Incident Command System (ICS)

1. Incident Command System (ICS) Using the Incident Command System to Enhance Emergency Response Capabilities Randall J. Till Vice President MasterCard Worldwide

2. Agenda • ICS Overview and Background • ICS Team Structure and Group Responsibilities • ICS Escalation Flow • ICS Processes and Tools • ICS Implementation and Integration • Questions

3. What is Emergency Management Emergency Management is the process of responding to and managing any event that impacts offices or assets across the enterprise • Emergency Response teams in each office • Standard processes and procedures • Train and practice

4. Why Incident Command System (ICS)? • Global events (e.g. Pandemic) • Promote emergency management plan • Management awareness • Reputation and shareholder value

5. What is Incident Command System (ICS)? ICS is a well organized team approach for managing critical incidents • It is modular and scalable – only use teams that you need • Provides for consistent and reliable communications using common terminology • Ensures coordinated response among teams and locations (horizontal & vertical) • Especially helpful for companies with multiple locations • Employs standard and proven practices Source: Emergency Management & Safety Solutions

6. Incident Command System (ICS) is Required • Compliance with US Presidential Directive (PD #5) • Mandatory for all US federal agencies for federal funding • US State governments had to migrate to ICS by January 2006 • Mandated for all hazardous material incidents • Required for all US law enforcement, government, and the military Prevailing thought is that ICS will be a required emergency management practice in the future Source: Emergency Management & Safety Solutions

7. Team Types and Group Responsibilities

8. ICS Team Types • IAT = Initial Assessment Team • Team for Small Regional Offices and sub-team of the CIRT/LIRT • LIRT = Local Incident Response Team • Regional Headquarters and Select Offices • CIRT = Corporate Incident Response Team • Corporate Headquarters ONLY

9. Initial Assessment Team (IAT)Responsibilities • Manage local events • Determine initial impacts to life safety, building, and operations • Assess the event and determine the Incident Level • Communicate with appropriate Incident Commander • For offices with a CIRT or LIRT • Determine if CIRT/LIRT should be activated and to what degree • For offices with a IAT only • Continue to address the incident until conclusion • Declare disaster for local office recovery activation

10. Local Incident Response Team (LIRT)Responsibilities • Manage local events • Support events at regional offices (with IAT only) • Communicate with the Corporate Incident Commander • Perform Action Planning meetings for local office • Interface with local Executive Management • Declare disaster for local office recovery activation

11. Corporate Incident Response Team (CIRT)Responsibilities • Manage events at corporate office • Support all global incidents from an enterprise business perspective • Perform Action Planning meetings for corporate office • Interfaces with Corporate Executive Management • Declares disaster for corporate office recovery activation

12. ICS Organizational Structure Command (manages) Operations (does) Planning & Intelligence (plans) Logistics (care/gets) Financial (pays/records)

13. CommandResponsibilities A Incident Commander is responsible for overall command of the incident • Sets priorities and objectives • In charge of all ICS functions • Directs, controls, and orders resources • Resolves conflict • Conduct Initial Assessment with Team • Facilitates Action planning meeting Interfaces with Executive Management Command (manages) Lead by Incident Commander

14. Operations GroupResponsibilities Responsible for all tactical operations necessary to carry out the plan (response and restoration) • Involves the key “backbone” aspects of the business • Facilities, Security, IT, Telecom • Initial damage inspection • Establish interface with first responders • Establish situation control • Develop situation status report • Front line – resolve the issues Restores business back to“business-as-usual” Operations (does) Lead by the Operations Group Leader

15. Planning & Intelligence GroupResponsibilities Responsible for the collection, evaluation, and dissemination of information concerning the incident • Develop and maintain intelligence plans • Crisis communications, business recovery and technical recovery plans • Take situation reports and evaluate information • Apply “intelligence” to the situation and action plans • Addresses communication needs and legal aspects Recommends actions and next steps based on event and plans Planning & Intelligence (plans) Lead by the P&I Group Leader

16. Logistics GroupResponsibilities Responsible for providing the necessary support to meet incident needs • All of the human aspects of the event • Well being of employees • Acquires resource to support the incident • Addresses services, materials and vendor resources • Provides administrative support/message center Provides for the “care” of personnel and acquisition of resources Logistics (care/gets) Lead by the Logistics Group Leader

17. Financial GroupResponsibilities Responsible for monitoring and documenting all costs • Properly records all expenditures • Payroll, emergency purchase orders, cash, purchasing cards and other critical payment issues • Works with insurance companies regarding reimbursement and worker’s compensation insurance Provides financial support and funding related to an event Financial (pays/records) Lead by the Financial Group Leader

18. IAT Members

19. CIRT Members

20. LIRT Members

21. ICS Team MemberCommitment and Empowerment Effective emergency response is dependent on qualified staff being trained to execute with proper authority ICS team members must be: • Trained to clearly understand their roles and responsibilities • Committed to fulfilling their responsibility • Engaged by participating in meetings and exercises • Empowered to perform their roles in accordance with practiced guidelines

22. ICS Escalation Flows

23. Executive Management Corporate Incident Response Team (CIRT) CIRT Commander Local Incident Response Team (LIRT) Regional Headquarters and Large Staffing Executive Management Region Local Incident Response Team (LIRT) Office Location LIRT Commander Operations Planning & Intelligence Logistics Financial Operations Team Lead P&I Team Lead Financial Team Lead Logistics Team Lead • Responsibility of the LIRT: • Manages the events locally • Communicates up to Corporate Headquarters

24. Escalation Flow to Corporate Incident Response Team (CIRT) Corporate Headquarters CIRT US Regional Offices IAT Technology Headquarters LIRT Latin America Headquarters LIRT Asia Pacific Headquarters LIRT Europe Headquarters LIRT

25. Country IAT Country IAT Country IAT Country IAT Country IAT Country IAT Country IAT Middle East & Africa LIRT Country IAT Country IAT Country IAT Country IAT Country IAT Country IAT Country IAT Country IAT Country IAT Country IAT Country IAT Country IAT Country IAT Initial Assessment Team (IAT) for Regional offices example Corporate HQ CIRT Asia Pacific LIRT

26. Corporate Headquarters CIRT Corporate Headquarters CIRT Corporate Headquarters CIRT Technology LIRT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT AP LIRT SEMEA LIRT IAT IAT IAT LAC LIRT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT Global Incident Command System (ICS) Escalation Flow Corporate Headquarters CIRT IAT IAT W. Europe LIRT IAT IAT IAT Europe LIRT IAT IAT IAT IAT IAT IAT IAT IAT IAT IAT

27. CIRT – Corporate Headquarters No Cross Office Notification Process Normal operating procedures ? Yes IAT activated Assess (use Initial Assessment Form) Cross Office Notification Process Cross Office Notification Process STOP Yes No Security (if any), Incident Commander & Business Continuity discusses IAT Activation? No IAT only - Regional Offices IAT activated Assess (use Initial Assessment Form) Yes • Incident Commander: • IC notifies Regional LIRT Incident Commander ICS Escalation Flow EVENT Notify GSCC First Response process Global Security Control Center (GSCC) Process LIRT – Regional HQs & Select Offices Security, Incident Commander & Business Continuity discusses IAT Activation and Cross Office Notification? Monitoring Continues IAT activated Assess (use Initial Assessment Form) Activate LIRT? (appropriate components) No Activate CIRT? (appropriate components) IAT continues monitoring No Yes IAT continues monitoring Yes • LIRT activated • Conduct Action Planning Process • IC notifies local Executive Management • IC notifies CIRT Incident Commander • CIRT activated • Conduct Action Planning Process • IC notifies the Policy Committee

28. ICS Processes and Tools

29. ICS processes and supporting tools • Initial Assessment Team (IAT) process • Initial Assessment process and forms • Incident matrix • LIRT/CIRT process • Functional group checklists • Action Planning meeting process • Command Center operations and procedures • Notification tool

30. Incident Levels: Level 1: Compartmentalized or Minor • An emergency limited in scope Level 2: Local or Minimum • An emergency moderate to severe Level 3: Regional or Major • A catastrophic disaster • Damaged a mission critical facility • Relocation of staff & business • Disruption of services IAT Process • Event triggers a normal escalation process • Decision to activate IAT to assess situation (face-to-face or conference call) • IAT assesses the event to: • Assess impacts of incident • Determine incident level • Execute required actions based on incident level

31. IAT Process - CIRT/LIRT Activation • Based on the Incident Level, the IAT determines if CIRT/LIRT activation is required • If No, IAT manages the event • If Yes, the CIRT/LIRT is activated (full or partial) and a decision is made to activate virtually or physically • Incident Commander conduct an Action Planning meeting with Group Leaders • Incident Commander report status to appropriate management based on escalation flow • CIRT/LIRT groups meet to work on event objectives

32. CIRT/LIRT Action Planning Meeting • Action Planning meeting • Incident Commander and Group Leaders • Update on event status and assessment • Sets strategic objectives to address • Assigns objectives to functional groups • Defines operational period • Time period to work on objectives before next Action Planning meeting • Action Planning meetings continue throughout the event lifecycle

33. CIRT/LIRT Process • Formal Command Center process and procedures • The CIRT/LIRT Functional Group Leaders share objectives from the Action Planning meeting with members of their functional groups • CIRT/LIRT functional team members take steps to complete the objectives • Teams provided with functional checklists • Team members provide updates on objectives to Group Leader for reporting to Incident Commander • If needed, Action Planning meeting begins again

34. Notification Tool Flexibility: • Messages can be delivered to mobile phone, landline, e-mail, fax, pager, PDA, SMS, or BlackBerry • Worldwide distribution via phone or fax to 95 countries and text to 110 countries • Real-time delivery tracking to monitor progress – seeks a positive confirmation • The availability rate exceeds 99.9 percent Benefits: • Allows immediate contact of a large numbers of people with a single activation • Employs multiple communication modes (voice, email and text messaging) • Provides the ability for people to respond to a question sent in a message (via prompts) • Imports contact information from your recovery planning database

35. ICS Implementation and Integration

36. Focus on Emergency Management • Implement standard structure/methodology to consistently manage events globally • ICS is a proven "Best Practice" • Conduct training sessions globally to expand preparation and readiness • Conduct scenario based exercises • Performed training and table top exercises • Conducted comprehensive scenario-based functional exercises for CIRT/LIRT offices • Encourage preparedness as part of the business culture

37. Integration with existing Business Continuity Program • Business Recovery and Technical Recovery activation • Planning & Intelligence on CIRT/LIRT • Integrate ICS triggers in IT problem resolution process • Develop ICS reporting mechanism with business and technical recovery operations • Address pandemic planning and other scenario-based requirements • Integrate ICS with Business Continuity Manuals for regional offices ICS is an integral part of the Business Continuity Program

38. Core Offices (Corporate Headquarters and Key Operations) Corporate Incident Response Team (CIRT) Technology and International Headquarters – Local Incident Response Teams (LIRT) Initial Assessment Teams (IAT) serves as sub-team to CIRT/LIRT Regional Headquarters and Select Offices Key offices with a significant number of people or operations Local Incident Response Teams (LIRT) Initial Assessment Teams (IAT) serves as sub-team to LIRT Business Continuity Manuals contain emergency planning materials Regional Offices (all other offices) Initial Assessment Teams (IAT) Business Continuity Manuals contain emergency planning materials Emergency Management Teams

39. Implementing ICS at each office • Awareness sessions with key management • Awareness sessions with functional group leaders • Role specific training – commitment and participation • Initial Assessment Team (IAT) • Functional Groups (Operations, P&I, Logistics, Finance) • LIRT/CIRT exercises • Notification tests • “ICS Ready”

40. ICS Implementation

41. 2008 Emergency Management Planning Deliverables

42. ICS Benefits • ICS buy-in and enterprise wide endorsement • Global response and management of events • Strengthen partnerships and coordination with key internal and external partners • Gained management participation and commitment • Streamlined processes, integrated actions and solidified comprehension • Enhanced organizational readiness to respond to and manage any type of incident

43. Thank You