuals and agencies.
Develop the initial recovery plan and strategy for the jurisdiction.
Ensure that all appropriate agencies are kept informed and have the opportunity to participate in the recovery planning process.
Develop the strategy to transition from recovery planning in the EOC to a wider post-emergency recovery effort.
Supervise the Recovery Unit.
CEMP Part II
Finance Section December 2025
Part II - 122
Check in at the EOC.
(FORM | ICS 211, FORM | ICS 205A)
Assist with EOC Set-up (If not already fully set-up).
Check work station to ensure readiness.
Wear identification vest and read over job aid.
Receive situation, section, and position briefing from available and appropriate personnel.
Ensure readiness to maintain concise records of position activities. (FORM | ICS 214)
Establish and maintain a recovery system.
Monitor the current situation report to include recent updates and determine overall impacts of the emergency.
Based on available information, prepare an initial estimate of likely recovery issues that must be addressed. Document these in a preliminary report.
Coordinate with the Advance Planning Unit to determine major mid-to-long range social, economic, environmental and political impacts.
Assist the Operational Area as necessary in determining appropriate sites for Disaster Application Centers.
Facilitate recovery planning meetings involving appropriate Management and General Staff personnel and other agencies as needed.
Develop a recovery plan and strategy for the jurisdiction or agency.
Coordinate with Finance/Administration to ensure that FEMA, OES and other public reimbursement source documents and applications are consistent with the recovery strategy.
In conjunction with Finance/Administration, ensure that specific project timelines are developed to meet the goals and objectives of the recovery plan.
Provide turnover briefing to position replacement.
Provide details regarding ongoing activities and planned activities to be accomplished during the upcoming operational period.
(FORM | USE CURRENT POSITION JOBAID)
(FORM | USE CURRENT ICS 214)
Provide all completed documentation to the Documentation Unit.
Follow EOC check out procedures, including signing out, work station clean-up and forwarding phone number where you can be reached.
(FORM | ICS 211, FORM | ICS 205A)
Deactivate position when authorized by EOC Director and directed by Section Coordinator.
Follow Demobilization Unit Leader directions/plan.
CEMP Part II
Finance Section December 2025
Part II - 123
Complete all required forms, reports, and other documentation.
Provide all completed documentation to the Documentation Unit, prior to your departure.
Turn over financial information to Finance/Administration Section Coordinator.
Clean up your work area before you leave.
Provide a forwarding phone number where you can be reached.
Assist the EOC Coordinator and Planning & Intelligence Section with preparing the After-Action Report.
(REPORT | AFTER ACTION)
SHIFT/STAFF CHANGE
TASKS
(PENDING)
NOTES
Name:
Forwarding
Phone #: _______________________
Date: Time: ________________am / pm
Comprehensive Emergency
Management Plan – 2025
Part III – Support Annexes
CEMP Part III
Table of Contents December 2025
Part III - 2
TABLE OF CONTENTS
TABLE OF CONTENTS .................................................................................................... PART III - 2 PUBLIC ALERT & WARNING SUPPORT ANNEX ................................................................ PART III - 3 PROTECTIVE ACTIONS EMERGENCY EVACUATION SUPPORT ANNEX ........................... PART III - 12 FINANCIAL MANAGEMENT SUPPORT ANNEX .............................................................. PART III - 19 PRIVATE SECTOR COORDINATION SUPPORT ANNEX .................................................... PART III - 20 VOLUNTEER AND DONATIONS MANAGEMENT SUPPORT ANNEX ................................ PART III - 22
CEMP Part III
Public Alert and Warning Support Annex December 2025
Part III - 3
PUBLIC ALERT & WARNING SUPPORT ANNEX
1.0 WARNING AND ALERT
Warning is the process of alerting governments and the public of the threat of imminent extraordinary danger. Depending on the nature of the threat and the population group at risk, warning can originate at any level of government.
Success in saving lives and property is dependent on timely dissemination of warning and emergency information to persons in threatened areas.
The City of Hayward (the “City”) has identified the following areas to be areas of focus to strengthen their public alert and warning system as developed during November 2023 workshops:
The enterprise-wide use of the ATT FirstNet system; this network has been built with and for first responders. The Federal government set aside Band 14 spectrum specifically for public safety. During an emergency, this band is locked and available only to first responders on FirstNet. FirstNet subscribers maintain always-on priority across LTE – Band 14 spectrum plus all of AT&T’s commercial LTE spectrum bands. FirstNet wireless coverage reaches over 99% of Americans.
Public safety agencies also have access to a nationwide, dedicated fleet of over 150+ portable cell sites – including satellite cell on light trucks and cell on wheels.
FirstNet provides access to the FirstNet Response Operations Group (ROG) – a dedicated team of former first responders always ready to support communities. Communications through Microsoft Teams video conferencing software offering workspace chat and videoconferencing, file storage, and application integration. Text (SMS) can be an invaluable tool for communicating emergency notifications and alerts during any natural disaster. SMS is considered the best alerting system during a crisis. It is considered the simplest and most effective communication channel during a crisis and plays a vital role in sending essential notifications and alerts to citizens during pandemics, climate disasters, terrorist attacks, and any sort of crisis. SMS messaging takes place offline, relying on Wi-Fi or 5G is unnecessary. In a disaster, this connectivity might make all the difference. Engagement with Alameda County Environmental Health for the purpose of supporting the issuance of boil water advisories and other public health related notifications.
Solutions related to the recalling of out-of-city personnel, many of whom live up to 80 miles out of the area. The City has increased the use of remote work; on a typical workday, only 40% of support staff are in the City.
CEMP Part III
Public Alert and Warning Support Annex December 2025
Part III - 4
The management of increased call volume and call prioritization in the City’s 9-1- 1 call center.
Mobilizing personnel to report to an activated Emergency Operations Center (EOC).
2.0 ATTACK WARNING SYSTEMS
The National Warning System (NAWAS) is a nationwide attack warning system developed to accomplish this task in a war emergency. For major peacetime emergencies, portions of the NAWAS system can be used, augmented by state and local systems as appropriate. NAWAS is a dedicated wire-line system that provides two-way voice communications between Federal Warning Centers, states’ warning points and local warning points. The system in California consists of four elements:
1. NAWAS, Federal-California Link
This system may be activated nationally from two protected federal facilities the National Warning Center (North American Air Defense Command Colorado Springs, Colorado) and Alternate National Warning Center (Olney, Maryland).
2. NAWAS, State-County Warning Point Circuits
California ties into the national system with a primary state warning point at the Cal OES Headquarters in Sacramento. Circuits then extend to 45 County Warning Points. The California Highway Patrol Headquarters in Sacramento serves as the Alternate State Warning Point.
Both Federal and State circuits are monitored 24 hours a day at the Cal OES Warning Center, the Alternate State Warning Point, and each of the local Warning Points. The 13 counties not on this system receive warning via other means normally the California Law Enforcement Telecommunications System (CLETS).
3. County-City Warning Systems
To disseminate warning from the County Warning Points to the City, local communications channels are normally used. Although the State Warning Point will relay warnings over CLETS, it is usually more expeditious for cities to arrange with the County Warning Point on NAWAS for further relay of the information within the County. This is normally done via local public safety communications channels or, in some instances, telephone.
4. Local community attack warning devices, such as sirens, horns or whistles.
CEMP Part III
Public Alert and Warning Support Annex December 2025
Part III - 5
DIALOGIC
The City is responsible for warning the population of impending or imminent danger. The City uses an automated telephone notification system called “Dialogic Communications System”, which can be activated from the the City Dispatch Center. “Dialogic Communications System” uses a Geo- Notify program (a desktop mapping computer interface, indicating street-level maps with telephone data) to notify selected areas, including homes, businesses and schools, via telephone lines using a pre-recorded emergency message.
EMERGENCY ADVISORY RADIO SYSTEM
Many communities operate their own AM radio stations specifically to tell local area motorists what to do during flash floods, industrial accidents, AMBER alerts, terrorist threats, earthquakes, severe weather, and other emergencies. These systems usually come as complete packages able to broadcast noncommercial, voice messages on the AM radio band. FCC rules provide a 10-year, renewable license in the community’s name and a 9.3-mile protection zone inside which no other community can operate on the assigned frequency. The effective range for one station is 3 to 5-mile radius that can accommodate additional synchronized transmitters to expand the coverage.
LOCAL ALERTING, WARNING & NOTIFICATION
A combination of methods may be employed to notify, alert, or warn the public concerning local emergency situations. The Dialogic system may be activated along with Law Enforcement Officers and personnel from the Fire Department to make notifications to the public using portable loud speaker systems.
2.1 Hazard-Specific Alerts & Warnings
FLOOD
A flood emergency is normally preceded by a buildup period that permits marshalling forces required to combat the emergency. During the buildup period, Cal OES cooperates with the National Weather Service and the State Department of Water Resources by relaying pertinent weather information and river bulletins to local officials in affected areas.
FIRE
Initial warnings of major fires are normally issued by the affected area through the OA and/or Cal OES Regional Fire Coordinator, using whatever means of communication is appropriate and available. Requests for mutual aid follow the same channels.
CEMP Part III
Public Alert and Warning Support Annex December 2025
Part III - 6
EARTHQUAKE
Earthquakes occur without warning. Cal OES could receive notification of an earthquake as well as subsequent information, including damage reports from various sources.
The information may be received via NAWAS, radio, television, and/or telephone, and may be further disseminated as appropriate, using all of these means. The State Warning Center has a seismic alarm system that activates during earthquakes, prompting duty personnel to investigate the disturbance.
OTHER EMERGENCIES
Warning and information concerning emergencies other than those cited above is disseminated using any appropriate system.
3.0 ALERTING & WARNING SIGNALS
ATTENTION OR ALERT SIGNALS
The ATTENTION or ALERT signal is a 3-to-5-minute steady tone on sirens, horns, or other devices. This signal is meant to transmit the message that an emergency exists or is imminent and for citizens to listen to local or area radio or television stations for essential emergency information.
ATTACK WARNING SIGNAL
This is a 3-to-5-minute wavering tone on sirens of a series of short blasts on horns or other devices, repeated as often as indicated over NAWAS or as deemed necessary by local authorities. This signal indicates that an actual attack against this country has been detected. IT WILL BE USED FOR NO OTHER PURPOSE AND WILL HAVE NO OTHER MEANING. Citizens should tune to their emergency alert system radio for further instructions.
TESTING LOCAL WARNING SYSTEMS
With prior public notice, local warning devices may be tested to assure that they are operating properly and that the emergency signals will be recognized by the public.
4.0 AUXILIARY COMMUNICATIONS SERVICE PLAN
Radio Amateur Civil Emergency Service (RACES), is an Emergency Communications Reserve. The following paragraphs are the contents of the local RACES members’ plan for support to the Alameda County OA (OA); use of RACES is typically coordinated through a resource request to the OA.
CEMP Part III
Public Alert and Warning Support Annex December 2025
Part III - 7
The Auxiliary Communications Service provides the Alameda County OA with an emergency communications reserve based on a variety of volunteer skills for emergency tactical, administrative, and logistical communications between the cities and their agencies, and between the cities and county government.
The Auxiliary Communications Service (ACS) coordinates Amateur Radio resources or equivalent government resources; and promotes the effective management and utilization of the Amateur Radio operators and other FCC licensees in support of civil defense and disaster response and recovery. While other FCC licensees may become a part of the ACS, this Plan is specifically directed to the use of Amateur Radio operators under the provisions of the Radio Amateur Civil Emergency Service (RACES).
The resources of this Service are an essential staff resource intended to augment agency and public safety communications. The number of participants is not limited and will be based on the specific need and the availability of responders. A declaration of an emergency is not required to mobilize the RACES resources.
The cities support an active involvement of RACES participants in the day-to-day affairs of the local emergency management agencies so that in times of need the RACES participants are cognizant with on-going procedures and personnel and can integrate with all systems. As part of its on- going activity, RACES Amateur Radio operators may conduct on-the-air activities to test, train, and keep in peak readiness the emergency operations communications equipment.
The purpose of this Plan is to provide authority for the participation of Amateur Radio operators in providing essential communications during periods of national, state, or local emergency. RACES operations are carried out in accordance with FCC Rules and Regulations. The Amateur Radio operators within the City are a single regional resource and may be assigned to any appropriate jurisdiction within the area.
AREA COVERED
Alameda County has a population of approximately 1.5 million (2000 census) and an area of 737.5 square miles.
THREAT
The population in this area faces a variety of threats both natural and man-made, to which they must be prepared to respond, e.g., earthquakes, floods, hazardous material spills, and energy emergencies. A complex geographic area of alluvial plains, canyons and hills provides topographic extremes. Demographic factors as well as climate and geological faults present a range of hazards to be considered by emergency services workers - both CEMP Part III
Public Alert and Warning Support Annex December 2025
Part III - 8
professional and volunteer. Any of the threats could occasion the activation of qualified emergency communication needs to assist, supplement, or replace the capabilities existing in the County.
RADIO OFFICER AND ORGANIZATION
The organization for the implementation and administration of the RACES resources is based on the key role of the RACES Radio Officer. The RACES Radio Officer is usually the Amateur Radio Emergency Service (ARES) Emergency Coordinator for the respective city. The Emergency Services Coordinator(s) may appoint a RACES Radio Officer(s) at any time and this appointment will take precedence.
PARTICIPANTS
Amateur Radio operators participating under this Plan shall be registered as Disaster Service Workers in the communications class in accordance with Section 3100 (et seq.) of the California Government Code.
The Alameda County OA utilizes two categories of Amateur Radio volunteers:
RACES Radio Operators: This category is composed of Amateur Radio operators who have indicated their willingness to participate by completing the California Disaster Service Worker Volunteer Program form for the Communications Classification, Auxiliary Communications Service Specialty and completing the Loyalty Oath/Affirmation as required by State law. These operators may carry out any actions or duties consistent with FCC and RACES rules and regulations (also see Section 14). This category of participant shall be issued an identification card by the City indicating the operator’s status as RACES Radio Operator. RACES EOC Responders: This category is composed of RACES Radio Operators who are approved to respond to Emergency Operation Centers (EOC), special or restricted city facilities, and special or restricted agency locations (e.g., hospital, school, etc.). Due to the potentially sensitive nature of the activities and accesses granted to this category of participants, enrollment shall additionally include a finger print check by the The City Police Department. This category of participant shall be issued an identification card by the City indicating the operator’s status as RACES EOC Responder.
RESOURCES
RACES resources are considered a facility that is available to all government services/agencies, and are not assigned exclusively to any one service/agency. RACES frequencies/channels are not assigned exclusively to any one service/agency. The CEMP Part III
Public Alert and Warning Support Annex December 2025
Part III - 9
RACES Radio Officer and/or RACES EOC Responders coordinate resources while consulting with the Director or Incident Commander. It is the intent of this Plan to meet the needs of the Alameda OA for the available RACES resources.
NETWORKS
Alameda County Emergency Service (ACES) operates four network levels that will be used by RACES under the provision of this Plan. The network levels are identified as the following:
LEVEL 1 networks provide Direction and Control communications between the Cal OES Region II EOC and the OA EOC(s) within Region II. LEVEL 2 networks provide Direction and Control communications between the OA EOC(s) and the jurisdictions within the OA, and between Alameda County and the Emergency Alert System (formerly Emergency Broadcast System) stations in the OA.
LEVEL 3 networks provide communications between the OA EOC(s) and deployed mobile and other authorized units within the OA. LEVEL 4 networks provide communications between the jurisdictional EOC(s) and deployed mobile and other authorized units under the direction of the City(s).
IDENTIFIERS
Operators may use tactical station identifiers in conjunction with the FCC call signs.
FREQUENCY COORDINATION
The RACES Radio Officer(s) will establish the frequencies used within the OA. All frequencies will be coordinated with the Cal OES Regional Communications Coordinator.
Interference problems from outside sources will be referred to the Cal OES Regional Office for resolution. In an emergency, the RACES EOC Responder(s) may establish frequencies in coordination with the Alameda County Sheriff’s Communication Team and/or the Cal OES Regional Communications Coordinator.
In the event of an emergency that necessitates invoking the President's war emergency powers, RACES will be governed by paragraph 97.407 (b) of the FCC Rules and Regulations, 47 CFR. Operations will be restricted to frequencies assigned and coordinated by the Cal OES.
CEMP Part III
Public Alert and Warning Support Annex December 2025
Part III - 10
STATION LOCATIONS
Locations of EOC stations and other fixed stations operated under this Plan, and their tactical identifiers, are determined on a case-by-case basis. In an emergency, RACES Radio Officer(s) may establish temporary stations for RACES Responder(s) at any time.
EQUIPMENT RESOURCES
There are several hundred fixed, portable and mobile stations that may be operated under the provisions of this Plan. The majority of the equipment is owned, maintained and operated by the individual Amateur Radio operators. The RACES Radio Operator(s) will control, maintain and inventory equipment owned or provided by the City.
MUTUAL AID
This Service is a COMMUNICATION resource covered by the California Master Mutual Aid Agreement. RACES resources may be requested by, and supplied to other jurisdictions in accordance with established inter-governmental mutual aid procedures:
Alameda OA to/from the Cal OES Region. That Region to the State Coordinating Center (SCC) will direct requests for mutual aid exceeding Cal OES Regional capabilities. Should communication be broken with the SCC, the request will be directed to an adjacent Cal OES Region with notification to the SCC as soon as conditions permit.
Alameda OA to/from contiguous jurisdictions.
Alameda OA to/from the City or adjacent cities with which it has an agreement.
REVIEW
This plan, and its appendices, shall be reviewed for completeness, currency, and accuracy not later than every two years after the latest approval date. Revisions and corrections will be issued to the Distribution List when approved.
MOBILIZATION/USAGE
This service is an essential staff resource intended to augment agency and public safety communications. Program participants may be used in support of agency and public safety communications requirements at any time. A declaration of an emergency is not required to mobilize RACES resources. However, the use of FCC Amateur Radio Service frequencies in RACES operations is limited to training and emergency communications as set out in paragraphs 97.401- 97.407, FCC Rules and Regulations, 47 CFR.
AUTHORITY
CEMP Part III
Public Alert and Warning Support Annex December 2025
Part III - 11
The authority to mobilize and use this service and any of its personnel rests with the County Emergency Services Coordinator and City's emergency staff.
REQUESTS
Requests for RACES support from any agency shall be directed to the Emergency Services Coordinator, Emergency Manager or Incident Commander.
CALLOUT
The RACES Radio Officer for each City will maintain a current roster and establish a callout procedure.
RESPONSE
RACES Radio Operators and RACES EOC. Responders are unpaid volunteers, however once they have been notified and have accepted an assignment, they are expected to respond to their assigned location as quickly as possible with proper regard for safety and public laws.
DIRECTION
RACES Radio Operators acting under this Plan are expected to take their direction from the RACES Radio Officer(s), the RACES EOC Responder(s), or the Incident Commander.
RACES EOC Responder(s) are expected to take their direction from the RACES Radio Officer(s), the Emergency Services Coordinator, Operation Section Chief, or the Incident Commander.
CEMP Part III
Protective Actions Emergency Evacuation Support Annex December 2025 Part III - 12
PROTECTIVE ACTIONS EMERGENCY EVACUATION SUPPORT
ANNEX
This operational procedure will be used by agencies and organizations in the City to manage and coordinate evacuations in response to any hazard which would necessitate such actions. This document defines the scope of procedure, details the concept of operations and assigns responsibility for implementation.
1.0 PURPOSE
This procedure establishes a consistent operational methodology for the City to plan for and implement evacuations, regardless of the geographic area in which they occur. The availability of consistent city-wide procedures facilitates an adequate understanding on the part of all agencies, organizations and levels of government regarding their responsibilities during an evacuation and establishes uniform operational techniques through which those responsibilities can be fulfilled.
2.0 AUTHORITY
This annex is adopted as an operational element of the City’s Comprehensive Emergency Management Plan and is incorporated by reference thereto. As such, it is intended to be consistent with and supportive of the Comprehensive Emergency Management Plan, and to be implemented, when needed, with the same authorities under law as provided therein.
3.0 SCOPE
This procedure applies to all City Emergency Response Team personnel and local emergency and response agencies tasked with planning for and implementing evacuations. Implementation of this procedure is under the direction of the Director of Emergency Services, through the City EOC. This procedure defines the circumstances under which evacuations in the city may be necessary. It also defines the roles and responsibilities of local response agencies.
4.0 CONCEPT OF OPERATIONS
This section describes the concepts and provisions through which the EOC will determine the need for, and implement, an evacuation. The concept of operations for this procedure provides guidance and structure for both the planning and implementation of evacuations.
The procedure relies on effective preplanning for evacuations as well as the implementation of established plans accordingly.
CEMP Part III
Protective Actions Emergency Evacuation Support Annex December 2025 Part III - 13
The principal assumptions underlying the concept of operations for an evacuation are as follows:
Activation of this procedure will occur for all hazards which could necessitate evacuation and sheltering operations involving all or parts of the City. However, the need to implement certain aspects of the procedure, such as opening shelters in non-threatened areas or terminating evacuations and opening refuges-of-last- resort, may vary based on the specific hazard, degree of vulnerability, and projected area of impact.
The evacuation of large numbers of people from vulnerable areas will stress the limited capabilities of roadways available for this purpose, potentially requiring substantial additional time to complete an evacuation. Consequently, an evacuation must be initiated as soon as feasible upon recognition of the threat and must continue to function efficiently until completion. Evacuations will require a substantial level of personnel and equipment resources for traffic control, which could stress and/or exceed the capabilities of the City.
Specific procedures may be developed regarding the pre-deployment of mutual aid personnel and equipment resources to as required.
Coordination between the OA and the City in the implementation of an evacuation will occur through exchanges of information regarding decision-making, protective actions, and resource coordination and deployment.
The capacity of available public evacuation shelter facilities in and adjacent to the impacted areas may be limited, potentially requiring the full use of all shelters within the evacuation region (see Annex C of the City of The City Comprehensive Emergency Management Plan). A high level of coordination will be necessary to effectively communicate protective action and shelter information to evacuees. For certain hazards, large vulnerable populations and limited evacuation road networks may necessitate termination of evacuations prior to full completion and evacuees still at risk would need to be directed to refuges-of-last-resort as quickly as possible.
An evacuation will require expedited coordination of all City departments to maintain an efficient and safe movement of evacuation traffic out of the impacted areas and to adequate shelter locations.
5.0 OPERATIONS
The staff of the City’s EOC will monitor hazardous situations as they develop. Regular conference calls will be held between the OA EOC, other potentially affected city EOCs (risk and host) and appropriate state and federal agencies as to the degree of threat to The City and the potential for escalation. In addition, the City EOC will coordinate with local agencies as to whether the hazard will require coordination and implementation of CEMP Part III
Protective Actions Emergency Evacuation Support Annex December 2025 Part III - 14
protective actions including evacuations across multiple jurisdictions. If so, the City EOC and potentially affected jurisdictions’ EOCs will begin implementation of the evacuation process.
The City EOC will coordinate and reach consensus on the area(s) most likely to be impacted. The City EOC will then notify all agencies potentially involved in the response, and request that the Director declare a Local Emergency. Working together, the City and other affected agencies and organizations will then initiate the evacuation in accordance with the provisions of this procedure, including the pre-deployment of personnel and equipment resources, if applicable.
Under circumstances involving evacuations of multiple areas, the Director may recommend to the OA that a county-directed evacuation is necessary. At the Director’s discretion, language may be included in the Director’s Declaration identifying mandatory evacuations and directing a coordinated response from the City EOC among all local response agencies. County direction of the evacuation may also occur when some or all of the following conditions are present:
In support of evacuations, response operations including sheltering, traffic management, and emergency public information may be required in areas not threatened by the hazard;
Multiple jurisdictions will use a limited number of evacuation routes necessitating central coordination and direction;
The threat will necessitate evacuation of large numbers of people, requiring the coordination of emergency operations among two or more counties; The Director has issued a Declaration of a Local Emergency; and The City Comprehensive EOC has been activated.
The City EOC will monitor the progress of the evacuation and exchange information on an established time schedule to promote effective coordination by all involved. Through this procedure, the City and OA EOCs will coordinate the efficient deployment of resources when needed, efficient use of available evacuee shelter capacity, and effectively address modifications to evacuation routes, if necessary.
In order to effectively implement an evacuation, this procedure requires pre-hazard planning by all parties, pre- event coordination, consistent implementation strategies, and post impact assessments. A general description of these activities is provided in the following Exhibit One.
CEMP Part III
Protective Actions Emergency Evacuation Support Annex December 2025 Part III - 15
EXHIBIT ONE
Operational Phases
Preparedness Phase Stand-By Phase Decision Phase Evacuation Phase Re-entry Phase Procedure update
Pre-hazard public
information program
Training and
exercising
Monitor progress
of hazard
Conference calls
Assess
vulnerability and
decision times
Resource pre-
positioning
Evacuation
decision
Pre-event public
information
Enhanced
coordination
Monitoring of
evacuation
Assess need to
terminate
Develop reentry
plan
Post-event public
information
Immediately preceding an event that may necessitate an evacuation, and under a Local Emergency declared by the Director, the City may implement response efforts through the pre-positioning of resources. The City will coordinate with the OA EOC regarding the dissemination of appropriate public information.
During implementation, local response agencies will monitor the progress of the evacuation and exchange information on the level of traffic on routes and the use of public shelter space. Ongoing public information will be provided through the broadcast media to inform the evacuees of any change in evacuation routes, the availability of hotel and public shelter space in host jurisdictions, and similar information.
After the threat has passed, the City EOC will coordinate with other affected areas to develop a re-entry traffic management plan. Post-event activities will also include a review and critique of the evacuation and associated procedures to determine the need for any modifications. The post-event critique should consider the need for more training or exercises to improve the capabilities of response personnel to implement this procedure.
6.0 PRE-POSITIONING OF RESOURCES
Implementation of an evacuation will require substantial personnel, equipment and supplies at various locations along the evacuation routes and at facilities designated as shelters. Further, mutual aid resources necessary for initiating and sustaining the evacuation process may need to be pre-positioned prior to or concurrently with the Director’s emergency declaration. Therefore, the incident action plan must include procedures regarding the pre-deployment of resources, the agencies involved, and the coordination process that will occur.
CEMP Part III
Protective Actions Emergency Evacuation Support Annex December 2025 Part III - 16
Pre-positioning City law enforcement personnel in support of local traffic management plans should occur consistent with the resources available and the magnitude of the event. Upon implementation of this procedure, the City EOC will instruct the responsible agencies to pre-position resources as specified in the Incident Action Plan or as agreed to during local coordination conference calls.
Exhibit Two lists the types of pre-positioned resources that agencies should consider in the development of evacuation procedures.
EXHIBIT TWO
Pre-Positioned Resources
• Electronic programmable message boards
• Portable AM / FM radio transmitters
• Tow trucks
• Gasoline tankers at stations along regional routes
• Ambulances and medical personnel
• Shelter management personnel
• Buses for transport of evacuees without other means
To effectively manage an evacuation, it is essential that every involved agency and organization have timely and accurate information regarding the current characteristics of the evacuation, support operations, resource availability, and the hazard itself. To that end, a process for routine communications and coordination should be initiated by the City.
EOC and all other involved EOCs upon determining that an evacuation must be implemented.
Immediately upon the decision to implement an evacuation, all affected agencies and organizations will use the Incident Action Plan provided by the City EOC, as a guide to communicate information to the City EOC at regular intervals. Examples of such information regarding evacuations could include:
The characteristics of the hazard and associated events The designated evacuation area, initiation times and resource mobilization status The progress of resource pre-deployment
The status of evacuation routes
The status of available public shelter and hotel/motel space by location Assessment of the need to terminate the evacuation prior to full completion Estimated time of evacuation completion
CEMP Part III
Protective Actions Emergency Evacuation Support Annex December 2025 Part III - 17
During an evacuation, for a wide variety of unanticipated reasons, it may become necessary to adjust or modify procedures stipulated in the Incident Action Plan. The most readily apparent reasons for such modifications could include, but are not necessarily be limited to, the following:
Changes in the direction or intensity of the hazard;
Blockage or excessive vehicle congestion on an evacuation route; Filling of available capacity at public shelters and hotels/motels in host areas; and Anticipated failure to complete the evacuation prior to hazardous conditions impacting evacuees.
If alternative routes, actions or resource deployment can be pre-planned to address these possibilities, appropriate procedures will be included in the Incident Action Plan. For other situations that cannot be anticipated during the planning of an evacuation, the City EOC will work with all relevant agencies at the time to make adjustments in the evacuation.
In the event of a physical blockage of an evacuation route, the EOC will coordinate with the OA, as necessary, to remove the blockage. If removal is not feasible, the City EOC will coordinate with all affected EOCs to plan and implement alternative routing.
An evacuation will generate impacts outside areas immediately at risk and may necessitate the use of local resources in non-threatened areas to support the response.
The City EOC will determine whether activation of response operations in designated host areas outside the immediate area of impact is necessary. If so, the City EOC, in conjunction with the Director’s Declaration, will direct the assistance of any or all local agencies, and request as needed adjacent agencies, to support the evacuation as follows:
The City EOC may request that the OA direct host areas to implement protective actions in support of evacuations in risk areas. All EOCs within designated host areas may be requested to activate and prepare to initiate host response plans. All jurisdictions within designated host areas may be included in any Governor’s Declaration of a State of Emergency and all requests by the Governor for emergency disasters and major disaster declarations.
The OA may be requested to coordinate traffic management issues with local law enforcement from within host and risk areas and with the highway patrol and CALTRANS, when necessary.
In support of host response operations, the City EOC may request, at a minimum, that the OA make the following information available to host areas, including those in other counties, on a continuous basis or when warranted by the situation:
CEMP Part III
Protective Actions Emergency Evacuation Support Annex December 2025 Part III - 18
CALTRANS real-time traffic counter data for roads within the host area or on all roads leading into the area;
Traffic Reports from CALTRANS, local news organizations and the highway patrol; Any significant changes to the situation in adjoining counties that may have an impact on host sheltering operations; and
The content of any public information released by other agencies.
CEMP Part III
Financial Management Support Annex December 2025
Part III - 19
FINANCIAL MANAGEMENT SUPPORT ANNEX
The City’s Finance Department is responsible for financial management during disaster operations. The The City Fire Department (HFD) and the City Clerk share supporting responsibilities for fiscal management. The City’s Public Assistance (PA) Standard Operating Procedure (SOP) describes:
Responsibilities for financial management
Responsibilities for training in the documentation and reimbursement process Mutual aid financial management roles and responsibilities Processing and maintenance of records of expenditures The relationship of federal/state/county/municipal government in financial management
1.0 FINANCIAL AUTHORITIES
Authority to expend funds in emergency management operations is contained in California Statute, county, and city ordinances. In general, emergency operations are funded by the budget allocations of each agency involved. A presidential disaster or emergency declaration will permit funding under the Robert T. Stafford Disaster Relief and Emergency Assistance Act. P.L. 100-707 in addition to the financial resources initiated at the state and local levels. Federal disaster assistance is generally provided at the 75% level with state and local governments sharing the remaining 25%. There is precedent for the federal government to assume a larger share than 75% under unusual circumstances.
2.0 FEDERAL FUNDING SOURCES
Many funding sources provide financial assistance to support preparedness, response, recovery, and mitigation activities. The SAM.gov website is the official U.S. Government system for searching out assistance. Local government’s role in obtaining funding from these sources involves maintaining awareness of the availability of funds, communicating to eligible applicants the availability and processes related to obtaining funds, assisting eligible applicants with applying for funds, assisting fund awardees with project management and financial management where appropriate, and taking action to leverage funds where appropriate to strengthen and sustain the local community. In most cases, local government must partner with state government to obtain funding. In this regard, local government must maintain awareness of and adhere to the processes and procedures set forth by state government to access funds. Local government commonly becomes a contractual sub-grantee to the state.
CEMP Part III
Private Sector Coordination Support Annex December 2025 Part III - 20
PRIVATE SECTOR COORDINATION SUPPORT ANNEX
A private-public partnership (P3) is any type of mutually beneficial cooperative arrangement, informal or formal, between two or more organizations of private industry and the public sector to enhance the life safety, economic security, and resilience of jurisdictions. At the core, a P3 connects people, builds relationships, and breaks down barriers so that representatives from private, nongovernmental, and public organizations know each other prior to an incident affecting their jurisdiction.
The Federal Emergency Management Agency (FEMA) provides guidance on developing the P3 concept within a community. This guidance, entitled “Building Public-Private Partnerships” (July 2021), is based on national lessons-learned offers and offers a step- wise approach to developing this concept is support of disaster related resource needs.
The City Manager’s Office maintains professional positions related to Economic Development and Community Services which develop and maintain relationships within the community on a day-to-day basis.
As part of the ongoing development of the City’s EOC team, the staff members of these divisions have been identified as best suited for the Disaster Service Worker (DSW) role of Private Sector Coordinator(s) within that team.
In an effort to fulfill the responsibilities of this role, the well-networked professionals from these divisions began planning towards the P3 concept in 2023. FEMA’s P3 doctrine describes a process of planning, engaging, integrating, assessing, and refining the pubic- private partnerships within the community. This approach is familiar and normative for the City Manager’s Office, which offers a jump-start position for the City’s EOC team support to field responders.
Lessons learned, coupled with the relationships that were built provide a strong baseline for the further development of the P3 capabilityity of the City. It also informed the City about the utility of what their experience describes as a P4 framework which enhances relationships among and between those other public sector entities that are within their jurisdiction. Relationships and existing legal agreements with these entities are already in place, including the The City Area Recreation and Parks District (H.A.R.D.), Chabot College, and CalState East Bay, among others. Enhancing these relationships and agreement to include disaster response and recovery concepts is “low hanging fruit” and can be leveraged early on in the City’s P3 development efforts.
The City’s Private Sector Coordinators have identified the need to develop general legal agreements templates designed to facilitate discussions with other agencies and the CEMP Part III
Private Sector Coordination Support Annex December 2025 Part III - 21
structuring of pre-positioned emergency contract guidance as developed through the City Attorney’s Office and Finance.
These P3 professionals have talking points about disasters that focus on leveraging locally available resources (equipment, materials, supplies, and personnel) for response and recovery efforts. The importance of this cannot be overemphasized as the combined resources of the community are closer – in both time and space – than outside resources.
This advantage is the goal of the P3 process. Private Sector Coordinators from the City Manager’s Office Divisions of Economic Development and Community services agree that going forward, it should be normative to discuss disaster response and recovery coordination during regular business conversations among the P4 representatives within the area.
Operational agencies with the City have begun to identify those resources, by kind and type, that would be most useful during those incidents that are most likely to impact the City.
P3 relationships – or P4 relationships – provide multiple benefits to all parties. The local Public Safety efforts which are the responsibility of the City are significantly enhanced by local resource support; private sector (and external public sector) agencies in several ways to include the following:
Use of equipment, materials and supplies vs. in situ loss and damage with reduced claims and accountancy related issues.
Use of employees in roles where they are either subject matter experts or well suited toward adaptation to new roles, providing continuing employment. Increased economic sustainability, recovery, and resiliency.
Mutual benefit is derived as the cost-accounting for the whole-community response and recovery efforts is consolidated which provides a clearer picture of economic impacts and helps with establishing whether those impacts reach or exceed the thresholds established for disaster assistance through state and federal government.
CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 22
VOLUNTEER AND DONATIONS MANAGEMENT SUPPORT ANNEX
This annex contains sections of the 2008 Alameda County Operational Area Volunteer Plan. Information contained herein is intended to be useful in understanding the regional perspective on the use of volunteer resources and to suggest a framework for volunteer solicitation and use. The City will continue to develop and refine their concepts of operations as it relates to the use of volunteers during disasters and will reflect those ideas in future updates of this plan.
Donations are not discussed in this annex at the time of the writing of this plan.
1.0 ALAMEDA COUNTY OPERATIONAL AREA
The primary agency responsible for countywide mobilization and deployment of volunteers and service programs is the Alameda County OA. Its responsibilities include the following:
Prepare and maintain this plan and all associated procedures. Coordinate activation, implementation, and demobilization of this Volunteer Coordination Plan
Facilitate and support activation of the call center for countywide volunteer intake and referral.
Oversee registration of volunteers working for county government as Disaster Service Workers.
Provide volunteer intake and referral services for unincorporated communities. Arrange for volunteer intake and referral services for cities unable to activate. Communicate and coordinate with cities in Alameda County for purposes of joint decision-making, sharing of resources and mutual aid.
Coordinate with other agencies and organizations for maximum utilization of limited resources.
Coordinate spontaneous volunteers and service programs to assist the efforts of both governmental agencies and non-governmental organizations throughout the affected communities.
2.0 EDEN INFORMATION AND REFERRAL
In the event of a disaster that affects a significant part of the county or greater area, it may be necessary to initiate a countywide disaster volunteer call center. The OA has identified Eden Information and Referral as the organization to provide a call center. The responsibilities of Eden Information and Referral include:
CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 23
Prepare and maintain call center policies and procedures for disaster volunteer coordination.
Maintain a state of readiness to activate, including designated staff who are prepared and trained, and supplies necessary for operations. At request of OA, activate, manage, and demobilize countywide call center for disaster volunteer coordination.
Proactively identify volunteer opportunities in government agencies and NGOs following a disaster.
Interview prospective volunteers from the community and refer to either an NGO or local government agency.
Coordinate with ALCO OA and cities in Alameda County for effective management of volunteer resources.
3.0 ACTIVATION OF VOLUNTEER COORDINATION PLAN
This Volunteer Coordination Plan will be activated by decision of the Logistics Section Chief, who will inform the Personnel/Volunteers Unit Leader. When the order to activate the plan is given, the Volunteer Coordinator in the EOC’s Personnel/Volunteer Unit will notify as needed those people and organizations tasked with specific implementation roles. These include one or more Emergency Volunteer Center Managers and Eden Information and Referral.
The chief method for referring volunteers is the Emergency Volunteer Center (EVC). The EVC is used to receive, interview, refer and register volunteers. It can be set up as a walk-in center (sometimes referred to as a volunteer reception center), a call center, an online process, or a combination of two or more of these possible models. Each of these models lends itself to one or more of the possible activation levels, as follows:
For local activation, a walk-in EVC is the preferred model; online intake could also be employed.
For multi-city activation, walk-in EVCs are preferred, possibly enhanced by online intake; a multi-city call center could also be considered as an alternative. For countywide activation, a call center is the most efficient model, possibly enhanced by online intake.
This plan provides for three different activation strategies for coordinating spontaneous volunteers. The OA’s roles vary depending on the activation strategy.
CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 24
3.1 Local (Independent Municipal) Activation
Local activation is defined as a city independently establishing an EVC for the mobilization and deployment of volunteers within its boundaries. Theoretically, each city within a county could activate a local EVC.
OA roles for this level include:
Establish EVCs as needed in unincorporated areas of the county. If requested, provide support to any city, including securing mutual aid resources from other jurisdictions.
If requested, arrange for EVC for any city unable to establish one on its own. Provide communication and coordination link among cities.
3.2 Multi-City Activation
Multi-city activation is defined as the operation of an EVC serving multiple cities. At this level, neighboring cities combine and leverage resources to serve a sub-region of the county. Methods of multi-city activation include:
Cities join forces and operate a joint EVC.
Cities co-locate in a multi-city EVC Cities create a “virtual” multi-city EVC by communicating with each other regarding local needs for volunteers and the availability of volunteers.
A multi-city EVC may also include neighboring unincorporated communities.
Proposed multi-city areas and cities to be included in each:
Tri-Cities Fremont, Newark, Union City
Tri-Valley Pleasanton, Livermore, Dublin
North Oakland, Alameda, Albany, Berkeley, Emeryville, Piedmont Central, Hayward, San Leandro
OA roles for this level include:
Establish EVCs as needed in unincorporated areas of the county and cooperate with cities in establishing multi-city EVCs.
If requested, provide support to regions, including securing mutual aid resources from other jurisdictions.
Provide communication and coordination link among regions.
CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 25
3.3 Countywide Activation
Countywide activation is defined as the activation of a single countywide EVC under the aegis of the OA to serve all agencies in Alameda County needing volunteers.
OA roles at this level include:
Establish countywide EVC (call center) by request to Eden Information and Referral.
Establish one or more Disaster Registration Stations to register volunteers who will be working under the auspices of county government as Disaster Service Workers (DSWs).
Provide communication and coordination link among cities. Assist with transition of local and multi-city EVCs to countywide operations.
3.4 Sequence of Activation Strategies
Because disasters vary in terms of their size, scope, duration, intensity and consequences, the choice of activation levels and sequencing of activation levels should be tailored to the incident as well as to the resources available. For example, for a large fire or flood, a countywide EVC (call center) could be established to coordinate volunteer matching from Day One of the incident. For a large-scale or catastrophic event, each affected city might activate an EVC and operate it as long as needed. Then, as needs and resources change, local EVCs could either be folded into multi-city EVCs or a countywide EVC.
To summarize:
For some disasters, all three strategies could be activated over a period of time, starting with local EVCs, then multi-city EVCs and finally a countywide EVC. For other disasters, local EVCs might be established and then transition into a countywide EVC. For still other disasters, a countywide EVC might be the first and only strategy implemented.
4.0 DESIGNATING EMERGENCY VOLUNTEER CENTER LOCATIONS
4.1 Local EVCs
These local EVCs should be established at a location not directly at or near the site of an incident or the OA’s EOC. The ideal EVC location is 1/2 mile or more away from these places, yet close enough for a runner to deliver communications, supplies, etc. The designated location should have adequate space and accommodations for intake and CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 26
registration of volunteers. When searching for one or more possible facilities, take the following characteristics into consideration:
Large room or space for centralized EVC operations Adequate space for intake and registration
Space that allows for relatively easy traffic flow
Separate space (room) for volunteer orientation and training Separate space (room) for staff break area
Accessibility for people with disabilities
Adequate parking
Ease of identifying facility as the EVC
Facility that can be secured
Adequate and accessible restrooms
Capacity for phone/network lines
Potential sites for EVCs in Alameda County’s unincorporated communities are the following:
Castro Valley Library, 20055 Redwood Road
San Lorenzo Library, 395 Paseo Grande
4.2 Countywide Call Center EVC
Most of the criteria above also apply to a call center site. The main difference is that less space is needed because volunteers will be contacted by phone, not in person.
Eden Information and Referral has designated the following sites for operation of the call center:
Eden Information and Referral, 570 B Street, Hayward
Conference Room, Hayward City Hall, 777 B Street, Hayward (alternate site)
4.3 Volunteer Registration Stations
In the event a countywide call center is activated, the OA will need to establish one or more sites for Volunteer Registration Stations, where volunteers who will work under the auspices of county government can be processed and registered as Disaster Service Worker volunteers. The criteria for designating sites for local EVCs above apply also to Volunteer Registration Station sites.
CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 27
5.0 STAFFING
5.1 Local EVCs
The Personnel/Volunteers Unit in the Logistics Section is responsible for initial staffing of local EVCs in unincorporated communities. Most Alameda County Human Resource Services staff have been pre-trained to set up and operate a local EVC. Check with Cal OES Manager for EVC training opportunities. Assigned staff should follow all guidelines and procedures required of civil service workers for the county, including reporting for duty as soon as they have determined the safety of their respective families and homes.
Additional staff can be assigned to work with pre-trained staff (for staffing resources, see Augmentation of Staff in the Administration Section below). In general, when selecting staff to work at the EVC, consider candidates who:
Have good customer service skills Interact regularly with the public Work well under stress and in fast-paced, changing environments Can make quick decisions and exercise good judgment
New staff will require orientation, training for their specific tasks, and supervision. Where feasible, have new staff work side-by-side with experienced staff until they have gained proficiency and confidence in carrying out their assignment. Policies should be established at the outset regarding hours of work, required breaks, shift schedules and other personnel-type issues for all workers in an EVC, both employees and volunteers.
These policies should be determined by the EVC Manager, in consultation with the EOC’s Volunteer Coordinator. Establish some form of identification from the outset for EVC staff – vests, shirts, hats, identification badges, etc. – that will indicate to the public their role at the EVC. Supplemental staffing may also be needed by Eden Information and Referral to implement the countywide call center. To the extent possible, employees available to support the call center should be pre-assigned and pre-trained, following the guidelines above.
5.2 Volunteer Registration Stations
The same considerations for staffing Emergency Volunteer Centers apply to staffing for Volunteer Registration Stations, with one additional but extremely important addition: At least one person staffing a Volunteer Registration Station must be authorized to swear in Disaster Service Workers volunteers. The person authorized by law is the County Clerk, who may deputize other county employees to fill this role.
CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 28
6.0 CONCEPT OF COMMUNICATIONS
This section describes the organization-to-response communication protocols and coordination procedures used during emergencies and disasters. Communication is critical to the successful activation of EVCs and the effective coordination of responsibilities for managing spontaneous volunteers among multiple agencies.
6.1 Relationship between EOC and EVC
A close working relationship between the EVC and its respective EOC (as listed below) is essential to the EVC’s success at each level of activation:
City EOC
Local EVC
OA EOC
Unincorporated Area EVC
Lead City EOC
Area EVC
OA EOC
6.2 Call Center (Eden Information & Referral)
The EOC makes decisions on EVC activation and demobilization and provides significant support in the form of supplies, equipment, staffing and technical assistance to EVCs during operations.
6.3 Other EVC Relationships
The EVC also interacts with other agencies and organizations for a variety of purposes.
Principal among these are government agencies, community based organizations and foundation based organizations, which are the source of disaster volunteer opportunities.
The EVC maintains close communication with local community based organizations, and other organizations as needed.
7.0 COMMUNICATION METHODS
Today’s technology offers a wide array of tools for communicating among organizations during response operations. Tools available to EVCs may vary from jurisdiction to jurisdiction. At a minimum, EVCs should plan for use of telephones and or cell phones for voice communication; fax machines (ideally one for incoming messages and one for outgoing); email; and ham radio and runners as system backups. Even if phone service is disrupted, fax lines and email may still be working.
CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 29
Transmission of forms, charts, data and lengthy or complex text messages is best accomplished via fax or email.
7.1 Communication Protocols
A Communication Protocols tool (see EVC Form 8) has been developed to aid EVCs at all levels. The tool is a chart designed to help EVCs quickly identify who talks to whom, for what purpose, and when—in response to a variety of situations that can occur during EVC activation and operations.
7.2 Communications Coordinator Position
Communications Coordinator is a new position added to the EVC staff lineup as of February 2009. The Communications Coordinator, reports to the EVC Manager, serves as the hub, for incoming and outgoing messages and establishes functional EVC communications equipment. While EVC staff are not required to channel communications through the Communications Coordinator, doing so enables consistent tracking of incoming and outgoing messages, greater ease in sharing of key information, and a full record of operational activity. A Contact List for Disaster Volunteer Coordination with contact information for people, agencies and organizations will enhance the ability to communicate and should be prepared in advance.
8.0 MUTUAL AID
The OA may request mutual aid from other jurisdictions for staffing and other resources to assist with volunteer coordination operations. Requests on behalf of an EVC should be channeled through the EOC in accordance with this jurisdiction’s mutual aid policies and procedures.
9.0 RISK MANAGEMENT
When an EVC refers a volunteer to an outside organization, it limits its exposure to certain risks because the receiving organization assumes responsibility for the volunteer. The EVC staff uses the Volunteer Intake Form to gather enough information to make an appropriate referral. The EVC does not verify the identity or licenses of, conduct background checks on, or perform other screening of a volunteer it refers to another organization; those tasks are the responsibility of the receiving organization.
Alameda County assumes responsibility for any volunteer working under the auspices of the jurisdiction. Therefore, the role of the Volunteer Registration Station is critical for managing certain inherent risk. Potential volunteers should first be screened for suitability. Professional license verification and Department of Justice background checks may be necessary for some functions. As additional protection for the jurisdiction CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 30
and the volunteers, it is strongly recommended that all volunteers involved in disaster- related activities under the direction of this jurisdiction be registered as Disaster Service Worker (DSW) volunteers. Under the guidelines of the DSW Volunteer Program, volunteers who are registered as DSW volunteers must be provided with adequate training and supervision. (See Disaster Service Workers Volunteer Program section below for more details).
Safety is an important component of risk management. Safety of all workers, volunteers, and others onsite is the responsibility of the EOC’s Safety Officer. The Safety Officer must examine facilities to be used for EVCs and Volunteer Registration Stations for unsafe or unsanitary conditions and should address any that exist before such facilities are open to the public. Security in the EVC is the responsibility of the EOC’s Safety Officer. The level of security may vary depending on the type of disaster and other factors. At a minimum, all entering the EVC should be asked to sign in and out. A safe place for EVC staff to store personal belongings should be made available. Security of equipment, supplies and other resources should also be addressed.
Due consideration must be given to the reduction and/or management of stress in the disaster work environment. Stress is an unavoidable component of disaster work. A plan that addresses staff work schedules, breaks, and accessibility to mental health services and Critical Incident Stress Debriefing should be implemented.
10.0 DISASTER SERVICE WORKERS VOLUNTEER PROGRAM (DSWVP) The Disaster Service Worker Volunteer Program (DSWVP) is a state funded program that provides workers’ compensation benefits and medical compensation to registered Disaster Service Worker (DSW) volunteers who are injured while performing disaster related activities or participating in pre-approved training/exercises. It also provides limited immunity from liability to political subdivisions or political entities as well as the DSW volunteer if a civil suit results from an act of good faith while the DSW was providing disaster-related services. Eligibility for the DSWVP is based on a volunteer’s registration with an accredited Disaster Council in accordance with state law. his or her deployment to participate in disaster-related activities, including pre-approved training. The only exception to the pre-registration requirement is an “impressed volunteer” who is directed/ordered to perform disaster-related duties by an authorized government employee. In addition to the pre-registration requirement, the DSW must be deployed/assigned disaster-related activities by the registering authority. Under no circumstances is a self-deployed volunteer eligible for DSWVP benefits.
The State’s laws and regulations governing the DSWVP specify the need to provide DSWs with adequate training and supervision. The registering authority is responsible for ensuring the disaster training is commensurate with the duties of the DSW. The CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 31
registering authority may require the DSW volunteer to participate in training as a condition of remaining an active DSW volunteer. For more information on these and other rules and policies governing the DSWVP, see the Governor’s Office of Emergency Services’ publication entitled “Disaster Service Worker Volunteer Program (DSWVP) Guidance” (available at www.oes.ca.gov under Plans and Publications).
11.0 PUBLIC INFORMATION
Dissemination of information to the public near the onset of a disaster about volunteer opportunities and procedures is critical to successful management of volunteers. In the absence of such messages, people may converge at inappropriate sites and/or engage in activities that place themselves and others at risk. Public information messages may not entirely prevent such behavior. However, they can provide an extremely useful service to those who wish to be helpful.
Once the EVC infrastructure is in place, a release should be distributed to the media in coordination with the Public Information Officer for the incident (see EVC Form 9 for Press Release template). It is recommended that the EVC organizational infrastructure be in place before sending out the first release.
12.0 DEMOBILIZATION
As the level of volunteer activity decreases, those in charge of a local or countywide EVC should prepare to demobilize. An effort should be made to address all outstanding issues and to transfer any unresolved issues to the appropriate staff or department within the county. Lessons learned regarding volunteer coordination should be captured through debriefing of EVC lead staff and preparation of an After-Action Report. The lessons learned should be reviewed and evaluated for inclusion in the Corrective Action process.
A plan for recognizing volunteers (at a minimum, those who rendered services to city government but ideally, all who came forward to help the community) should be developed in advance and executed as part of the demobilization process.
13.0 STANDARDIZATION
The procedures, materials and forms developed for this plan are based on tested plans and best practices from a variety of sources. Use of standardized methods and tools facilitates mutual aid. Ideally, all cities within the ALCO OA, as well as the OA itself, will use the same forms and procedures in establishing and operating EVCs.
CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 32
14.0 FINANCE
Those responsible for staffing an EVC must track all expenses. This is necessary in order to document costs and account for funds expended in order to maximize any reimbursement that may become available.
If requested by OA to activate the countywide EVC call center, Eden Information and Referral will track all expenses and provide the appropriate information to the jurisdiction during demobilization. Any reimbursement will depend on the nature of the agreement between the OA and Eden Information and Referral and on the availability of resources.
15.0 TECHNOLOGY
The predominant use of technology within an EVC will be for computerized input and storage of information about spontaneous volunteers and volunteer opportunities. There are several reasons for creating a volunteer database:
A computerized system enables summaries to be created, for example, a daily count of volunteers interviewed and referred. These can be useful for final reports and also for keeping the media informed.
A computerized system enables EVC staff to search the database for volunteers with particular skills or days/times of availability. For example, three days into the disaster, one could search for people who listed construction skills in order to identify potential candidates for damage assessment teams. A relational database allows automated matching of volunteers with appropriate volunteer opportunities.
The relational database developed by Eden Information and Referral will be used for the countywide call center. Its adoption by cities for use in local EVCs would facilitate information-sharing, consistency of data and overall coordination. A separate database file should be established for each disaster at the time of EVC activation.
Confidentiality and privacy of information are important concerns when developing and using a database.
Highly efficient manual systems should also be developed that serve the same purpose as computerized systems to allow for events where electricity is not readily available.
16.0 AUGMENTATION OF STAFF
In large-scale disasters, or disasters that attract a large number of volunteers, it may be necessary to increase the number of staff of an EVC. The following are possible resources:
CEMP Part III
Volunteer and Donations Management Support Annex December 2025 Part III - 33
Other employees of the county. By state law all county employees are designated Disaster Service Workers and therefore available to be assigned to any aspect of the county’s disaster operations. Those with volunteer management responsibilities, regardless of department, would bring valuable skills and experience.
Employees of other jurisdictions. Request mutual aid assistance from other jurisdictions after fully utilizing your own resources. Spontaneous volunteers who have contacted the EVC. Most people who have some basic skills can be taught to interview other volunteers or to take on other EVC tasks fairly quickly. EVC staff should keep an eye out for volunteer managers, people with interviewing skills, those who work in the personnel/human resources field, social workers, teachers, trainers, etc.
Unaffiliated service program groups. Some of their members may be available for 1-3 weeks or longer. Establishing a relationship with one or more service program groups in advance of the disaster would expedite the process. New staff should be appropriately screened and will require orientation, training for their specific tasks, and supervision. Where feasible, have new staff work side-by- side with experienced staff until they have gained proficiency and confidence in carrying out their assignment.
Policies should be established at the outset regarding hours of work, required breaks, shift schedules and other personnel-type issues for all workers in the EVC, both employees and volunteers. Establish some form of identification from the outset for EVC staff – vests, shirts, hats, identification badges, etc. – that will indicate to the public their role at the EVC.
Comprehensive Emergency
Management Plan – 2025
Part IV – Hazard, Threat, or
Incident Specific Annexes
CEMP Part IV
Table of Contents December 2025
Part IV - 1
TABLE OF CONTENTS
EARTHQUAKE INCIDENT ANNEX.................................................................................... PART IV - 1 HAZARDOUS MATERIALS INCIDENT ANNEX ................................................................... PART IV - 4 EVACUATION ANNEX .................................................................................................. PART IV - 18 CYBERSECURITY ANNEX .............................................................................................. PART IV - 32
CEMP Part IV
Earthquake Incident Annex December 2025
Part IV - 1
EARTHQUAKE INCIDENT ANNEX
The HayWired Scenario is a hypothetical yet scientifically realistic and quantitative depiction of a moment magnitude (Mw) 7.0 earthquake (mainshock) occurring on April 18, 2018, at 4:18 p.m. on the Hayward Fault in the East San Francisco Bay Area, California. The hypothetical earthquake has its epicenter in Oakland, CA and strong ground shaking from the scenario causes a wide range of severe impacts throughout the greater Bay Region. In the scenario, the Hayward Fault is ruptured along its length for 83 kilometers (about 52 miles).
The U.S. Geological Survey (USGS) and its partners developed the HayWired scenario as a tool to enable further actions that can change the outcome when the next major earthquake strikes.
Objectives of the HayWired Scenario were to (1) improve the communication and use of earthquake-hazard science in decision-making, (2) advance basic knowledge of earthquake risks and to inform actions to reduce earthquake risks, and (3) help build community capacity to respond to and recover from earthquakes.
The Scientific Investigations Report 2017–5013 (the Report) and accompanying data releases are the products of an effort led by the USGS, but this body of work was created through the combined efforts of a large team including partners who have come together to form the HayWired Coalition.
The City, as a member of the HayWired Coalition, has placed emphasis on building community capacity to respond to and recover from earthquakes through preparedness activities to include planning, training, and exercises.
Pertinent to the City’s earthquake capability building are the findings from the HayWired Report. These findings are summarized below, organized by those focus areas of most concern to the City’s Public Safety responsibilities.
1.0 AREAS OF CONCERN
1.1 Earthquake Urban Search and Rescue
Throughout the area of impact, it seems realistic that an earthquake like the HayWired scenario mainshock could trap about 2,500 people in 5,000 collapsed buildings. (There are more collapses than occupants, because not every building collapse traps people.) It is reasonable to assume that an earthquake like the HayWired mainshock will cause electric power to go out across the region as utility operators act to protect generators and transmission stability, causing many buildings to lose power before shaking reaches CEMP Part IV
Earthquake Incident Annex December 2025
Part IV - 2
them. Elevator earthquake-safety devices (seismic switches or so-called ring-and-string devices) will therefore not be triggered; it seems possible that more than 22,000 people could be trapped in approximately 4,600 stalled elevators, requiring urban search and rescue personnel—generally firefighters—to free them. The job of extricating more than 22,000 people from 4,600 stalled elevators, along with about 2,400 people from 5,000 collapsed buildings, would fall to the approximately 19,000 firefighters who work in the San Francisco Bay region, at the same time as those firefighters are fighting fires.
1.2 Water Network Resilience
The water-network resilience model is used to estimate damage and restoration to counties served by two water networks in the San Francisco Bay region for the HayWired scenario earthquake sequence - those of the San Jose Water Company (SJWC) and of the East Bay Municipal Utility District (EBMUD). The more seriously damaged of the two networks would likely be EBMUD because of its proximity to the Hayward Fault. In the scenario, EBMUD’s 4,162 miles (6,698 km) of pipe suffer about 1,800 breaks and 3,900 leaks during the earthquake sequence, equivalent to 1.4 repairs per mile of pipe (about
0.85 repairs per kilometer of pipe). More than half of water-pipeline damage results directly from ground shaking (60 percent); the remaining damage occurs from liquefaction (29 percent), landslides (3 percent), and coseismic slip (4 percent) and afterslip on the fault (4 percent). In the HayWired scenario, the average EBMUD customer would be without water for 6 weeks, some for as many as 6 months. The Report provides recommendations to reduce vulnerability to this scenario.
1.3 Societal Implications
The HayWired Earthquake Scenario—Societal Consequences volume examines how the HayWired scenario earthquake sequence could affect recovery of communities, businesses, and regional economies. This includes effects of property damages and water-supply service disruptions, telecommunications, electric power, highway, and Bay Area Rapid Transit (BART) system disruptions.
1.4 Lifeline Infrastructure and Collocation Exposure
Fuel distribution would be impeded by damage to transportation systems, and power outages would make it difficult to pump gas out of the ground at most gas stations in the region (placing further demands on fuel for generated power). Transporting fuel via rail on land or via tankers or barges on water (with a waiver) are suggested as potential solutions to consider in anticipation of a major earthquake.
CEMP Part IV
Earthquake Incident Annex December 2025
Part IV - 3
1.5 Communities at Risk
The “Bay Area Earthquake Plan” estimates that approximately 330,000 individuals would immediately seek sheltering support after a major earthquake on the San Andreas or Hayward Faults (Cal OES, DHS, and FEMA, 2016), and the Bay Area UASI “Regional Catastrophic Earthquake Interim Housing Plan” estimates 400,000 displaced households, of which 160,000 households will still need shelter one year, after a Mw 7.9 earthquake on the San Andreas Fault (Bay Area UASI, 2011). Neither of these plans consider the possibility of widespread fires and extensive lifeline utility disruptions.
In the days and weeks after the Mw 7.0 mainshock of the HayWired scenario, many displaced residents may be able to return to their neighborhoods and homes as access controls are lifted, lifeline utility services are restored, and structures are deemed safe to reoccupy. The occupants of damaged housing units will most likely need alternative, or interim, housing while repairs and rebuilding take place, or until other permanent housing is available.
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 4
HAZARDOUS MATERIALS INCIDENT ANNEX
This annex comprises general response guidelines for dealing with hazardous materials emergencies associated with other events.
1.0 PURPOSE
These Hazardous Materials Emergency Operations Guidelines were established by the Alameda County Mutual Aid Fire Departments to provide a system that is responsive to the needs of the local communities. In the event of a hazardous materials incident that poses any threat to personnel health and safety, the environment, private property or local communities; these guidelines shall be used to meet legislatively mandated response requirements from local, state and federal agencies for responding to and controlling hazardous materials incidents.
The scope of these emergency guidelines is to establish responsibilities for the mitigation of all hazardous material incidents that require a mutual aid response. The responsibilities are to cover the following actions:
Containment and control of hazardous materials to protect life, the environment, and property from their uncontrolled effects and establish the following priorities:
Provide technical and operational coordination to return the site of the incident to normal.
Delineate legislatively mandated areas of responsibility and/or authority for scene management and control of hazardous materials incidents. Establish a verification process for maintaining this plan with required skill levels for effective and safe operations at the scene of a hazardous materials incident.
2.0 PRINCIPLES OF OPERATION
These guidelines follow normal emergency reporting and dispatching systems used for all mutual aid emergencies within the Alameda County area.
The first arriving Fire Department Officer at the incident assumes the position of “Incident Commander” responsible for implementing the “Incident Command System” and determining the Incident Level during the initial size-up. T he Incident Commander will assign crew members to positions according to the level of the incident and the objectives required for control of the emergency until relieved by a higher ranking officer (normally a Chief Officer). This position meets both NFPA’s and OSHA’s requirements for “On Scene Incident Commander.”
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 5
The first arriving personnel will use the structure for Level 1 incidents until a call for assistance (activation of the mutual aid plan) is made and the incident becomes a Level 2 incident. At that time, the expanded ICS structure will be used. The Company Officer (IC) initially filling all of the supervisory functions in a Level 1 incident. The primary function of the crew consists of Site Access Control activities.
Implementation of the Alameda County Hazardous Materials Mutual Aid Response Plan begins with the activation of the Emergency Response System via notification of Lawrence Livermore National Laboratory’s Emergency Dispatch Center of a hazardous materials emergency requiring assistance. The Emergency Dispatcher then responds with the appropriate fire department personnel and equipment as per the Alameda County Mutual Aid Response Schedule for hazardous materials incidents.
2.1 Organizational Structure
The Alameda County Fire Departments have adopted Firescope’s standardized Hazmat ICS structure for management of emergency operations. The Incident Command System shall be implemented at all hazardous materials incidents and must include the identification of the Incident Commander and a Safety Officer. The Incident Commander shall fulfill the role of, and act as the “On-Scene Coordinator” until separate positions are created under a unified command system.
2.2 Responder Positions and Duties
Hazmat ICS Packets and Identification Vests will be used for all Level 2 and 3 incidents.
The Hazmat ICS Packet contains checklists for all the ICS positions and ICS forms required to be filled out during the emergency. ICS Packets are carried in all command vehicles and the Fire Department’s Hazardous Materials Response Unit. In addition, the Hazardous Materials Response Unit carries a bag containing vests for each of the ICS positions. Each vest and ICS Position Packet will be given to the respective Team Leader for his or her position as they are created. Personnel assigned an ICS position are responsible for wearing their vest, performing the functions and completing the ICS forms required of their position as contained in the ICS packet.
3.0 STANDARD OPERATING PROCEDURES
This section outlines the operating procedures of the response personnel to ensure uniformity and standardization of the actions taken during a hazardous materials emergency. The Standard Operating Procedures are comprised of the following elements:
Initial Response
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 6
Assistance
Establishing Incident Levels
Incident Action Plan
Proper emergency response and personnel safety require that a safe approach be made to the incident. This should be from an uphill and upwind direction. Apparatus should be positioned facing away from the incident when possible for rapid escape. The DOT guide setback distances will be used initially for known substances and modified only when determined safe to do so. If at any time there is an indication that a setback distance needs to be increased, then it should be done without hesitation.
Initial Upwind Setbacks for Unknowns:
150 feet – for small incidents (1-gallon to 55 gallon drum, or 1-bag) 300 feet – for residential, light industrial, and trucks with trailers 600 feet – for heavy industrial facilities, railcars, and facilities where hazardous materials are used during manufacturing or processing operations, or the storage of large quantities of hazardous materials is known or suspected.
A small attack line shall be charged and positioned so as to provide emergency protection of personnel at all hazardous materials incidents for which protection cannot be otherwise provided.
The IC will transmit to the Emergency Dispatcher the safe route to be taken by all additional responding resources. IC will also relay product identification information to dispatch.
No responder shall take an offensive action unless they are at least Certified as a Hazardous Materials Technician or they have been trained to perform that specific offensive operation in the required level of personal protection and personnel are available to meet the staffing and safety requirements of the Hazardous Materials Area Plan.
3.1 Assistance
All support personnel and responders shall report to the IC unless otherwise directed. All hazardous materials incidents that involve a confined space problem, materials that may be immediately dangerous to life or health, or that have potential, or will require the donning of a Level A or B suit, shall be immediately upgraded to a Level 2 Incident.
Level 2 incidents require additional support personnel. Additional responding fire service personnel shall be directed to the staging area unless otherwise instructed. In addition to CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 7
Fire Safety personnel responding to the scene of hazardous materials incidents, support personnel may be requested by the IC to respond. Requests for support personnel may vary depending on the material(s) involved and the nature of the incident.
Non-fire department support personnel responding to the scene of a hazardous materials incident need to be directed to the Command Post so that they can be assigned to a position within the ICS. The Command Post will be the vehicle displaying a green rotating beacon light. All key personnel in a Level 2 or greater incident shall be given an “identification” vest, which identifies the person’s roles/position in the organization during the incident. Each person shall also receive a checklist, which outlines key responsibilities and is used Ito document activities.
4.0 LEVEL 1 INCIDENT
An incident that can be handled by the first alarm fire companies or can be contained within a single jurisdiction without the need for mutual aid assistance.
For a Level 1 incident the officer assumes the responsibilities of IC, Operations Chief, Safety Officer, and Hazmat Group Supervisor.
The other crew members of the crew will be assigned functional duties.
For incidents that involve injuries, an ambulance will be dispatched.
The ranking medical provider will be the Medical Group Supervisor and the ambulance crew will be members of the Medical Group, per County EMS policies.
4.1 Level 1 Incident with Gas, Liquid, or Solid Spill and No Victims Upon arrival, the IC shall confirm the identification of the product through placards, labels, reporting party, etc. The IC will consult a minimum of three (3) references (unless they are intimately familiar with the spilled produce) that verifies that the product will not require Level B or higher personnel protection and therefore, will not require a call for assistance for a Level 2 response.
The IC will then assign crew members the proper level of protection and they will perform containment and control functions as assigned.
A Police Officer shall be requested and a Department of Health Services representative summoned for technical assistance and to declare the scene safe for reoccupation (required for public and private occupancies).
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 8
The property owner will be responsible for proper disposal of the materials and supplies for the incident.
4.2 Level 1 Incident with Gas or Liquid Spill and “Ambulatory” Victims As soon as it is determined that there are injuries associated with a hazardous materials incident, an ambulance will be dispatched to the scene. The IC will serve as the Hazmat Group Supervisor. Initial medical management will follow the California State EMS Authority Hazardous Materials Medical Management Protocols manual.
The Hazmat Group Supervisor is responsible for the following:
Establish Site Access Control
Deny entry or exit
Set up zones
Confirm the product’s identification
Lay a line and charge it for protection and emergency decontamination Direct the victims to a safe refuge area
Use wind and terrain
Construct a privacy decontamination shower (if victims need to unclothe Water supplied from an engine
Prepare an emergency decontamination solution, soap and water (Solution E), in a bucket with sponges
Establish an Emergency Decontamination Corridor
Place a decontamination solution for access by victims Place shower if applicable
Assist in patient decontamination if appropriate
Provide emergency coverage with a hose line if needed The person in charge of the paramedic ambulance will be assigned the position of Medical Group Supervisor.
The Medical Group Supervisor reports to the IC and is responsible for:
Assembling emergency rescue equipment
Stokes Litter
Trauma Bag
Resuscitator
Paper Coveralls
Instructing the victims to wash themselves
Ivory Soap or equivalent
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 9
Determining medical significance of exposures
Providing medical assistance as required
Packaging patients for transport
Establishing contact with Medical Facility and Poison Control Center Relaying product identification information to hospital receiving facilities Relaying the type and severity of the exposure(s) to the IC
4.3 Level 1 Incident with Gas or Liquid and “Non-Ambulatory” Victims Liquids present more of a potential secondary contamination problem than gases and the protection of the Decontamination and Medical Personnel should be a main concern.
When it is determined that there are non-ambulatory victims associated with a liquid hazardous materials incident, additional fire department companies will be required and should be dispatched immediately.
A rescue will have to be initiated by an Entry Team with proper personal protective equipment.
If the product is known, then the level of protection required can be determined with the aid of available resources and the rescue performed by log rolling the victims into a stokes litter and placing the letter entirely into the decontamination pool (if needed) supported on plastic 5-gallon buckets. Remember, life safety takes precedence over environmental concerns, and a salvage cover placed over a charged hose line (loop) will serve as an adequate catch basin if nothing else is available.
Emergency Decontamination will be established simultaneously with the rescue effort.
Only water and Decontamination Solution E (Ivory Soap or equivalent) are to be used, unless otherwise specified in the State’s EMS Hazmat protocols.
Victim’s clothing will be stripped and left in the Decontamination Pool and the victims wrapped in blankets. The victims will then be brought to a Treatment Area established by the Medical Group.
The Medical Group will conduct patient evaluation and stabilization as well as any additional packaging and decontamination needed prior to transport using the State Hazardous Materials Medical Management Protocols manual.
If the product is unknown, a sample needs to be sent off to a lab for positive identification.
Personnel protection of the emergency responders will have to be done on a worse case assumption until proper identification can be obtained.
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 10
NOTE: It is very important to verify that the product does not pose an absorption threat and that rescuers are not being placed in a compromised situation.
4.4 Level 1 Incident with Solid Spilled Product & “Ambulatory” Victims The Hazmat groups have the same position responsibilities as with liquids and gases.
Decontamination will be as follows, unless immediate flushing is indicated:
Rescuers shall wear proper eye and respiratory protection. A dry contaminant should not be rinsed off with water until after an attempt has been made to wipe or brush as much off as possible. This includes removing clothing.
Precautions need to be taken to ensure that the product is not inhaled by either the rescuers or the victims. This may be accomplished by using a respirator. Prior to applying a respirator to a victim, the rescuer shall first wipe the mouth and nose areas of the victim in an outward manner.
Patients with an injury that compromises or has the potential to compromise the airway shall not be provided with a respirator after the nose and mouth have been wiped clean of contaminants.
After clothing has been removed and a majority of the product has been wiped off consider rinsing. First obtain a sample of the product and place it in water to see if there is a violent reaction.
If the product reacts violently with water, then use of water should be avoided as long as the patient is not experiencing discomfort.
If discomfort is present, flush with large amounts of water for at least ten minutes unless injuries are life threatening.
It is prudent to delay transport for purposes of flushing a chemical exposure in cases of minor injuries.
Provide containment of the runoff if possible.
4.5 Level 1 Incident with Solid Spilled Product and “Non-Ambulatory” Victims The Hazmat and Medical Groups have the same position responsibilities as with liquids and gases.
Decontamination will be the type provided for solid contaminants unless immediate flushing is indicated.
Rescuers shall wear proper eye and respiratory protection.
Victims will be rescued from the spill area by log-rolling them into a stokes litter and carrying or dragging them to a safe refuge area where EMS can be initiated. Rescuers CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 11
will extricate victims as long as proper protection can be provided to the rescuers. As soon as possible, victims should be decontaminated and brought to a Treatment Area.
5.0 LEVEL 2 INCIDENT
An incident that requires more resources than those that responded to the first alarm, and these additional resources are readily available through the Alameda County Mutual Aid and are expected to be adequate to handle the emergency.
NOTE: A Level 2 incident will activate the Alameda County Mutual Aid Plan. Every alarm level greater that a first alarm receives an engine from the Alameda County Fire Departments with at least two Techs or Specialists, and one of the Valley’s Hazardous Materials Response Units.
The first arriving officer assumes the position of IC until relieved by a chief officer who has been Hazmat IC trained.
A separate position shall be identified for Hazardous Materials Safety Officer. The Hazmat Safety Officer must have training equal to or greater than those performing any work at the incident whether offensive or defensive. Other positions shall be filled as necessary.
Below is a list of the minimum staffing requirements needed to perform work at a hazardous materials incident that involves a confined space problem, materials that may be Immediately Dangerous to Life or Health, or that have that potential, or will require the donning of Level A or B suits:
LEVEL 2 INCIDENT MINIMUM STAFFING REQUIREMENTS
Number Title Training Level
1 Hazmat Group Supervisor Specialist
1 Hazmat Safety Officer Specialist
1 Entry Team Leader Technician
2 Entry Team Technician
2 Back-up Team Technician
1 Entry Team Recorder Operations
1 Decon Team Leader Technician
1 Decon Team Operations
1 Site Access Team Leader Operations
2 Technical Reference Technician
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 12
6.0 LEVEL 3 INCIDENT
An incident that requires more resources than those that can be readily obtained. For Level 3 incidents, the first arriving officer assumes the position of IC until relieved by a chief officer who has been Hazmat IC trained.
Separate positions shall be created for the Hazmat Group Supervisor, Incident Safety Officer, and the Hazmat Safety Officer.
The Hazmat Safety Officer shall have equal or greater training than those performing any work whether offensive or defensive.
Other positions shall be filled as necessary.
NOTE: A Level 3 incident will normally require more resources than are readily available in the area.
7.0 INCIDENT ACTION PLAN
After initial ICS positions have been created and an initial assessment of the incident has been conducted by the key personnel, an Action Plan meeting will be conducted by the Incident Commander where an Incident Action Plan will be developed. Issues to be included in the development of the Incident Action Plan include the following:
Safety Plan
Hazard Identification
Site Control
Establishing Control Zones
Selecting Levels of Protective Clothing
Entry Team Operations
Decontamination Team Operations
Medical Plan Development
Clean-up and Disposal Plan Development
7.1 Safety Plan
The Hazmat Safety Plan addresses the following issues and is developed by the Hazmat Safety Officer:
Secondary means of egress from the Hot Zone
Review of Safety Hand Signals
Radio check of Entry and Backup Team radios
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 13
Identification of a Site Safety Officer and a Hazmat Safety Officer Identification of an EMS Group or Medical Monitoring Group Confirmation that Decontamination is in place prior to entry Time limit for Entry Team to be in the Hot Zone
Placement of an Emergency Decontamination hose line
Location and placement of personnel and equipment on scene
7.2 Hazard Identification
Identification of the material is critical in forming an Action Plan. In most cases identification will be possible through shipping papers, placards, labels, container shape and type, and information given by those who have knowledge of what is involved.
All standard means of identification shall be exhausted before any attempt shall be made to obtain a sample of an unknown.
For incidents where no identification is possible, a sample shall be taken and the 5-Step Field Identification System will be used to determine if the material poses a threat to personnel or qualifies as an emergency situation.
Since obtaining a sample of an unknown requires contact with the product, the minimum level of protection for sampling personnel will be Level B, and minimum level of training shall be Certified Hazardous Material Technician.
7.3 Site Control
Site Control is established by isolating and controlling entry/exit. The purpose of site access control is to control the movement of people into and out of the spill area and to limit the potential for increased spread and exposure to the spilled produce and also monitoring the spill for indications of spread. Site Access Control is established by setting up Control Lines (barrier type) and establishing Control Zones.
All Alameda County Fire Department members are trained at the First Responder Operations Level and are trained to perform Site Access Control. If the demands of the Site Access Control are extremely critical to the operation, site monitoring will be performed by Hazardous Materials Technicians, Specialists or County Health Department Hazmat members.
7.4 Establishing Control Zones
Control Zone Definitions:
Hot Zone (Exclusion Zone)
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 14
The Hot Zone is the area where contamination does or could occur. It is delineated with a red barrier tape. Entry into the Hot Zone requires the proper level of personal protective equipment. The primary activities performed in this zone are:
Rescue
Control and Containment
Size Characterization
Sampling
Warm Zone (Contamination Reduction Zone)
The Warm Zone is the transition zone between the Hot and Cold Zones. It is where the Decontamination Corridor is located (the zone where decontamination takes place) and is designed to reduce the possibility of spreading contamination to the Cold Zone. It needs to be large enough to set up a Decontamination Area. The Warm Zone is delineated with yellow barrier tape and is the first zone established. All unauthorized personnel shall be evacuated from within this area (an exception would be the Media, see Isolation Perimeter below).
Cold Zone (Support Zone)
The Cold Zone is located adjacent to the Warm Zone and is free of any contamination.
This is the only zone where protective clothing is not required. The Command Post, equipment and support personnel are staged in this area.
Decon (Decontamination) Corridor
The Decon Corridor is the area between the Hot Zone Control Line and the Warm Zone Control Line where decontamination of personnel and equipment takes place. Entry Teams enter and exit the Hot Zone through the access control points that are located at each end of the Decon Corridor. The Decon Corridor is delineated with traffic cones.
Isolation Perimeter/Crowd Control Line
If crowd control becomes a problem, an Isolation Perimeter (Crowd Control Line) can be established by placing green barrier tape around the Cold Zone and keeping all non- emergency personnel outside the line. The media however, cannot be excluded from entering an incident (including a Warm or Hot Zone) unless they are damaging a crime scene or are endangering the health and safety of the public by their actions. They will however be subject to the same contamination control requirements as the other emergency workers within the zone they enter.
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 15
7.5 Criteria for Establishing Zones
The initial control zone to be established will be the Warm Zone by placing yellow “Warm” Zone Control Line barrier tape around the incident. People will be evacuated from any area within this zone.
Isolation
No person shall exit or be removed from a Hot Zone until they have been properly decontaminated or it has been confirmed to be safe to remove them without first being decontaminated.
No person shall be allowed into a Warm or Hot Zone without the proper level of personnel protective equipment as specified by the Hazmat Group Supervisor.
No person shall enter a Hot Zone prior to the establishment of a Decontamination Area.
Once entry has been made into the Hot Zone, no one who remains in the Warm Zone will be allowed to exit into the Cold Zone until they have been decontaminated or checked for contamination.
Safe Refuge Area
Contaminated victim shall be staged in a “Safe Refuge Area” of the Hot Zone until emergency decontamination can be initiated. This will be a temporary holding area set up to control the spread of contamination by personnel movement until the victims and personnel can be decontaminated. It will be located away from the dangers of the spill or its associated hazards in an area with the same exposure potential as found in the Warm Zone. This area shall be designated with cones if possible.
Evacuation and Crowd Control
Evacuations and crowd control functions should be delegated to the local law enforcement agency whenever possible, under the guidance of the hazardous materials technical experts. Evacuations should be performed whenever there is a chance that product concentration will exceed permissible limits or amounts which will cause harm to the public at large.
Immediate evacuations are performed in areas where the people are the most endangered first, followed by planned evacuations of areas where harmful effects will only occur after some period of time. The figure below shows the initial areas that should be considered as Immediate Evacuation areas and Planned Evacuation areas.
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 16
7.6 Entry Teams
The Entry Team objectives vary depending on the situation and the order of tasks as identified in the Incident Action Plan. They may include the following tasks to be conducted in the Hot Zone:
Product Identification
Obtaining Samples and Monitoring
Control and/or Containment
Site Characterization Rescue
All entries that require Level B or A personal protective suits shall be done using the “buddy” system and must have an equal number of rescuers in the same level of protection assigned as the “Backup Team.”
While the Decon Team is setting up a Decontamination Area, the Entry and Backup Teams will be preparing for entry.
Following is a list of the activities of the Entry and Backup Teams:
Entry Plan Briefing Equipment Layout
Medical Monitoring of Team Members
Donning of Personal Protective Equipment
Equipment Checks and Safety Procedure Review
Entry into the Hot Zone
Exit from the Hot Zone
Decontamination Teams
The purpose of Decontamination is to safely remove Entry Team members from their suits and to prevent contamination from being spread into clean areas. Once personnel enter a contaminated atmosphere their protective clothing becomes contaminated, and they must stay within this envelope until the contamination has been isolated.
In the event a person enters a toxic atmosphere, and due to a physical or equipment problem, must leave the contaminated area, a team must be set up to handle the situation immediately to protect the individual. Depending on available staffing, some members of the Decon Team may have the duties of more than one position. It’s best however, that Decon personnel stay at their respective station.
CEMP Part IV
Hazardous Materials Incident Annex December 2025
Part IV - 17
Emergency Decontamination
When an immediate rescue is encountered, the Decon Corridor needs to be designated and decon will be accomplished in the Emergency Decontamination Area.
Special Decontamination
Some types of contamination will require a decontamination process that differs from the traditional “wet” decon. In this case of dry, water reactive contaminants, a dry decon procedure needs to be used. This process may vary depending on the specifics of the incident.
Technical References and Resources
Below, is a list of technical reference and resource materials relating to hazardous materials incidents:
Coast Guard CHRIS Condensed Guide to Chemical Hazards (thick red and book) NIOSH Pocket Guide to Chemical Hazards
Material Safety Data Sheets
Emergency Action Guides American Association of Railroads ACGTH Guidelines for the Selection of Chemical Protective Clothing CAMEO RIDS stack
National Safety Council (written by NOAA) CAMEO version 3.0 Manufacturer's Information Sheets (come with suits)
NFPA Fire Protection Guide On Hazardous Materials Section 325M Handbook of Reactive Chemical Hazards (3rd Ed) L. Bretherick Butterworths
NFPA Fire Protection Guide On Hazardous Materials Section 491 M NFPA Fire Protection Guide On Hazardous Materials Section 49 National Safety Council (written by NOAH) CAMEO version 3.0 The Merck Index Encyclopedia of Chemicals and Drugs Merck & Co. Inc. The Condensed Chemical Dictionary Gessner G. Hawley
Van Nostrand Reingold Co. ISBN 0-442-23244-6
Grant and Heckl's Chemical Dictionary (5th Ed) Roger Grant, Claire Grant Handbook of Compressed Gases
Matheson Gas San Leandro
EMERGENCY CARE FOR EXPOSURES
Emergency Care for Hazardous Material Exposures
Pocket Guide to Tank Car I.D. Southern Pacific Railroad NFPA Fire Protection Guide On Hazardous Materials Section 704M CEMP Part IV
Evacuation Annex December 2025
Part IV - 18
EVACUATION ANNEX
1.0 INTRODUCTION
This operational procedure will be used by agencies and organizations in the City to manage and coordinate evacuations in response to any hazard which would necessitate such actions. This document defines the scope of procedure, details the concept of operations and assigns responsibility for implementation.
1.1 Purpose
This procedure establishes a consistent operational methodology for the City to plan for and implement evacuations, regardless of the geographic area in which they occur. The availability of consistent city-wide procedures facilitates an adequate understanding on the part of all agencies, organizations and levels of government regarding their responsibilities during an evacuation, and establishes uniform operational techniques through which those responsibilities can be fulfilled.
This procedure applies to all City Emergency Response Team personnel and local emergency and response agencies tasked with planning for and implementing evacuations. Implementation of this procedure is under the direction of the Director of Emergency Services, through the City EOC. This procedure defines the circumstances under which evacuations in the city may be necessary. It also defines the roles and responsibilities of local response agencies.
1.2 Authorities
This annex is adopted as an operational element of the City’s Comprehensive Emergency Management Plan, and is incorporated by reference thereto. As such, it is intended to be consistent with and supportive of the Comprehensive Emergency Management Plan, and to be implemented, when needed, with the same authorities under law as provided therein.
2.0 CONCEPT OF OPERATIONS
This section describes the concepts and provisions through which the EOC will determine the need for, and implement, an evacuation. The concept of operations for this procedure provides guidance and structure for both the planning and implementation of evacuations.
The procedure relies on effective preplanning for evacuations as well as the implementation of established plans accordingly.
CEMP Part IV
Evacuation Annex December 2025
Part IV - 19
2.1 Assumptions
Activation of this procedure will occur for all hazards which could necessitate evacuation and sheltering operations involving all or parts of the City. However, the need to implement certain aspects of the procedure, such as opening shelters in non-threatened areas or terminating evacuations and opening refuges-of-last- resort, may vary based on the specific hazard, degree of vulnerability, and projected area of impact.
The evacuation of large numbers of people from vulnerable areas will stress the limited capabilities of roadways available for this purpose, potentially requiring substantial additional time to complete an evacuation. Consequently, an evacuation must be initiated as soon as feasible upon recognition of the threat, and must continue to function efficiently until completion. Evacuations will require a substantial level of personnel and equipment resources for traffic control, which could stress and/or exceed the capabilities of the City.
Specific procedures may be developed regarding the pre-deployment of mutual aid personnel and equipment resources to as required.
Coordination between the OA and the City in the implementation of an evacuation will occur through exchanges of information regarding decision-making, protective actions, and resource coordination and deployment.
The capacity of available public evacuation shelter facilities in and adjacent to the impacted areas may be limited, potentially requiring the full use of all shelters within the evacuation region. A high level of coordination will be necessary to effectively communicate protective action and shelter information to evacuees. For certain hazards, large vulnerable populations and limited evacuation road networks may necessitate termination of evacuations prior to full completion and evacuees still at risk would need to be directed to refuges-of-last-resort as quickly as possible.
An evacuation will require expedited coordination of all City departments to maintain an efficient and safe movement of evacuation traffic out of the impacted areas and to adequate shelter locations.
2.2 Pre-positioning Resources
Implementation of an evacuation will require substantial personnel, equipment and supplies at various locations along the evacuation routes and at facilities designated as shelters. Further, mutual aid resources necessary for initiating and sustaining the evacuation process may need to be pre-positioned prior to or concurrently with the Director’s emergency declaration. Therefore, the incident action plan must include procedures regarding the pre-deployment of resources, the agencies involved, and the coordination process that will occur.
CEMP Part IV
Evacuation Annex December 2025
Part IV - 20
Pre-positioning City law enforcement personnel in support of local traffic management plans should occur consistent with the resources available and the magnitude of the event. Upon implementation of this procedure, the City EOC will instruct the responsible agencies to pre-position resources as specified in the Incident Action Plan or as agreed to during local coordination conference calls.
Agencies should consider the following pre-positionsd resources during the development of evacuation procedures:
Electronic programmable message boards
Portable AM / FM radio transmitters
Tow trucks
Gasoline tankers at stations along regional routes
Ambulances and medical personnel
Shelter management personnel
Buses for transport of evacuees without other means
In order to effectively manage an evacuation, it is essential that every involved agency and organization have timely and accurate information regarding the current characteristics of the evacuation, support operations, resource availability, and the hazard itself. Therefore, a process for routine communications and coordination should be initiated by the City EOC and all other involved EOCs upon determining that an evacuation must be implemented.
Immediately upon the decision to implement an evacuation, all affected agencies and organizations will use the Incident Action Plan provided by the City EOC, as a guide to communicate information to the City EOC at regular intervals. Examples of such information regarding evacuations could include:
The characteristics of the hazard and associated events The designated evacuation area, initiation times and resource mobilization status The progress of resource pre-deployment
The status of evacuation routes
The status of available public shelter and hotel/motel space by location Assessment of the need to terminate the evacuation prior to full completion Estimated time of evacuation completion
3.0 OPERATIONS
The staff of the City’s EOC will monitor hazardous situations as they develop. Regular conference calls will be held between the OA EOC, other potentially affected city EOCs CEMP Part IV
Evacuation Annex December 2025
Part IV - 21
(risk and host) and appropriate state and federal agencies as to the degree of threat to the City and the potential for escalation. In addition, the City EOC will coordinate with local agencies as to whether the hazard will require coordination and implementation of protective actions including evacuations across multiple jurisdictions. If so, the City EOC and potentially affected jurisdictions’ EOCs will begin implementation of the evacuation process.
The City EOC will coordinate and reach consensus on the area(s) most likely to be impacted. The City’s EOC will then notify all agencies potentially involved in the response, and request that the Director declare a Local Emergency. Working together, the City and other affected agencies and organizations will then initiate the evacuation in accordance with the provisions of this procedure, including the pre-deployment of personnel and equipment resources, if applicable.
Under circumstances involving evacuations of multiple areas, the Director may recommend to the OA that a county-directed evacuation is necessary. At the Director’s discretion, language may be included in the Director’s Declaration identifying mandatory evacuations and directing a coordinated response from the City’s EOC among all local response agencies. County direction of the evacuation may also occur when some or all of the following conditions are present:
In support of evacuations, response operations including sheltering, traffic management, and emergency public information may be required in areas not threatened by the hazard;
Multiple jurisdictions will use a limited number of evacuation routes necessitating central coordination and direction;
The threat will necessitate evacuation of large numbers of people, requiring the coordination of emergency operations among two or more counties; The Director has issued a Declaration of a Local Emergency; and The City’s Comprehensive EOC has been activated.
[Note: This list is not exclusive; rather it is intended to provide guidance as to when County-directed evacuations may be necessary.]
The City’s EOC will monitor the progress of the evacuation and exchange information on an established time schedule to promote effective coordination by all involved. Through this procedure, the City and OA EOCs will coordinate the efficient deployment of resources when needed, efficient use of available evacuee shelter capacity, and effectively address modifications to evacuation routes, if necessary.
CEMP Part IV
Evacuation Annex December 2025
Part IV - 22
In order to effectively implement an evacuation, this procedure requires pre-hazard planning by all parties, pre- event coordination, consistent implementation strategies, and post impact assessments.
Immediately preceding an event that may necessitate an evacuation, and under a Local Emergency declared by the Director, the City may implement response efforts through the pre-positioning of resources. The City will coordinate with the OA EOC regarding the dissemination of appropriate public information.
During implementation, local response agencies will monitor the progress of the evacuation and exchange information on the level of traffic on routes and the use of public shelter space. Ongoing public information will be provided through the broadcast media to inform the evacuees of any change in evacuation routes, the availability of hotel and public shelter space in host jurisdictions, and similar information.
After the threat has passed, the City’s EOC will coordinate with other affected areas to develop a re-entry traffic management plan. Post-event activities will also include a review and critique of the evacuation and associated procedures to determine the need for any modifications. The post-event critique should consider the need for more training or exercises to improve the capabilities of response personnel to implement this procedure.
4.0 PLAN ADJUSTMENTS
During an evacuation, for a wide variety of unanticipated reasons, it may become necessary to adjust or modify procedures stipulated in the Incident Action Plan. The most readily apparent reasons for such modifications could include, but are not necessarily be limited to, the following:
Changes in the direction or intensity of the hazard;
Blockage or excessive vehicle congestion on an evacuation route; Filling of available capacity at public shelters and hotels/motels in host areas; Anticipated failure to complete the evacuation prior to hazardous conditions impacting evacuees.
If alternative routes, actions or resource deployment can be pre-planned to address these possibilities, appropriate procedures will be included in the Incident Action Plan. For other situations that cannot be anticipated during the planning of an evacuation, the City’s EOC will work with all relevant agencies at the time to make adjustments in the evacuation.
CEMP Part IV
Evacuation Annex December 2025
Part IV - 23
In the event of a physical blockage of an evacuation route, the EOC will coordinate with the OA, as necessary, to remove the blockage. If removal is not feasible, the City’s EOC will coordinate with all affected EOCs to plan and implement alternative routing.
An evacuation will generate impacts outside areas immediately at risk and may necessitate the use of local resources in non-threatened areas to support the response.
The City’s EOC will determine whether activation of response operations in designated host areas outside the immediate area of impact is necessary. If so, the City’s EOC, in conjunction with the Director’s Declaration, will direct the assistance of any or all local agencies, and request as needed adjacent agencies, to support the evacuation as follows:
The City’s EOC may request that the OA direct host areas to implement protective actions in support of evacuations in risk areas. All EOCs within designated host areas may be requested to activate and prepare to initiate host response plans. All jurisdictions within designated host areas may be included in any Governor’s Declaration of a State of Emergency and all requests by the Governor for emergency disasters and major disaster declarations.
The OA may be requested to coordinate traffic management issues with local law enforcement from within host and risk areas and with the highway patrol and CALTRANS, when necessary.
In support of host response operations the City’s EOC may request, at a minimum, that the OA make the following information available to host areas, including those in other counties, on a continuous basis or when warranted by the situation:
CALTRANS real-time traffic counter data for roads within the host area or on all roads leading into the area;
Traffic Reports from CALTRANS, local news organizations and the highway patrol;
Any significant changes to the situation in adjoining counties that may have an impact on host sheltering operations;
The content of any public information released by other agencies.
5.0 PUBLIC INFORMATION ACTIONS
The following tools are of use in communicating emergency information to evacuees en route:
Pre-developed messages for release to the media;
Placement of variable message signs and procedures for updating messages; Placement of portable radio transmitters and procedures for updating messages; CEMP Part IV
Evacuation Annex December 2025
Part IV - 24
Providing maps, fliers or other shelter information to law enforcement / traffic control personnel, and at other key locations along major evacuation routes (restaurants, gas stations) both prior to and during the event; Integrating county public information operations with California Highway Patrol and CALTRANS public information officers.
Public information should include shelter locations, shelter openings and closings; and directions to the shelters from major evacuation routes. Other actions to ensure the public understands their role in an evacuation include:
Ensuring hotel /motel capacity and status information is incorporated into emergency public information procedures:
Coordinating and communicating refuge-of-last-resort procedures to address the possibility that evacuees may be stranded on evacuation routes within the area; Exchanging critical information with all agencies within the area via conference calls.
The City EOC will notify the Operational Area EOC of the estimated time of completion of the evacuation within the city, and subsequently, when the evacuation has been completed.
6.0 RE-ENTRY
Following an evacuation, the process for re-entry into the evacuated areas must be coordinated to ensure the safety of the public, protection of property, and effective response of the numerous organizations and jurisdictions involved. This procedure anticipates that the re-entry decision and traffic management will be a carefully managed process coordinated by the City’s EOC.
Throughout the re-entry process, the EOC Law Enforcement Unit will facilitate coordination conference calls with local law enforcement and transportation agencies to include all risk and host areas. These calls will serve as a mechanism to coordinate the timing of re-entry into impacted areas and the resources necessary to support the efforts.
In addition, the Public Information Officer will facilitate similar calls with other organizations and agencies as well as county public information officers to coordinate the dissemination of consistent information to risk and host areas. Additional re-entry procedures are included in the Incident Action Plan.
7.0 RESPONSIBILITIES
This section describes the general responsibilities of the principal players expected to participate in the implementation of an evacuation pursuant to this procedure. The intent CEMP Part IV
Evacuation Annex December 2025
Part IV - 25
of this section is to explain only the general framework for accomplishing the tasks necessary to implement this procedure. Additional duties and responsibilities of individual agencies and organizations will be defined in the Incident Action Plan.
7.1 The City of Hayward Emergency Services Coordinator
Periodically, the City’s Emergency Services Coordinator will coordinate with all agencies to ensure that they are adequately prepared to implement an evacuation. To assure this preparedness, the Emergency Services Coordinator will undertake the following duties:
Support agency planning efforts through necessary meetings and training sessions;
Solicit the involvement of other agency and organization representatives in the planning process where necessary;
Fulfill the City’s role in developing and presenting the necessary public information programs to support implementation of this procedure, promoting and assisting as needed the local public information programs;
Review this procedure and provide training to appropriate City EOC staff; When appropriate, use the procedure during the annual county-wide earthquake exercise, Department of Energy Site joint exercises, and other training opportunities to promote improved understanding of its operational concepts at the local level; and
Ensure that all agencies and organizations have an up-to-date copy of this procedure.
7.2 Emergency Operations Center
During the implementation period of an evacuation, the City’s EOC will have the following responsibilities:
Coordinate with OA EOC to ensure that all known impediments to facilitated traffic flow along evacuation routes have been removed, closed or otherwise addressed; Continually monitor the direction, intensity, and potential for escalation of the hazard;
Continually compile information from each agency;
Provide resources to assist in the implementation of the evacuation; Prepare and release appropriate public information in concert with the OA EOC and respond to inquiries from the affected population;
Continually monitor the progress of the evacuation;
CEMP Part IV
Evacuation Annex December 2025
Part IV - 26
Determine if the evacuation will be completed prior to impact of hazardous conditions on evacuees or if changes to currently implemented procedures are indicated;
Upon notification from one or more agencies that an evacuation route has been blocked, develop corrective response(s) in cooperation with the OA EOC(s) with responsibility for the affected portion of the route;
If the evacuation is to be terminated prior to completion, secure the Director’s concurrence and instruct agencies to implement actions for termination. Coordinate media releases and public information broadcasts with the media to instruct evacuees to seek refuges-of-last-resort;
Mobilize response personnel to provide medical, search and rescue, transportation and shelter services, and other needed resources to impacted evacuees promptly after the hazard has passed;
Assist areas where refuges-of-last-resort have been utilized in securing the necessary resources and personnel;
Take other such actions during evacuation implementation as may be indicated by the circumstances.
Using the Incident Action Plan and coordination conference calls, identify the point when each involved agency and organization has judged the evacuation within their area to be complete
Notify all agencies of the time of completion of the evacuation process, to initiate demobilization of appropriate personnel;
Issue appropriate public information regarding the completion of the evacuation, the shelters opened, etc.
8.0 AFTER-ACTION ASSESSMENT
The Emergency Services Coordinator will arrange for an after-action assessment of the event and evacuation operations to address the following:
The effectiveness of this procedure and any indicated changes needed; The timeliness and technical validity of the decision to implement an evacuation; The adequacy of the personnel, equipment and supply resources available and the timeliness of their mobilization, as well as the responsibility for taking any corrective action;
Any additional training and/or exercise needs in evacuation planning as indicated; The effectiveness of the public information used and the appropriateness of public behavior; and
Any other circumstance or condition that indicates a need for modification of plans and procedures or the provision of additional resources.
CEMP Part IV
Evacuation Annex December 2025
Part IV - 27
Following such an assessment, the Emergency Services Coordinator will provide coordination to assure any corrective actions indicated are implemented in a timely manner.
9.0 ALL AGENCIES
In order to maintain the capability of effectively implementing an evacuation, all agencies and organizations that support emergency operations, working under the coordination of the Emergency Services Coordinator, will accomplish the following:
Participate in and support, as appropriate, evacuation planning efforts; Provide information regarding the City’s available personnel, equipment, facilities and supplies to facilitate the implementation of evacuations; Review appropriate state and local procedures to ensure adequate understanding of the City’s responsibilities and commitment pursuant to each potential hazard; Integrate the responsibilities and operational concepts defined here into the agency’s other emergency plans and procedures;
Provide and/or participate in training regarding the implementation of evacuation procedures;
Maintain preparedness to implement the City’s responsibilities when events necessitate or the Director calls for an evacuation;
Upon the Director’s decision to implement an evacuation, conduct local operations to support the evacuation in accordance with these procedures and other plans and procedures used by the OA EOC; and
Participate in after-action evaluations and assessments of these and other local procedures.
10.0 MAINTENANCE OF THIS ANNEX
Periodically, the City’s Emergency Services Coordinator, working through the designated OA Coordinator as needed, should take the following steps to ensure that this procedure is maintained:
Ensure that evacuation planning meetings are convened and that, at a minimum, participants complete the following activities:
Review the existing evacuation procedures for all hazards to ensure continued accuracy and validity, and make any necessary modifications; Review the availability of evacuation routes, public shelters and hotel/motel capacities for all hazards, and modify as needed;
Determine the need to develop additional procedures;
CEMP Part IV
Evacuation Annex December 2025
Part IV - 28
Ensure that training in this procedure has been made available to all relevant agencies.
Consider simulated implementation of this procedure as a part of the annual county-wide earthquake exercise, Department of Energy Site joint exercises, and other training opportunities;
Modify this procedure accordingly;
Review all public information materials to ensure their adequacy to support and facilitate an evacuation anywhere in the City;
Identify any state or federally, as well as locally sponsored construction projects that may significantly decrease the capacity of any designated evacuation route; coordinate with the involved agencies to evaluate and define feasible alternative actions in the event of an evacuation along that route; and Provide training for the City EOC staff in the use and implementation of this annex
11.0 EVACUATION PROTOCOL
The implementation of an evacuation will occur through three operational phases:
1. The Decision Phase is initiated when the EOC, the Unified Command leadership and threatened areas determine that implementation of evacuations of vulnerable residents is necessary to preserve life. Tasks identified in this phase will be implemented prior to the initiation of an evacuation.
2. The Evacuation Phase is initiated at the time the decision to implement an evacuation is finalized. Tasks identified under this phase are implemented throughout the evacuation process until the evacuation is completed.
3. The Re-entry Phase begins immediately following the completion of an evacuation. Tasks identified in this phase will be implemented as hazardous conditions abate and continue until the re-entry process is determined by the EOC to be complete.
11.1 Decision Phase
The EOC Manager will coordinate with the Unified Command leadership, as well as potential risk areas to determine whether an event impacting or threatening the City could necessitate an evacuation. Upon receiving a recommendation from the Unified Command that a regional evacuation may be necessary, the following actions will be implemented:
The EOC will coordinate with potential risk and host area EOCs regarding identified vulnerable areas, populations at risk, available evacuation routes, and possible host sheltering destinations;
CEMP Part IV
Evacuation Annex December 2025
Part IV - 29
EOC staff will coordinate with local agencies regarding evacuation and sheltering resource needs;
The EOC and will continually monitor the event for changes that may affect the in movement of evacuees and potential impacts to evacuation and sheltering resources;
The EOC and will coordinate the release of emergency public information through the EOC Public Information Officer and conference calls; Field units will identify and communicate to the EOC any issues that may impact the implementation of an evacuation or sheltering operation (holidays, high tourism season, roadway construction, etc.);
The EOC will notify the Alameda County OA of the potential need for an evacuation and ensure that a Local Emergency and all necessary emergency ordinances and resolutions are in effect;
The EOC and will activate emergency information telephone lines, if necessary, to respond to inquiries from the affected population;
The EOC will notify the OA of potentially impacted risk and host areas;
11.2 Evacuation Phase
Upon reaching a decision by the Unified Command and threatened areas that an evacuation and sheltering operation must be initiated, the following actions will be implemented:
The EOC will instruct agencies to begin pre-positioning personnel, equipment and supply resources to support local operations (this may occur during the Decision Phase if events warrant);
All affected agencies and organizations will coordinate and finalize designation of risk and host areas involved in the evacuation;
The EOC will make estimations regarding initiation time for the evacuation and notify all affected agencies and organizations accordingly; The EOC will mobilize all necessary resources, direct the use of resources in non- threatened areas (if necessary), and coordinate deployment of available mutual aid resources to support the implementation of the evacuation and sheltering operation;
The EOC Public Information Officer will continue to coordinate the release of emergency public information through public information conference calls; the EOC will support local efforts to provide emergency information to vulnerable residents by all available means;
Risk and host areas will be identified by the EOC, and when the evacuation is completed for that area; the EOC will relay this information to all affected agencies and organizations;
CEMP Part IV
Evacuation Annex December 2025
Part IV - 30
The EOC will support local law enforcement agencies with security for evacuated areas. All non- emergency access to evacuated areas will be denied during this phase.
11.3 Re-entry Phase
Following an evacuation, the EOC and the Unified Command leadership will coordinate regarding the suitability and feasibility of allowing re-entry into evacuated areas. The decision to allow re-entry into impacted areas following an evacuation will be made jointly by the EOC, City Manager, Law Enforcement and the Unified Command. Re-entry traffic control will be directed by law enforcement, with support and coordination provided through the EOC. Re- entry will not be allowed until the Unified Command agrees that conditions within evacuated areas are favorable for residents to return.
Upon completion of initial impact assessments, appropriate agencies will initiate the actions listed below to develop and implement a re-entry plan:
The EOC will facilitate re-entry coordination conference calls with all affected risk areas, host areas, and the Unified Command and identify which, if any, evacuated areas are in a condition to permit re-entry;
The EOC, as well as other relevant City agencies, will provide to Director information on the condition and accessibility of designated evacuation routes; The EOC will coordinate with appropriate county and state agencies to map the regional routes available for re-entry into evacuated areas, identify traffic control resource needs, and prepare a re-entry traffic management plan; The EOC will coordinate with the OA EOC to identify the impact in areas throughout the planning process and support agency and organization planning efforts for re-entry traffic control within its jurisdiction; The EOC will finalize the re-entry plan as needed and initiate traffic control resource mobilization based on agency and organization input; The EOC will coordinate re-entry times into each risk and host area and arrange for publicly announced re-entry;
The EOC PIO will prepare and release consistent, appropriate public information regarding the time re-entry is to be allowed, the areas opened, and the routes to be used by returning residents; and
The EOC in conjunction with local law enforcement will monitor re-entry traffic on a city-wide basis, identify any needed adjustments in the re-entry plan, and take corrective action.
12.0 EVACUATION METHODOLOGY
CEMP Part IV
Evacuation Annex December 2025
Part IV - 31
Generally, an event that may require evacuation would be fairly isolated and would require only a portion of the population to be moved. However, there is always the possibility that a catastrophic event (e.g. a major earthquake and resulting fires/damage, a large chemical or hazardous materials release, etc.) could occur that would involve a large-scale evacuation of one half or more of the population. In any case, a mass movement of a concentrated, large number of people will severely stress roadways in and around the City.
The City will respond to each situation requiring evacuation on an individual basis using the protocols listed in this Annex.
CEMP Part IV
Cybersecurity Annex December 2025
CYBERSECURITY ANNEX
Attached on the following page is the Bay Area UASI template for a Cyber Incident Response Plan. The City created and maintains an Information Technology Incident Response Plan that uses the core principles contained in the Cybersecurity Annex and utilized this template to create, review, and update the Information Technology Incident Response Plan prior to and following the 2023 incident described in Section 2.8.3 of this EMP. Due to security, the Information Technology Incident Response Plan maintained by the City cannot be shared publicly as it contains sensitive security information.
However, the template contained in the Cybersecurity Annex provides examples of common data, processes, and actions that are contained within an Information Technology Incident Response Plan.
CYBER INCIDENT RESPONSE PLAN
Cyber Incident Response Plan
[Add Organization Name]
[Add Draft/Publication Date]
[Add Street Address]
[Add City, State Zip Code]
CYBER INCIDENT RESPONSE PLAN
Table of Contents FOR OFFICIAL USE ONLY ii
This page intentionally left blank
CYBER INCIDENT RESPONSE PLAN
iii
PREFACE
Plan Overview
Preparation and vigilance are vital to ensuring that an organization is able to respond quickly and effectively to a cyber incident. When a cyber incident occurs, having a plan in place that describes the specific actions and procedures the organization should perform can make a big difference. A well- managed incident may have little to no impacts, while undetected or ineffectively handled incidents may cause severe damage that prevents the organization from performing its mission. This Cyber Incident Response Plan (CIRP) template will provide the guidance and structure needed to develop a clear and actionable plan to implement during a cyber incident. This will help minimize damage, reduce disaster response times, and mitigate breach-related expenses.
Template Guidance
This template can be used as a guide to develop a CIRP for your organization. To aid in development, this template includes a variety of guidance language throughout. This guidance language falls into three categories: development guidance, best practices, and additional resources Throughout the template, this guidance language is included in tables with the icons depicted below in Table 1. Table 1: Overview of Template Guidance
Icon Usage
Development Guidance: Development guidance is included throughout the document to indicate specific instructions to complete the plan. It offers supplemental information that may help organizations fill in placeholders.
Best Practice: The template will identify best practices for developing the plan (or conducting the assessments that inform the plan). In some cases, following these best practices is not required for plan completion; however, they will help enhance the plan’s quality and usefulness.
Additional Resource: In some cases, this template may reference external resources that provide useful context that will help organizations better understand a concept, collect information as part of plan development, or address other aspects of cyber planning.
This template also includes placeholders that prompt the inclusion of organization-specific information within the existing plan content. These placeholders are included in brackets, with bold blue text and a description of the prompt: [Review Placeholder Example]. Filling in each placeholder will allow you to customize the template to reflect your organization’s specific requirements, capabilities, priorities, and procedures. In some cases, placeholders are for discrete data points such names, positions, and contact information. In other cases, they are used to indicate areas to build-out a more detailed concept or procedure based on your specific organization’s priorities, resources, and concepts of operation. Where placeholders are not relevant to your organization, or you would prefer to exclude them for any reason, simply remove the prompt and customize the plan to your preferences.
To help guide development, there are example entries included in the tables throughout this template.
These examples can help indicate the type of information that your organization may want to include
CYBER INCIDENT RESPONSE PLAN
iv
and the associated format. Those examples entries should be removed as your organization’s information is inserted into the tables.
Lastly, you will remove this “Preface” section from the final plan, given that it includes development assistance rather than plan content. When finalized, the plan should begin with the “Record of Changes” section.
CYBER INCIDENT RESPONSE PLAN
v
RECORD OF CHANGES
Table 2: Record of Changes
Change Number Section Date of Change Individual Making
Change
Description of
Change
– Best Practice: Tracking all changes to the plan will help ensure that all individuals implementing or referencing the plan are using the most current version and fully understand where updates have been made since previous iterations.
CYBER INCIDENT RESPONSE PLAN
vi
This page intentionally left blank
CYBER INCIDENT RESPONSE PLAN
vii
TABLE OF CONTENTS
Preface ......................................................................................................................................................... iii Record of Changes ....................................................................................................................................... v Table of Contents ....................................................................................................................................... vii Plan Approvals ............................................................................................................................................. ix Introduction .................................................................................................................................................. 1 Incident Response Team ............................................................................................................................. 6 Preparation ................................................................................................................................................ 10 Detection ................................................................................................................................................... 13 Analysis ...................................................................................................................................................... 17 Containment .............................................................................................................................................. 23 Eradication ................................................................................................................................................ 26 Recovery .................................................................................................................................................... 29 Post-Incident Activity ................................................................................................................................. 30 Plan and Development Maintenance ...................................................................................................... 33 Annex A: Glossary and Acronyms ............................................................................................................. 34 Annex B: Memorandum of Agreement ..................................................................................................... 38 Annex C: Incident Analysis Worksheet ..................................................................................................... 40 Annex D: Incident Response Checklist .................................................................................................... 43
CYBER INCIDENT RESPONSE PLAN
viii
This page intentionally left blank
CYBER INCIDENT RESPONSE PLAN
ix
PLAN APPROVALS
By their signatures below, the following senior-level officials certify that they approve this Cyber Incident Response Plan (CIRP) and fully understand the incident response procedures that are to be followed in the event of an incident.
Approved: _______________________________ Date ____________ [Name/Title]
Approved: _______________________________ Date ____________ [Name/Title]
Approved: _______________________________ Date ____________ [Name/Title]
Approved: _______________________________ Date ____________ [Name/Title]
– Best Practice: Examples of senior-level officials that might approve a CIRP include, but are not limited to, City Managers, Chief Information Officers (CIO), Chief Technology Officers (CTO), and Chief Information Security Officers (CISO).
CYBER INCIDENT RESPONSE PLAN
x
This page intentionally left blank
CYBER INCIDENT RESPONSE PLAN
1 INTRODUCTION
Overview of Cyber Incidents
A cyber incident is an event occurring on, or conducted through, a computer or network that jeopardizes the confidentiality, integrity, or availability of computers; information or communications systems and networks; physical or virtual infrastructure controlled by computers or information systems; or information housed on a network. More specifically, types of activity that are commonly recognized as breaches of a typical security policy include:
Attempts to gain unauthorized access to a system and/or to data; The unauthorized use of systems for the processing or storing of data; Changes to a systems firmware, software, or hardware without the system owner’s consent; and Malicious or accidental disruption and/or denial of service. [Add any other background information on cyber incidents that you feel is necessary to contextualize the plan for your staff]
Cyber Incident Response Lines of Effort
Today’s cyber dependent environment necessitates that the public and private sectors vigilantly manage, respond to, and investigate cyber incidents, and share lessons learned so that others can minimize the potential damage to their information systems and data. Ensuring unity of effort during incident response requires a shared understanding of roles and responsibilities for all participating organizations throughout the cyber incident lifecycle.
There are four lines of effort that drive cyber incident response: Threat Response, Asset Response, Intelligence Support, and Affected Entity Response. These concurrent lines of effort provide the
– Best Practice: The amount of additional information that you should include in this section will depend on the amount of experience your personnel have with cybersecurity and incident response. If your organization is well-versed in cybersecurity, more information may not be required. Alternatively, more basic information on what comprises a cyber incident and why they are dangerous may be useful for organizations with less experience in managing cyber incidents.
– In addition, if your organization’s mission makes it particularly prone or vulnerable to a particular type of cyber incident, you may want to highlight that here. If your organization has experienced any significant cyber incidents in the past, you may also want to use this section to describe what occurred. This will emphasize the importance of cyber response and underscore that cyber incidents can impact all organizations.
– Additional Resource: The cyber incident response lines of effort below are identified in Presidential Policy Directive (PPD)-41: United States Cyber Incident Coordination.
CYBER INCIDENT RESPONSE PLAN
2 foundation required to synchronize various response objectives before, during and after a cyber incident. Table 3 describes each cyber incident response line of effort. Table 3: Cyber Incident Response Lines of Effort
Lines of Effort Description
Threat Response
Threat response activities include the appropriate law enforcement investigative activities for:
Collecting evidence and gathering intelligence to provide attribution; Linking related incidents and identifying additional possible affected entities; Identifying threat pursuit and disruption opportunities; and Developing and executing courses of action to mitigate the immediate threat and facilitating information sharing and coordination with asset response efforts.
Asset Response
Asset response activities include furnishing technical assistance to affected entities to protect their assets, mitigate vulnerabilities, and reduce impacts of cyber incidents by:
Identifying other entities possibly at risk and assessing their risk to the same or similar vulnerabilities;
Assessing potential risks to the sector or region, including potential cascading effects, and developing courses of action to mitigate these risks; Facilitating information sharing and operational coordination with threat response; and
Providing guidance on how best to utilize resources and capabilities in a timely, effective manner to speed recovery.
Intelligence
Intelligence support facilitates the building of situational threat awareness and sharing of related intelligence to:
Create an integrated analysis of threat tactics, techniques, and procedures; Identify and assist with the mitigation of knowledge gaps; and Suggest methods to degrade or mitigate adversary threat capabilities. Share indicators of compromise with other potential victims to increase their defense posture
Affected Entity
Response
An affected entity is highly encouraged to share information surrounding the event with other cybersecurity specialists to assist with cyber incident response. The affected entity is the data owner and retains responsibility to ensure appropriate actions and safeguards are in place to remediate threats and secure their information.
Table 4 lists the entities, including public and private sector organizations and agencies, involved in each of the four cyber incident response lines of effort. Table 4: Entities Associate with the Cyber Incident Response Lines of Effort Lines of Effort Associated Entities
Threat Response [Add the names of additional relevant organizations, including third-party cybersecurity resources]
Asset Response [Add the names of additional relevant organizations, including third-party cybersecurity resources]
CYBER INCIDENT RESPONSE PLAN
3 Lines of Effort Associated Entities
Intelligence
[Add the names of additional relevant organizations, including third-party cybersecurity resources]
Affected Entity
Response
[Add the names of additional relevant organizations, including third-party cybersecurity resources]
Incident Response Lifecycle
This plan describes the actions and procedures that the organization should perform as a part of cyber incident response. Those actions and procedures fall into seven general stages:
Preparation
Detection
Analysis
Containment
Eradication
Recovery
Post-Incident Activity
Each of the seven phases of cyber incident response have a chapter dedicated to it within this plan.
Those phase-specific chapters will describe what the actions that comprise each phase and identify the personnel responsible for completing each action.
Please see the Annex D: Incident Response Checklist for an overall sequential list of tasks that [Add Organization Name] will perform during each step of incident response.
Relevant Cyber Entities
Resources are available at the state, regional, and federal levels, and through non-governmental organizations, that can assist agencies and organizations to improve their cyber preparedness and response capabilities (see Table 5). This resource is intended to serve as a high-level reference for relevant cyber entities that may be helpful to contact during incident response. For a specific
– Best Practice: The Incident Response Lifecycle below is based on the System Administration, Audit, Network, and Security (SANS) framework. However, it is also acceptable to use the National Institute of Standards and Technology (NIST) Framework (Identify, Protect, Detect, Respond, Recover) instead. Both the NIST and SANS incident response steps are considered industry standards.
– If you choose to use the NIST framework or any other, be sure to update the plan’s chapter headings accordingly.
CYBER INCIDENT RESPONSE PLAN
4 breakdown of the services external resources provide, and the contact information for the agency/organization point of contacts, refer to the Preparation chapter. Table 5: Relevant Cyber Entities
Cyber Entity Description of Services Performed
Relevant Cyber Departments and Agencies Contact Form
Table 6 can be used to identify points of contact at relevant organizations that [Add Organization Name] may need to notify or communicate with in the event of a cyber incident. Table 6: Cyber Departments and Agencies Contact Form
Organization Point of Contact Email Address Phone Number Organization A Jane Doe [email protected] 123-555-5555 [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number] [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number] [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number] [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number] [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number] [Add additional organization] [Add Name] [Add Email Address] [Add Phone Number]
CYBER INCIDENT RESPONSE PLAN
5 Organization Point of Contact Email Address Phone Number
CYBER INCIDENT RESPONSE PLAN
6 INCIDENT RESPONSE TEAM
It is important to pre-identify the necessary roles for the purpose of incident response. Individuals with the required knowledge and skill sets should be available at all times to respond to an incident. A single individual may perform several roles concurrently and members of an incident response group may or may not participate in a similarly labeled group in their day to day work. Specific incident responses will dictate which roles are necessary and activated.
Please see the Annex D: Incident Response ChecklistError! Reference source not found. for an overall sequential list of tasks that [Add Organization Name] will perform during the seven steps of incident response.
– Development Guidance: An Incident Response Team is a group of experts that assesses, documents, and responds to a cyber incident so that a network can not only recover quickly, but also avoid future incidents.
– Development Guidance: For many organizations, the full list of roles will not be necessary or may not be feasible due to limited resources and staff availability. As you identify the personnel that comprise each role, remove the positions and groups that are not relevant to your organization. Smaller organizations may not require as many teams or positions, and in some cases, the same individual may perform more than one role.
– Development Guidance: An incident response team should be available for anyone who discovers or suspects that an incident involving the organization has occurred. One or more team members, depending on the magnitude of the incident and availability of personnel, will then handle the incident. The incident handlers analyze the incident data, determine the impact of the incident, and act appropriately to limit the damage and restore normal services.
The incident response team’s success depends on the participation and cooperation of individuals throughout the organization.
– Incident response teams can be comprised entirely of internal employees, be fully outsourced, or consist of both internal and external personnel. – NIST identifies possible structures for an incident response team include the following:
– • Central Incident Response Team
– • Distributed Incident Response Team
– • Coordinating Team
– For more information, refer to the NIST Computer Security Incident Handling Guide.
CYBER INCIDENT RESPONSE PLAN
7 Command Staff
Table 7 lists the roles that comprise [Add Organization Name]’s Command Staff. Table 7: Incident Response Team (Command Staff)
Role Description Individual(s)
Currently in Role
Incident Commander
Management level person(s) with the authority to make
high-level decisions and approve actions to be taken by the Incident Response Team.
[Add Name(s)]
Information Officer Disseminates public and non-sensitive information to interested parties. [Add Name(s)]
External Liaisons Serves as the point of contact for other governmental and non-governmental agencies and organizations. [Add Name(s)] Safety Officer Monitors incident operations and advises on matters related to operational safety. [Add Name(s)]
Legal Advisor Advises incident command on legal matters. [Add Name(s)] [Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
General Staff
General Staff – Management
The General Staff is responsible for the functional aspects of the incident command structure. Table 8 lists the roles that comprise the management of the General Staff. Table 8: General Staff Management
Role Description Individual(s)
Currently in Role
Operations Chief (and
Deputies) Directly manages all incident tactical activities. [Add Name(s)] Lead Investigator
Gathers and analyzes technical evidence, determines the cause of the attack, and directs other analysts and IT
components to implement system and service recovery.
[Add Name(s)]
[Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
General Staff – Network Group
Table 9 lists the roles that comprise the organization’s Network Group, which is the incident response team responsible for functional aspects of network management. Table 9: General Staff – Network Group
Role Description Individual(s)
Currently in Role
Network Group Supervisor Oversees Network Group team members. [Add Name(s)] Network Subject-Matter
Experts (SMEs)
Persons with experience and authorization necessary to
manage affected local area networks and firewalls [Add Name(s)]
CYBER INCIDENT RESPONSE PLAN
8 Role Description Individual(s)
Currently in Role
Firewall Engineers Designs, builds, and manages the security infrastructure of IT systems [Add Name(s)]
[Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
General Staff – Database Group
Table 10 lists the roles that comprise the organization’s Database Group, which is the incident response team responsible for functional aspects of database systems. Table 10: General Staff – Database Group
Role Description Individual(s)
Currently in Role
Database Group
Supervisor Oversees Database Group team members. [Add Name(s)] Database SMEs
Person(s) with experience and authorization necessary to manage affected database systems, including:
[Add to list of database systems based on those used
by your organization]
[Add Name(s)]
[Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
General Staff – Platform Group
Table 11 lists the roles that comprise the organization’s Platform Group, which is the incident response team responsible for functional aspects of server and workstation platforms. Table 11: General Staff – Platform Group
Role Description Individual(s)
Currently in Role
Platform Group Supervisor Oversees Platform Group team members. [Add Name(s)] Server Platform SMEs
Person(s) with experience and authorization necessary to manage affected server platforms, including:
Windows
Linux
[Update list of platforms based on those used by your organization]
[Add Name(s)]
Workstation Platform
SMEs
Person(s) with experience and authorization necessary to manage affected workstation platforms, including:
Windows
[Update list of platforms based on those used by your organization]
[Add Name(s)]
CYBER INCIDENT RESPONSE PLAN
9 Role Description Individual(s)
Currently in Role
[Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
General Staff – Application Group
Table 12 lists the roles that comprise the organization’s Application Group, which is the incident response team responsible for functional aspects of server and client applications. Table 12: General Staff – Application Group
Role Description Individual(s)
Currently in Role
Application Group
Supervisor Oversees Application Group team members. [Add Name(s)] Web Application SMEs Person(s) with experience and authorization necessary to manage affected web server applications. [Add Name(s)]
Management Application
SMEs
Person(s) with experience and authorization necessary to manage affected management information systems,
including:
Antivirus
Patch management
Email
Other incident affected applications
[Update list of systems based on those used by your
organization]
[Add Name(s)]
Desktop Application SMEs Person(s) with experience and authorization necessary to manage affected workstation-based applications. [Add Name(s)] [Add any addition roles
specific to your
organization]
[Add high-level role description] [Add Name(s)]
CYBER INCIDENT RESPONSE PLAN
10 PREPARATION
Plans and Policy
Planning begins with the development of the CIRP (and other plans) and training an IRT or identifying outside resources for a third-party IRT. When outsourcing an IRT, the third-party organization will be pre-identified and contracted. Ideally, the contract will be in place before a cyber incident occurs. The third-party organization will perform a review of the customer organization’s IT infrastructure, review and test the CIRP, and clearly establish a Service Level Agreement (SLA) between all parties.
Table 13 identifies other organizational plans and policies that are relevant to cybersecurity or cyber incident response.
Table 13: Other Relevant Plans and Policies
Plan/Policy Description of Plan’s Relationship to CIRP Last Update Organization COOP Plan
As both COOP plans and a CIRP address steps for
critical operations to continue during a range of
emergencies, it is vital to ensure synergy between
both documents.
1/1/2020
[Add Plan/Policy Name] [Add Description] [Add Date]
[Add Plan/Policy Name] [Add Description] [Add Date]
[Add Plan/Policy Name] [Add Description] [Add Date]
[Add Plan/Policy Name] [Add Description] [Add Date]
[Add Plan/Policy Name] [Add Description] [Add Date]
[Add any desired information about your organization’s existing plans and policies that may impact this plan.]
The Preparation phase also includes training for operational employees as well as supervisors and managers. They must be trained to identify suspicious behavior, whether it is a computer or other device’s behavior or an interaction with another person, such as a phone call that may be an attempt at social engineering. Employees will also understand the appropriate use for information systems and know the steps necessary will they observe another employee or contractor’s behavior inconsistent with the [Add Organization Name]’s Acceptable Use Policy. Consider that insider threats are still a common source of cybersecurity incidents, including data breaches, theft of intellectual property and sensitive information, damage to networked systems, as well as accidental exposure due to misconfiguration.
Table 14 identifies the existing training courses relevant to cyber incident response and notes the percentage of the personnel that have successfully completed each course (among the personnel that are required to complete it, not the entire organization staff).
– Best Practice: The goal of the Preparation stage is to ensure that your organization has the ability to comprehensively respond to an incident at a moment’s notice.
CYBER INCIDENT RESPONSE PLAN
11 Table 14: Relevant Training Courses
Training Course Description of Course Date Course
Last Updated
Course Completion
Percentage (Among
Relevant Staff)
Data Breach Training
This training explores best practices for
employees to prevent data breaches
during the normal course of work.
1/1/2020 80%
[Add Course Name] [Add Description] [Add Date] [Add Percentage] [Add Course Name] [Add Description] [Add Date] [Add Percentage] [Add Course Name] [Add Description] [Add Date] [Add Percentage] [Add Course Name] [Add Description] [Add Date] [Add Percentage] [Add Course Name] [Add Description] [Add Date] [Add Percentage] [Add Course Name] [Add Description] [Add Date] [Add Percentage]
External Resources
External resources are often just as important as internal resources. Maintaining a comprehensive list of all partner agencies to ensure regular communication is key to establishing and managing effective partnerships to foster open information sharing. [Add Organization Name]’s partners are listed in Table 15 along with a description of the services they provide and the contact information for the agency/organization point of contact.
Table 15: External Resources
Partner Organization/Agency Service Provided POC Email POC Phone Number
Federal
[Add Description] [Add Email] [Add Number]
[Add Description] [Add Email] [Add Number]
[Add any additional relevant
agencies/organizations] [Add Description] [Add Email] [Add Number] State
[Add Description] [Add Email] [Add Number]
[Add Description] [Add Email] [Add Number]
[Add any additional relevant
agencies/organizations] [Add Description] [Add Email] [Add Number] Regional
[Add Description] [Add Email] [Add Number]
[Add any additional relevant
agencies/organizations] [Add Description] [Add Email] [Add Number] Non-Governmental Organizations/Private Sector
[Add Description] [Add Email] [Add Number]
[Add any additional relevant
agencies/organizations] [Add Description] [Add Email] [Add Number] Local
Police [Add Description] [Add Email] [Add Number]
Utility Provider [Add Description] [Add Email] [Add Number] Cellular/Network Provider [Add Description] [Add Email] [Add Number] Web Service Hosting [Add Description] [Add Email] [Add Number] [Add any additional relevant
agencies/organizations] [Add Description] [Add Email] [Add Number]
CYBER INCIDENT RESPONSE PLAN
12 Personnel
It is critical that all members of the IRT can be quickly contacted in the case of a cyber incident or suspected cyber incident. The “Incident Response Team” chapter lists the IRT positions and describes the role(s) played by each. Table 16 lists the members of [Add Organization Name]’s IRT and includes each person’s email address and phone number. As some members of the IRT may be contracted out to third-party vendors, the table is organized by internal staff and third-party organizations. Table 16: Incident Response Team
Name Position Email Address Phone Number
Internal Staff
Jane Doe IT Services Manager [email protected] 123-555-5555 [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] Third-Party Vendors
[Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number]
CYBER INCIDENT RESPONSE PLAN
13 DETECTION
Indicators of a Cyber Incident
The existence of a cyber incident can be derived from various types of sources, both systematic and from monitored open-source information. Table 17 lists the likely sources and who is responsible for monitoring for an incident or receiving notification from an external agency/organization. Table 17: Cyber Incident Indicators
Indicator Potential Sources Responsibility for Monitoring and/or Receiving Notification
Alerts from
Monitoring and
Detection
Systems
Intrusion Detection and Prevention Systems
(IDS/IPS)
Security Information and Event Management
(SIEM) and antivirus software and third-party
monitoring system or service
Vulnerability assessment platforms
[Add any additional sources]
[Add Position(s)]
Logs
Operating Systems (OS)
Applications
Web Servers
Network devices network monitoring system
[Add any additional sources]
[Add Position(s)]
Users
Internal or external users, including non-IT or
security-related staff
Customers can report possible incidents to the IRT
directly
[Add any additional sources]
[Add Position(s)]
Internal Teams
IT Departments
IT Help Desks
IRTs
Staff that may detect anomalies during their daily
work
[Add any additional sources]
[Add Position(s)]
Managed Service
Providers
Internet Service Providers (ISP)
Telecommunication Service Providers
Suppliers
[Add any additional sources]
[Add Position(s)]
Mass Media Newspapers [Add Position(s)]
– Best Practice: This phase involves detecting deviations from normal operations in the organization and understanding if a deviation represents a security incident. Early steps taken to detect and verify an incident are important to developing an effective containment and eradication strategy. Once an incident has been detected, resources can be assigned to investigate the scope and impacts.
CYBER INCIDENT RESPONSE PLAN
14 Indicator Potential Sources Responsibility for Monitoring and/or Receiving Notification
Television
[Add any additional sources]
Website
Public security information websites
Websites by security researchers
Defacement archive websites
[Add any additional sources]
[Add Position(s)]
[Add any
additional
indicators that
your organization
relies upon]
[Add Sources] [Add Position(s)]
Determining how to triage a potential incident depends on the characteristics of the incident and/or events in question. There are many contributing characteristics which may demand different exploratory methods and levels of escalation. Table 18 describes different incident characteristics, the exploratory methods required to determine whether a cyber incident has occurred, and the member(s) of the IRT responsible for the assessment.
Table 18: Cyber Incident Characteristics
Characteristic Description Exploratory Method Responsibility Authentication
Unusual or unauthorized
logon attempts, logon
activities after hours,
remote session attempts,
unauthorized privilege
escalation, etc.
The system administrator could review
the SIEM logs to understand the account
in question and reason for error and
advise the ISO.
[Add Position(s)]
Data Handling
Abnormal ad-hoc requests,
unauthorized access or
attempted access,
inappropriate disclosure,
inappropriate destruction of
sensitive data, etc.
The administrator can review SIEM and
Active Directory logs to understand the
nature of the requests – this could
simply be the case of user rights
management issues or it could lead to
an investigation.
[Add Position(s)]
Data
Exfiltration
Large amounts of data
leaving the network by an
authorized (or
unauthorized) user.
The system administrator may
immediately cease all applicable
activities related to the incident in
question, secure their workstation or
area and contact the appropriate ISO or
their representative to begin preserving
the information or evidence of
questionable activities. Do not turn off
power to the device in order to allow
cybersecurity personnel to conduct
forensics.
[Add Position(s)]
System
Availability
Web defacements, denial of
services, hacking activities,
modification of software or
The administrator may review SIEM logs
to understand the activity in question
and prepare to restore services from a
backup and actively review firewall logs.
[Add Position(s)]
CYBER INCIDENT RESPONSE PLAN
15 Characteristic Description Exploratory Method Responsibility systems, suspicious
activities
Physical
Power outages, physical
damage, sabotage, physical
loss or theft of information
or systems
Coordinate with the ISO and the facility
infrastructure team to understand the
nature of the event and understand how
to implement secondary power and
possibly provide security personnel to
protect the physical perimeter and
sensitive areas.
[Add Position(s)]
Other
Social engineering, Trojan
or virus infections,
harassment, elevated data
disclosure, improper
disposal of documents.
Disable the user account, take a
screenshot and turn in, unplug the
computer from the network, actively log
authentication and access actions, etc.
[Add Position(s)]
[Add any
additional
characteristics
relevant to
your
organization]
[Add any additional
characteristics that are
relevant to your
organization]
[Add any additional relevant information] [Add Position(s)]
Incident Response Team Roles and Responsibilities
Table 19 lists the actions required by the IRT during the Detection phase of cyber incident response, including the position(s) responsible for performing the action. The list suggests a recommended order.
In an actual disaster, some tasks may be performed before this list suggests they be performed. Table 19: Detection Roles and Responsibilities
Step Action Responsibility
1 Report signs of a security incident to the CISO Database Group Supervisor
2 Performs an initial assessment to determine source of cyber threat Lead Investigator
– Best Practice: SANS describes key components of Detection—which you may want to incorporate into the roles and responsibilities table below—as follows:
– • Setting up monitoring for all sensitive IT systems and infrastructure. – • Analyzing events from multiple sources including log files, error messages, and alerts from security tools.
– • Identifying an incident by correlating data from multiple sources and reporting it as soon as possible.
– • Notifying IRT members and establishing communication with a designated command center (e.g., senior management, IT operations).
– • Documenting all information that you collect during the process of detection. – • Threat prevention and detection capabilities across all main attack vectors.
CYBER INCIDENT RESPONSE PLAN
16 Step Action Responsibility
3 [Add Detection Action] [Add Position]
4 [Add Detection Action] [Add Position]
5 [Add Detection Action] [Add Position]
6 [Add Detection Action] [Add Position]
7 [Add Detection Action] [Add Position]
8 [Add Detection Action] [Add Position]
9 [Add Detection Action] [Add Position]
10 [Add Detection Action] [Add Position]
CYBER INCIDENT RESPONSE PLAN
17 ANALYSIS
Impact Analysis
During the Analysis phase of cyber incident response, the IRT will conduct an investigation of the incident, including threat and impact analysis, to categorize the impact of the event on the [Add Organization Name]. Once the incident’s impact level is understood it may be appropriate to escalate the incident response and contact other entities.
[Add Position Name] will lead the analysis, which should begin immediately upon the determining that a cyber incident has occurred. An Impact Analysis Worksheet can be found in Annex C: Incident Analysis Worksheet, which can be used to conduct the analyses described below.
2.0 Functional Impact
Incidents may affect the confidentiality, integrity, and availability of the organization’s information.
Table 20 lists the categories used to classify an incident’s functional impact. Table 20: Functional Impact Categories
Category Definition
None No effect to the organization’s ability to provide all services to all users.
Low Minimal effect; the organization can still provide all critical services to all users but has lost efficiency.
Medium Organization has lost the ability to provide a critical service to a subset of system users.
High Organization is no longer able to provide more than one critical service to any users.
– Development Guidance: During this phase, it is vital for resources to be assigned to investigate the incident. Assessments are conducted to determine the incident’s scope, such as which networks, systems, or applications are affected; who or what originated the incident; and how the incident is occurring (e.g., what tools or attack methods are being used, what vulnerabilities are being exploited).
– Development Guidance: Often, the CISO will be responsible for leading the analysis of a cyber incident.
– Development Guidance: Your organization may use a different scale to categorize cyber incident functional impacts. If so, replace the categories in the table below with those used by your organization.
CYBER INCIDENT RESPONSE PLAN
18 Information Impact
Incidents may affect the confidentiality, integrity, and availability of [Add Organization Name]’s information. Table 21 lists the categories used to classify an incident’s information impact. Table 21: Information Impact Categories
Category Definition
None
No information was exfiltrated/leaked, disclosed, changed, deleted, accessed, or disclosed by or for unauthorized persons or purposes, or otherwise compromised.
Privacy Breach
Sensitive PII of taxpayers, employees, beneficiaries, etc., was accessed or exfiltrated/leaked, or Protected Health Information (PHI) of individuals was used or disclosed by or for unauthorized persons or purposes, or otherwise compromised.
Proprietary Breach
Unclassified proprietary information, such as Protected Critical Infrastructure Information (PCII), was accessed, exfiltrated/leaked, or used or disclosed by or for unauthorized persons or purposes.
Integrity Loss Sensitive or proprietary information was changed or deleted accidentally or intentionally.
Recoverability
The size of the incident and the type of resources it affects will determine the amount of time and resources that must be spent on recovering from that incident. Table 22 lists the categories [Add Organization Name] uses to classify an incident’s recoverability impact.
Table 22: Recoverability Categories
Category Definition
Regular Time to recovery is predictable with existing resources.
Supplemented Time to recovery is predictable with additional resources.
Extended Time to recovery is unpredictable; additional resources and outside help are needed.
– Development Guidance: Your organization may use a different scale to categorize cyber incident information impacts. If so, replace the categories in the table below with those used by your organization.
– Development Guidance: Your organization may use a different scale to categorize cyber incident recoverability. If so, replace the categories in the table below with those used by your organization.
– Additional Resource: The NIST approach to analyzing impacts and recoverability can be found in the Guide for Cybersecurity Event Recovery. Your organization can use a different approach to analysis, if desired.
CYBER INCIDENT RESPONSE PLAN
19 Not Recoverable Recovery from the incident is not possible (e.g., sensitive data exfiltrated/leaked and posted publicly); launch investigation.
Overall Incident Severity
Once the analyses described above are complete, [Add Position Responsible] can prioritize the incident according to its severity level. The appropriate response to an incident is dependent on the severity rating of the incident. Table 23 describes the four levels of severity and identifies the timelines for initial action for incidents at each severity level. Refer to the Annex C: Incident Analysis Worksheet to assess an incident’s severity score.
Table 23: Incident Severity
Priority Guideline Score Initial Action
Severe:
Extreme impact on enterprise 13-15 Immediately
High:
Loss of a major service 11-12 Immediately
Medium:
Some impact some portion of enterprise 8-10 Within 4 hours Low:
Minor impact on a small portion of enterprise 5-7 Within 24 hours Cyber Incident Types
A cyber incident can be defined as any security related event that has an actual or potential adverse effect on any computing resource or the data contained therein, or the violation of an explicit or implied security policy. All incidents are classified according to the criteria listed in Table 24. An incident may fit into more than one defined type.
Table 24: Incident Types
Incident Type Description
Denial of Service
An incident by which authorized access to systems or data is prevented or impaired.
Usually a denial of service (DoS) incident is a security event if the DoS is due to malicious intent. Not all events that prevent or hinder authorized access to systems or
– Development Guidance: The initial action timelines listed in the table above are examples of how an organization might assign those values. Update the timelines based on your organization’s preferences and capabilities.
– Development Guidance: Although references to many other incident types can be found in documentation, they all fall in one of the three categories noted above. For example, malicious code such as a virus or trojan will be first recognized as a denial of service, unauthorized access, or inappropriate usage, depending on the payload of the malicious code. Similarly, a phishing attach leading to account compromise will first be recognized as unauthorized access. Using these three incident types, responses can be developed to cover any incident that might affect the enterprise. If your organization prefers to break categorize the incident types more granularly, simply update the table accordingly.
CYBER INCIDENT RESPONSE PLAN
20 Incident Type Description
data are security incidents. The mechanical, electrical, or administrative failure of a system or access mechanism may not be a security incident.
Unauthorized
Access
An incident where unauthorized access is attempted or gained to systems or data, such as a phising attack. This access can be logical or physical in nature. Unauthorized access is any access for which permission has not been granted. Such permissions would include connect, authenticate, read, write, create, delete, modify, etc. This unauthorized access can be by an individual or another system.
Inappropriate
Usage
An incident by which acceptable use policies are violated. Acceptable use policies may include what types of data may be accessed or transmitted, how information may be accessed or transmitted, and where information may be received from or transmitted to.
[Add additional
incident types, as
desired]
[Add Desription]
Physical Considerations
Any incident involving or affecting physical systems or critical infrastructure mandates the participation of the applicable Critical Infrastructure Protection (CIP) team(s). Incidents involving physical infrastructure have additional considerations in addition to typical cyber-attacks. CIP-centric organizations have to consider more than simply network protection principles; they must also take into consideration the acquisition and replacement of systems on the network.
Table 25 lists the members of the CIP team, including the positions that comprise the team and each member’s email address and phone number.
Table 25: Critical Infrastructure Protection Team
Name Position Email Address Phone Number
Jane Doe Transit and Port Security
Liaison [email protected] 123-555-555
[Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number] [Add Name] [Add Position] [Add Email Address] [Add Number]
– Development Guidance: If your organization does not have a CIP team, you may delete the table below.
CYBER INCIDENT RESPONSE PLAN
21 Additional FERC Physical Considerations
FERC supplies the following list of physical conditions in Table 26, in order for [Add Organization Name] to ensure compliance.
Table 26: FERC Physical Considerations
# Definition
3.3.2.1 Physical considerations extend beyond the immediate physical and boundary of the computing center; even beyond the facility walls. Physical considerations encompass any and all physical and / or mechanical features directly or indirectly required to support business operations. Some example areas of concern that may require addition consideration.
3.3.2.2 Environmental Control Systems (ECS) are required to maintain an environment conducive to static free temperature and humidity-controlled environment. These controllers are more often than not enabled with an Internet or network connection which inherently creates additional vulnerabilities and risk to the environment.
3.3.2.3 Bulk Electrical Systems (BES) require additional considerations during the Post-Incident or Recovery phase of an incident in addition to the “typical” cyber related business recovery actions.
BES systems inherently have additional physical recovery considerations to ensure the proper restoration to protect the confidentiality, integrity and the availability of public and private critical physical infrastructure.
3.3.2.4 FERC Order 829 mandated additional controls addressing cyber security post-incident recovery for Industrial Control Systems (ICS) hardware, software and computing services associated with BES systems. NERC created implementation guidance CIP-009-6, as part of the overall CIP-009 recovery plan, to provide guidance with national, state and local CIP recovery strategies. More information is available directly from the NERC website at http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx
3.3.2.5 Security of the facility and applicable supporting infrastructure is another vital area concern.
Recovery efforts must include ensuring the physical and / or logical boundaries are “sound” and free of “evidence of tamper”. The organization may no longer have the resources necessary to secure the environment, and therefore may look into other options such as contracted support.
This type of action may require support by contracting, financial, logistics and management personnel.
Incident Response Team Roles and Responsibilities
Table 27 lists the actions required by the IRT during the Analysis phase of cyber incident response, including the position(s) responsible for performing the action. The list suggests a recommended order.
In an actual disaster, some tasks may be performed before this list suggests they be performed. Table 27: Analysis Roles and Responsibilities
Step Action Responsibility
1 Begin steps for evidence preservation and containment Lead Investigator 2 Perform detailed impact analysis to properly prioritize additional response activities that may be required
Network Subject-
Matter Experts
(SMEs)
3 [Add Analysis Action] [Add Position]
4 [Add Analysis Action] [Add Position]
5 [Add Analysis Action] [Add Position]
6 [Add Analysis Action] [Add Position]
CYBER INCIDENT RESPONSE PLAN
22 Step Action Responsibility
7 [Add Analysis Action] [Add Position]
8 [Add Analysis Action] [Add Position]
9 [Add Analysis Action] [Add Position]
10 [Add Analysis Action] [Add Position]
CYBER INCIDENT RESPONSE PLAN
23 CONTAINMENT
Once an incident is detected and analyzed, [Add Organization Name] will contain the incident in order to minimize continued impact and/or disruption of services and reduce the possibility of continued contamination to other services. Tactics supporting the immediate local isolation and containment are vital to slowing, and hopefully stopping the proliferation of the attack.
A risk management strategy will address the risk at every level, starting with the infected computing device all the way to examining the viability of the network. The affected computing devices may require immediate isolation or removal from the network in order to support the required efforts. Some commonly employed network tactics involve disconnecting or isolating network segments, creating additional firewall rules, employing active IDS/IPS rules or simply disconnecting the infected workstation or server from the company and/or public networks.
The type of cyber incident will inform the actions required to contain the incident. Table 28 identifies different actions that may be required for each of the three cyber incident types. Table 28: Containment Activities by Incident Type
Incident Type Description
Denial of Service [Add containment actions your organization can perform] Unauthorized
Access [Add containment actions your organization can perform] Inappropriate
Usage [Add containment actions your organization can perform] [Add additional
incident types, as
desired]
[Add containment actions your organization can perform]
– Development Guidance: Containment procedures attempt to actively limit the scope and magnitude of the attack. A vulnerability in a particular computer architecture can be exploited quickly. Containment involves acquiring, preserving, securing, and documenting all evidence.
Ultimately, Containment has two goals: preventing data from leaving the network and preventing an attacker from causing further damage to your organization’s information technology assets.
– Development Guidance: If you updated or added to the list of incident types in the Analysis chapter, make sure to update the table above accordingly. – In the description column in the table above, list the different activities that may be required to contain incidents based on the incident type. While the specifics of the incident will ultimately determine which is most appropriate, including the various option in the CIRP can help responders identify options more quickly when an incident occurs. Examples of activities might include: Disconnecting the suspected subnet; terminating the operation;
CYBER INCIDENT RESPONSE PLAN
24 [Add Organization Name] identifies goals for containment timelines based on the incident severity, as assessed in the Analysis chapter of this plan. In cases where multiple incidents are occurring simultaneously or in close succession, containment of those incidents that will cause the most serious impacts to mission performance will be prioritized over less severe incidents. Table 29 lists the containment goals for incidents at each level of severity. Refer to Annex C for the Incident Analysis Worksheet which can be used to determine an incident’s severity score. Table 29: Containment Goals by Incident Severity
Priority Guideline Score Containment Goal
Severe: Extreme impact on enterprise 13-15 ASAP
High: Loss of a major service 11-12 <24 Hours
Medium: Some impact some portion of enterprise 8-10 <72 Hours Low: Minor impact on a small portion of enterprise 5-7 <7 Days
Incident Response Team Roles and Responsibilities
Table 30 lists the actions required by the IRT during the Containment phase of cyber incident response, including the position(s) responsible for performing the action. The list suggests a recommended order.
In an actual disaster, some tasks may be performed before this list suggests they be performed. Table 30: Containment Roles and Responsibilities
Step Action Responsibility
1 Document evidence from the incident Lead Investigator running a full system backup; notifying an appropriate help desk; and changing the passwords on the compromised systems.
– Development Guidance: The containment goals listed in the table above are examples of how your organization might assign those values. Update the goals based on your organization’s preferences and capabilities.
– Best Practice: SANS describes key components of Containment—which you may want to incorporate into the roles and responsibilities table below—as follows:
– • Short-term containment—limiting damage before the incident gets worse, usually by isolating network segments, taking down hacked production server and routing to failover. – • System backup—taking a forensic image of the affected system(s) with tools such as Forensic Tool Kit (FTK) or EnCase, and only then wipe and reimage the systems. This will preserve evidence from the attack that can be used in court, and also for further investigation of the incident and lessons learned.
– • Long-term containment—applying temporarily fixes to make it possible to bring production systems back up. The primary focus is removing accounts or backdoors left by attackers on the systems, and addressing the root cause—for example, fixing a broken authentication mechanism or patching a vulnerability that led to the attack.
CYBER INCIDENT RESPONSE PLAN
25 Step Action Responsibility
2 Complete a full system shutdown Operations Chief
3 [Add Containment Action] [Add Position]
4 [Add Containment Action] [Add Position]
5 [Add Containment Action] [Add Position]
6 [Add Containment Action] [Add Position]
7 [Add Containment Action] [Add Position]
8 [Add Containment Action] [Add Position]
9 [Add Containment Action] [Add Position]
10 [Add Containment Action] [Add Position]
CYBER INCIDENT RESPONSE PLAN
26 ERADICATION
The Eradication process must include measures to not only remove the infection from the primary device, but various methods to scan every device on the affected network segment to ensure the relevant risk is addressed. This step should only take place after all external and internal actions are completed. There are two important aspects of Eradication: Cleanup and Notification. Cleanup typically consists of running antivirus software, uninstalling the infected software, rebuilding the OS, or replacing the entire hard drive and reconstructing the network. Table 31 identifies several important considerations that should guide eradication procedures, as well as who is responsible for addressing each.
Table 31: Eradication Considerations Checklist
Eradication Consideration Responsibility
Have infected systems been hardened with new patches or updates?
[Identify who in your organization should
address the consideration]
Do any systems or applications need to be reconfigured? [Identify who in your organization should address the consideration]
Have all possible entry points been reviewed and closed up? [Identify who in your organization should address the consideration]
Have all processes to eradicate the threat(s) been covered? [Identify who in your organization should address the consideration]
Are any additional defenses needed to support the eradication of the threat(s)?
[Identify who in your organization should
address the consideration]
Has all malicious activity been eradicated from affected systems?
[Identify who in your organization should
address the consideration]
Once that is complete, notification will be sent to relevant members of the IRT and others in the organization to alert them that the source of the incident has been removed. Table 32 identifies who must be notified, as well as the individuals responsible for providing the notification and the method though which the notification will be provided. All executive-level officials should be included in this list.
Table 32: Notification Requirements Following Removal of Incident Cause Individual Requiring Notification Individual Providing Notification Method of Notification IT Service Manager Managed Service Support Email
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
– Development Guidance: The goal of this phase is to find and eliminate the root cause of the breach. Eradication is intended to actually remove malware or other artifacts introduced by the attacks, and fully restore all affected systems. Once an incident is detected, analyzed, and contained, your organization can determine how to effectively and safely remove the source of the incident from the computing device and ensure another node in the network is not affected in the future.
CYBER INCIDENT RESPONSE PLAN
27 Individual Requiring Notification Individual Providing Notification Method of Notification [Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add Position] [Add Position] [Add Description]
[Add an organization chart below to depict the call chain that will be required to notify all members of the IRT of an incident]
Incident Response Team Roles and Responsibilities
Table 33 lists the actions required by the IRT during the Eradication phase of cyber incident response, including the position(s) responsible for performing the action. The list suggests a recommended order.
In an actual disaster, some tasks may be performed before this list suggests they be performed.
Individual Who First Detects an IncidentIndividual AIndividual A.1Individual BIndividual B.1Individual CIndividual C.1
– Development Guidance: The organization chart above should be replaced with one from your organization.
– Best Practice: SANS describes key components of Eradication—which you may want to incorporate into the roles and responsibilities table below—as follows:
– • Reimaging—complete wipe and re-image of affected system hard drives to ensure any malicious content is removed.
– • Preventing the root cause—understanding what caused the incident preventing future compromise, for example by patching a vulnerability exploited by the attacker. – • Applying basic security best practices—for example, upgrading old software versions and disabling unused services.
– • Scan for malware—use anti-malware software, or Next-Generation Antivirus (NGAV) if available, to scan affected systems and ensure all malicious content is removed.
CYBER INCIDENT RESPONSE PLAN
28 Table 33: Eradication Roles and Responsibilities
Step Action Responsibility
1 Identify and prioritize vulnerabilities for mitigation Operations Chief 2 Remove malware, inappropriate materials, and other components Database SMEs 3 [Add Eradication Action] [Add Position]
4 [Add Eradication Action] [Add Position]
5 [Add Eradication Action] [Add Position]
6 [Add Eradication Action] [Add Position]
7 [Add Eradication Action] [Add Position]
8 [Add Eradication Action] [Add Position]
9 [Add Eradication Action] [Add Position]
10 [Add Eradication Action] [Add Position]
CYBER INCIDENT RESPONSE PLAN
29 RECOVERY
As a result of the ever-increasing reliance on technology, [Add Organization Name] has developed a comprehensive Technology Recovery Plan (TRP) to re-establish services quickly and completely following a disaster. The TRP should be activated immediately after a disaster strikes to enable the efficient recovery of critical systems and help the organization avoid further damage to mission-critical operations.
Data Recovery
The key to an effective data recovery strategy begins with a well planned and executed backup strategy. A back-up strategy may vary from company to company based on the data type, location, sensitivity, availability requirements, and / or data owners. Other variables may come into play such as location of the backup media or the Statement of Work (SOW) with an external data recovery vendor.
Refer to [Add Organization Name]’s TRP for a detailed overview of the actions required for data recovery.
Service Recovery
The organization’s reliance on third-party services during normal operations means that those entities will also play an important role during technology recovery after an incident. Refer to [Add Organization Name]’s TRP for a detailed overview of the actions required for service recovery.
Site Recovery
The actions required for site recovery are based upon what type of recovery site is defined in the BCP (e.g., cold site, warm site, or hot site). Refer to [Add Organization Name]’s Continuity of Operations (COOP) or TRP for a detailed overview of the actions required for site recovery.
– Development Guidance: Today’s technological and business environments are dynamic and utilize multiple platforms for information management. This phase of the incident response lifecycle includes your organization’s plans for data recovery, service recovery, and site recovery. Much of this information should be captured in your organization’s Technology Recovery Plan (TRP) or Continuity of Operations (COOP) Plan. These plans are vital to recovering from a cyber incident and resume normal operations. – You can reference those plans below rather than duplicating the same information here.
This will help avoid inconsistency between the plans that can arise if content that is quoted in one plan, is updated in another.
CYBER INCIDENT RESPONSE PLAN
30 POST-INCIDENT ACTIVITY
Following an incident, [Add Organization’s Name] should perform lessons learned activities, with the purpose of improving security measures and the incident handling processes, determining the root cause a cyber incident, and identifying recommendations and any shortfalls identified during the incident response process.
Lessons Learned
Learning and Improving
[Add Organization Name]’s IRT will hold lessons learned meetings with all involved parties after a major incident, and periodically after lesser incidents (as resources permit) to improve security measures and incident handling processes. Questions to be answered in these meetings include:
How well did staff and management perform? Were documented procedures followed? Were procedures adequate?
What information was needed sooner?
Were any steps or actions taken that might have inhibited the recovery? What would staff and management do differently the next time a similar incident occurs? How could information sharing with other organizations have been improved? What corrective actions can prevent similar incidents in the future? What precursors or indicators will be watched for in the future to detect similar incidents? What additional tools or resources are needed to detect, analyze, and mitigate future incidents? [Add any additional relevant questions]
[Add Position or Name] will lead the lessons learned meeting following an incident. Table 34 describes how soon these lessons learned meeting will occur after a major incident, and how frequently they will occur for lesser incidents.
– Development Guidance: This section will describe the lessons learned activities that the organization will conduct following an incident as well as the process to collect recommendations.
– Best Practice: Based on available resources, your organization can customize the contents of this chapter to reflect the amount and type of post-incident assessment and reporting that you would like to complete. It may be possible to combine several products/assessments described below into a single, comprehensive reporting product.
CYBER INCIDENT RESPONSE PLAN
31 Table 34: Frequency of Lessons Learned Assessments Type of Incident Timeline for Lessons Learned Assessment Major Incident Initiate lessons learned process within [Add Timeline] of incident.
Lesser Incidents Conduct a lessons learned process for any lesser incidents that have occurred every [Add Frequency].
After these lessons learned meetings, the organization will use the identified lessons learned to:
[Add a description of any lessons learned products (e.g., trainings, best practice presentations, guidance material) that you would like your IRT to develop based on the key takeaways from the lessons learned meetings].
Table 35 describes the lessons learned products that [Add Individual or Position(s) Name] will develop and provides a timeline for development of these product. Table 35: Lessons Learned Product Development
Product Description Timeline for Development
Incident Response Training
Training will detail strengths, previously
identified areas for improvement, and
best practices for incident response
Within 90 Days of Incident
Resolution
[Add Product Name] [Add Description of Product] [Add Timeline] [Add Product Name] [Add Description of Product] [Add Timeline]
Root Cause Analysis
A root cause is a fundamental, underlying, system-related reason why an incident occurred that identifies one or more correctable system failures. By conducting a root cause analysis following a cyber incident and addressing root causes, [Add Organization Name] may be able to substantially or completely prevent the same or a similar incident from recurring. [Add Individual or Position] will lead the root cause analysis and will lead the review of logs, forms, report, and other incident documentation to focus on relevant assessment objective, including:
Identifying recorded precursors and indicators;
Determining if the incident caused damage before it was detected; Determining if the actual cause of the incident was identified; Determining if the incident is a recurrence of a previous incident; Identifying measures, if any, that could have prevented the incident; and [Add any additional areas for analysis]
Following the root cause analysis, [Add Position or Name] will oversee the documentation of the results for future reference and to guide continuous improvement. These results will take the form of a [Add a description of how your organization will capture and disseminate the results of the root cause analysis (e.g., a report or presentation) along with a description of who is responsible for development and the desired timeframes]
CYBER INCIDENT RESPONSE PLAN
32 Recommendations
In addition to the lessons learned guidance materials and job aides described above, [Add Organization Name] will compose an after-action report based on the lessons learned and any shortfalls identified during the incident response process. This report will also detail how the organization will use the information to update the CIRP, retrain the IRT as necessary, and share information with cybersecurity partners for them to use as lessons learned.
This after-action report will include specific recommendations that should be made to improve the organization’s incident response processes. Each recommendation will clearly capture when the recommendation was made, a target date for implementing the recommendation, and the individual(s) responsible for implementing the recommendation. This after-action report should be completed within [Add Timeframe] of the resolution of the incident. Strongly consider sharing these lessons- learned so that others can further protect themselves.
– Development Guidance: If your organization chooses to complete the root cause analysis as part of the lessons learned products described above, you can delete this section from your plan and describe how the root cause analysis will fit into the lessons learned process above.
– Best Practice: In addition to identifying strengths, areas for improvement, and recommendations, this after-action report can also be used to house other information about the incident response for future reference. For example, it may include a formal event chronology (including time-stamped information from systems), a monetary estimate of the amount of damage the incident caused, and other information for the record.
CYBER INCIDENT RESPONSE PLAN
33 PLAN AND DEVELOPMENT MAINTENANCE
The CIRP will be updated [Describe Update Frequency], or any time a major system update or upgrade is performed. [Add Individual or Position Name] will be responsible for updating the plan, and so is permitted to request information and updates from other employees and departments within the organization in order to complete this task.
Maintenance of the CIRP will include (but is not limited to) the following:
Ensuring that all team lists are complete and up to date; Making any required updates to directions and guidance to reflect changes in [Add Organization Name]’s organization, policies, personnel, priorities, and IT systems and equipment; Ensuring that the plan is compliant with all requirements specified in new laws or regulations. [Add any actions or key considerations that your organization would like to include in the plan maintenance process]
During the maintenance periods, all changes to the Incident Response Teams will be accounted for. If any member of an Incident Response Team is no longer an employee of the organization. it is the responsibility of the [Position] to appoint a new team member. [Add any additional information about the process your organization will use to review and update the plan]
– Best Practice: In order to maintain operational relevancy, the CIRP should be updated regularly. Ideally, the plan will be updated annually, though this is dependent on organization resources.
– Best Practice: You may want to describe the specific coordination processes that your organization will use to review the plan, identify gaps or required changes, update the plan, and receive approval from leadership.
CYBER INCIDENT RESPONSE PLAN
34 ANNEX A: GLOSSARY AND ACRONYMS
Glossary
Authentication: security measure designed to establish the validity of a transmission, message, or originator, or the identity confirmation process used to determine an individual’s authorization to access data or computer resources.
Availability: assurance that the systems responsible for delivering, storing, and processing information are accessible when needed by those who need them.
Breach: an impermissible use or disclosure by an unauthorized person or for an unauthorized purpose that compromises the security or privacy of Confidential Information such that the use or disclosure poses a significant risk of reputational harm, theft of financial information, identity theft, or medical identity theft.
Confidentiality: assurance that information is not disclosed to system users, processes, and devices unless they have been authorized to access the information.
Containment: the process of preventing the expansion of any harmful consequences arising from an Incident.
Data: information in an oral, written, or electronic format that allows it to be retrieved or transmitted.
Eradication: the removal of a threat or damage to an information security system.
Event: an observable occurrence in a network or system or of confidential information.
Forensics: the practice of gathering, retaining, and analyzing information for investigative purposes in a manner that maintains the integrity of the information.
Hardware: the physical technology used to process, manage, store, transmit, receive, or deliver information. The term does not include software. Examples include laptops, desktops, tablets, smartphones, thumb drives, mobile storage devices, CD-ROMs, and access control devices.
Incident: an attempted or successful unauthorized access, use, disclosure, exposure, modification, destruction, release, theft, or loss of sensitive, protected, or confidential information or interference with systems operations in an information system.
Incident Response Team (IRT): led by the Incident Response Lead, the core team composed of subject- matter experts and information privacy and security staff that aids in protecting the privacy and security of information that is confidential by law and provides a central resource for an immediate, effective, and orderly response to Incidents at all levels of escalation.
Information Security: the administrative, physical, and technical protection and safeguarding of data (and the individual elements that comprise the data).
Integrity: assurance that the data are authentic, accurate, and complete and can be relied upon to be sufficiently accurate for their purpose.
Malware: a generic term for a number of different types of malicious code.
CYBER INCIDENT RESPONSE PLAN
35 Protected Health Information (PHI): information subject to HIPAA: Individually identifiable health information in any form that is created or received by a HIPAA Covered Entity, and relates to the individual’s healthcare condition, provision of healthcare, or payment for the provision of healthcare as further described and defined in the HIPAA Privacy Regulations.
Personal Identifying Information (PII): Under California Civil Code4 §1798.80 81 "Personal information" means any information that identifies, relates to, describes or is capable of being associated with a particular individual, including, but not limited to:
name, address, social security number, date of birth; government-issued identification number; driver’s license; state ID card; mother’s maiden name; signature, medical information; insurance information; unique biometric data, including the individual’s fingerprint, voice print, and retina or iris image;
unique electronic identification number, address, or routing code; banking information; credit card / debit card information, education, employment (current and/or history).
Recovery: process of recreating files which have disappeared or become corrupted from backup copies.
Sensitive Data: while not necessarily protected by law from use or disclosure, data that is deemed to require some level of protection as determined by an individual agency’s standards and risk management decisions. Some examples of “Sensitive Data” include but are not limited to:
Operational information
Personnel records
Information security procedures
Internal communications
Information determined to be authorized for use or disclosure only on a “need-to-know” basis Threat: any circumstance or event with the potential to adversely impact an information system through the unauthorized access, destruction, disclosure, modification of data and/or denial of service.
Vulnerability: weakness in an information system, system security procedures, internal controls, or implementation that could be exploited.
CYBER INCIDENT RESPONSE PLAN
36 Acronyms
Refer to Table 36 for definitions of all acronyms used in this plan. Table 36: Acronym List
Acronym Definition
BES Bulk Electrical Systems
CCIU Cyber Crimes Investigation Unit
CDT California Department of Technology
CHP California Highway Patrol
CIO Chief Information Officer
CIP Critical Infrastructure Protection Teams
CIRP Cyber Incident Response Plan
CISA Cybersecurity and Infrastructure Security Agency
CISO Chief Information Security Officer
CIOCC CISA Integrated Operations Coordination Center
COOP Continuity of Operations Plan
CTO Chief Technology Officer
ECS Environmental Control Systems
FBI Federal Bureau of Investigations
FERC Federal Energy Regulatory Commission
HIPAA Health Insurance Portability and Accountability Act of 1993 ICS Industrial Control Systems
IDS Intrusion Detection System
IPS Intrusion Prevention System
IRT Incident Response Team
ISP Internet Service Providers
IT Information Technology
MOA Memorandum of Agreement
MOU Memorandum of Agreement
NCATS National Cybersecurity Assessments and Technical Services
NERC North American Electric Reliability Corporation
CYBER INCIDENT RESPONSE PLAN
37 Acronym Definition
NIST National Institute of Standards and Technology
OS Operating System
PCII Protected Critical Infrastructure Information
PHI Protected Health Information
PII Personally Identifiable Information
PPD Presidential Policy Directive
SANS System Administration, Audit, Network, and Security SIEM Security Information and Event Management
SLA Service Level Agreement
SOW Statement of Work
TRP Technology Recovery Plan
UASI Urban Areas Security Initiative Program
CYBER INCIDENT RESPONSE PLAN
38 ANNEX B: MEMORANDUM OF AGREEMENT
Memorandum of Agreement (MOA) between [Add Providing Agency/Jurisdiction] and [Add Requesting Jurisdiction].
WHEREAS, on this event and associated conditions will collectively be referred to as [Add Name of Incident]; and
WHEREAS, on [Add Date], this declared emergency event consists of [List Type of Incident]; and
WHEREAS, the following extreme conditions exist: [Briefly describe the incident (e.g., lives threatened, extent of property/infrastructure damaged and/or threatened). List the type of conditions contributing to the disaster such as strong winds and low humidity aiding fires that swept through the region]; and
(If applicable) WHEREAS, on [Add Date] a Presidential Declaration of Emergency (FEMA‐XXXX‐DR) was issued; and
WHEREAS, the Emergency Management Mutual Aid Plan delineates the current state policy concerning Emergency Management Mutual Aid; and
WHEREAS, the Emergency Management Mutual Aid Plan describes the standard procedures used to acquire emergency management mutual aid resources and the method to ensure coordination of emergency management mutual aid planning and readiness; and
WHEREAS, the county emergency manager is the Operational Area Emergency Management Mutual Aid Coordinator; and
WHEREAS, Emergency Management Mutual Aid Plan provides, in pertinent part, “When an emergency develops or appears to be developing which cannot be resolved by emergency
– Development Guidance: This template is intended to be your guide for writing an MOU. It is important to note that the sample paragraphs are geared for illustration purposes toward a specific MOU example. Further, each community’s MOU language will need to be modified according to the purpose of the agreement. This document does not address every issue that jurisdictions may face when seeking to establish an MOU. An MOU will be customized to the capability or resource for which it is established and will consider any unique characteristics of the specific community and participating jurisdictions.
CYBER INCIDENT RESPONSE PLAN
39 management resources within an Operational Area, it is the responsibility of the Operational Area Mutual Aid Coordinator to provide assistance and coordination to control the problem;” and
WHEREAS, the Emergency Management Mutual Aid Plan provides, in pertinent part, “A request for emergency management mutual aid requires the approval of an authorized official of the requesting jurisdiction;” and
WHEREAS, the (Authorized Official Title) of the County of [Add Requesting Agency/Jurisdiction] requested the mutual aid assistance of [Add Providing Agency/Jurisdiction], pursuant to the Emergency Management Mutual Aid Plan to provide emergency management support in connection with the [Add Name of Incident]; and
WHEREAS, [Add Providing Agency/Jurisdiction], provided emergency management mutual aid consisting of emergency management personnel, equipment, and/or materials from [Add Date Through Date] to assist with emergency management services in connection with the [Add Name of Incident]; and
WHEREAS, [Add Providing Agency/Jurisdiction] agrees to document all of its mutual aid assistance costs related to the [Add Name of Incident] as attachments to this MOA and submit to [Add Requesting Agency/Jurisdiction] as soon as practicable;
NOW, THEREFORE, IT IS HEREBY AGREED by and [Add Requesting Agency/Jurisdiction] and [Add Providing Agency/Jurisdiction] that [Add Requesting Agency/Jurisdiction] shall reimburse all reasonable costs associated with [Add Providing Agency/Jurisdiction] emergency management mutual aid assistance during the [Add Name of Incident].
Providing Jurisdiction
Approved: _______________________________ Date ____________ [Name/Title]
Providing Agency
Approved: _______________________________ Date ____________ [Name/Title]
Requesting Agency/Jurisdiction
Approved: _______________________________ Date ____________ [Name/Title]
CYBER INCIDENT RESPONSE PLAN
40 ANNEX C: INCIDENT ANALYSIS WORKSHEET
The Incident Analysis Worksheet is used to document an incident, categorize its impacts, and ultimately calculate its severity. Once the incident is categorized it is prioritized according to its severity level. The appropriate response to an incident is dependent on the severity rating of the incident.
Incident Overview
In order to accurately identify incident impacts, use Table 37 to categorize and description the incident. Table 37: Incident Overview
Incident Type Description of Incident
[Add Incident Type based on categories listed in
Analysis chapter of this plan] [Briefly describe what occurred]
Functional Impact
Incidents may affect the confidentiality, integrity, and availability of the [Add Organization Name]’s information. Use Table 38 to classify the incident’s functional impact as None, Low, Medium, or High. Table 38: Functional Impact
Category Definition
None No effect to the organization’s ability to provide all services to all users.
Low Minimal effect; the organization can still provide all critical services to all users but has lost efficiency.
Medium Organization has lost the ability to provide a critical service to a subset of system users.
High Organization is no longer able to provide more than one critical service to any users.
Functional Impact Category: [Add the category relevant to this incident]
Information Impact
Use Table 39 to classify the incident’s information impact as None, Privacy Breach, Proprietary Breach, or Integrity Loss.
CYBER INCIDENT RESPONSE PLAN
41 Table 39: Information Impact
Category Definition
None No information was exfiltrated/leaked, disclosed, changed, deleted, accessed, or disclosed by or for unauthorized persons or purposes, or otherwise compromised.
Privacy Breach
Sensitive PII of taxpayers, employees, beneficiaries, etc., was accessed or exfiltrated/leaked, or Protected Health Information (PHI) of individuals was used or disclosed by or for unauthorized persons or purposes, or otherwise compromised.
Proprietary Breach Unclassified proprietary information, such as PCII, was accessed, exfiltrated/leaked, or used or disclosed by or for unauthorized persons or purposes.
Integrity Loss Sensitive or proprietary information was changed or deleted accidentally or intentionally.
Information Impact Category: [Add the category relevant to this incident]
Recoverability Impact
The size of the incident and the type of resources it affects will determine the amount of time and resources that must be spent on recovering from that incident. Use Table 40 to classify an incident’s recoverability impact.
Table 40: Recoverability Impact
Category Definition
Regular Time to recovery is predictable with existing resources.
Supplemented Time to recovery is predictable with additional resources.
Extended Time to recovery is unpredictable; additional resources and outside help are needed.
Not Recoverable Recovery from the incident is not possible (e.g., sensitive data exfiltrated/leaked and posted publicly); launch investigation.
Recoverability Impact Category: [Add the category relevant to this incident]
Overall Impact Severity
By adding the scores in Table 41 from the following evaluation criteria, a severity rating is established:
Table 41: Incident Severity Scoring
Action Score
Potential number of affected parties: How much productivity is impacted by this incident? Less than 1% of systems; less than 1% of workforce 1
More than 1%, but less than 10% of systems; more than 1% but less than 10% of workforce 2
More than 10% of systems; more than 10% of workforce 3
– Development Guidance: Certain types of data, due to regulatory and/or legal definitions are always classified as ‘High’. One example would be HIPAA covered Electronic Protected Health Information
CYBER INCIDENT RESPONSE PLAN
42 Action Score
Probability of widespread escalation: Does this incident have the potential to spread to as yet unaffected systems?
Minimal 1
Moderate 2
High 3
Commonality: Has this occurred in the past; is there experience in mitigating this particular incident? Commonly Seen 1
Occasionally Happens 2
Rare 3
Potential for damage or loss: How expensive is the incident expected to be, both in lost production and in mitigation costs.
Minimal 1
Moderate 2
High 3
Business impact: What is the expected negative impact on the overall health of the enterprise both in short- and long-term contexts?
Minimal 1
Moderate 2
High 3
Once the analyses described above are complete, it is possible to prioritize the incident according to its severity level. The appropriate response to an incident is dependent on the severity rating of the incident. Table 42 describes the four levels of severity and identifies the timelines for initial action for incidents at each severity level.
Table 42: Impact Severity
Priority Guideline Score Initial Action
Severe: Extreme impact on enterprise 13-15 Immediately
High: Loss of a major service 11-12 Immediately
Medium: Some impact some portion of
enterprise 8-10 Within 4 hours
Low: Minor impact on a small portion of
enterprise 5-7 Within 24 hours
Incident Severity Score: [Add Incident Severity Score
CYBER INCIDENT RESPONSE PLAN
43 ANNEX D: INCIDENT RESPONSE CHECKLIST
Table 43 section presents a sequential list of tasks that [Add Organization Name] will perform during the seven steps of incident response. The list suggests a recommended order. In an actual disaster, some tasks may be performed before this list suggests they be performed. Table 43: Incident Response Checklist
Step Action Responsibility Completed
1 Detection
1.1 Report signs of a security incident to the CISO Database Group Supervisor ☐
1.2 Performs an initial assessment to determine source
of cyber threat Lead Investigator ☐
1.3 [Add Actions] [Add Position/Individual] ☐
2 Analysis
2.1 Begin steps for evidence preservation and
containment Lead Investigator ☐
2.2 Perform detailed impact analysis to properly prioritize additional response activities that may be required
Network Subject-Matter
Experts (SMEs) ☐
2.3 [Add Actions] [Add Position/Individual] ☐
3 Containment
3.1 Document evidence from the incident Lead Investigator ☐
3.2 Complete a full system shutdown Operations Chief ☐
3.3 [Add Actions] [Add Position/Individual] ☐
– Development Guidance: The checklist captures key, high-level actions that commonly occur during incident response. Based on your organization’s resources, staff, standard operating procedures, priorities, and other factors, you should modify the checklist to reflect the actions you anticipate being required to response to a cyber incident. – In the “Responsibility” column, you do not need to list the names of every individual that is responsible for performing each action. Including the name of the relevant team, office, or entity is sufficient. If a single individual is responsible, consider including either the position name or the position name and the individual’s name. Including only the name of the individual responsible can make implementation of the plan more challenging or confusing if that individual is no longer with the organization when this plan is used during an incident.
The roles and responsibilities you fill-out in each phase of the incident response lifecycle should also be included here.
– Best Practice: The table below reflects only Detection, Analysis, Containment, and Eradication. Preparation and Post-Incident are left out, as they do not have specific actions that must be performed in a particular order under time sensitive conditions. Recovery is left out as recovery actions are captured in the TRP.
CYBER INCIDENT RESPONSE PLAN
44 Step Action Responsibility Completed
4 Eradication
4.1 Identify and prioritize vulnerabilities for mitigation Operations Chief ☐
4.2 Remove malware, inappropriate materials, and other
components Database SMEs ☐
4.4 [Add Actions] [Add Position/Individual] ☐