Incident Management Training for IT Operations

Level 1 Onsite

Day 1

Operational Period 1

09:00-09:30 Welcome/ introductions/overview of BRP

09:30-10:00 Teambuilding exercise/TIME discussion

10:00-10:15 Break

10:15-11:30 Overview of IMS and Command: forward momentum, challenges of command, transition from normal operations to incident operations

11:30-12:30 Lunch

Operational Period 2

12:30-14:00 CAN Reports and IMS Briefing: communications process

14:00-14:15 Break

14:15- 14:30 Breakout session assembly/transition to Zoom

14:30-16:00 Communications Breakout session: CAN Reports/IMS Briefings [prepare for main session deliverables

16:00-16:15 Break/reassemble in main session

16:15-17:00 Main session presentations and debrief


Small Group Exercises
Multimedia Resources

Day 2

Operational Period 3

09:00-09:15 Welcome/Q&A

09:15-10:15 Documentation: capturing key events, time stamps, time contracts and from-to

10:15-10:30 Break

10:30-11:45 Incident Responder Toolbox: preparation/presentation/post game, response/answer, timelines and time contracts, delegation, span of control

11:45-12:00 Lunch exercise briefing: intro to Unified Command and rules of engagement

12:00-13:00 Lunch exercise with peer evaluation

13:00-13:30 Lunch exercise After Action Review (AAR)

Small Group Exercises
Operational Period 4

13:30-13:45 Breakout session assembly/transition to Zoom

13:45-15:30 Breakout session: technology-based Command Staff exercise [UC interface]

15:30-15:45 Break/reassemble in main session

15:45-16:30 Main session presentations and debrief



Small Group Exercise
Multimedia Resources
Command Staff Simulation
Successfully Leading Critical IT Functions During Incident Response