Emergency Response and Incident Management
Domain 5 - Emergency Response and Incident Management. This domain tests how security operations transition from routine monitoring to coordinated response: command roles, evacuation versus shelter-in-place versus lockdown, accountability, communications, drills, and after-action improvement.
Core rules
- Use a recognized incident command structure with a single incident commander and unified command when multiple agencies respond. Span of control should remain manageable.
- The emergency action plan must define evacuation, shelter-in-place, lockdown, assembly areas, accountability, and re-entry authority. These are distinct decisions, not one universal response.
- Life-safety egress must not be blocked by security controls. Fire alarm interfaces, marked exits, and assembly areas are part of the security design.
- Communications need redundancy and interoperability: internal notification, public address, radio channels, and law enforcement liaison.
- Drills should test roles and decision-making, not just walking to an assembly point. After-action reviews must produce assigned corrective actions with dates.
Worked example
A bomb threat is received at a reception desk. Pulling the fire alarm would move occupants toward the likely device and create confusion. The incident commander instead directs a quiet evacuation to an alternate assembly area away from the building, notifies police and fire through unified command, accounts for occupants, and preserves the reception area for investigation. The reasoning is to avoid directing people into or through the hazard while maintaining accountability.
Traps
Treating fire alarm as the default response to every incident; unclear authority to order lockdown; no occupant accountability; unexercised plans; and after-action reviews with no corrective action.