Exercise Materials
We are the Experts So That You Don't Have To Be
ICS4ICS Exercise April 18, 2022
The first exercise of ICS4ICS capabilities was conducted at S4 on April 18, 2022. The exercise was attended by over 300 people who provided very positive feedback and suggestions to improve future exercises. The attendees said that the ICS4ICS process will be extremely valuable particularly as the complexity of cybersecurity incidents continue to increase causing greater impact to critical infrastructure. Megan Samford summarized the results of the ICS4ICS Exercise which can be viewed at: ICS4ICS – Megan Samford - Bing video
There are two videos from the ICS4ICS exercise:
- The first part of the ICS4ICS Exercise explains how the incident was declared and the steps taken by the ICS4ICS team to manage the incident: https://www.youtube.com/watch?v=l4ec0SjfcH8
- The second part of the ICS4ICS Exercise provides more details about how the incident evolves and how the ICS4ICS team responds to a ransom-ware request: https://www.youtube.com/watch?v=E-x_E8qrNZs
We appreciate your feedback and any suggestions to improve the ICS4ICS process and/or the ICS4ICS exercise. If you have any feedback, please send it to bpeterson@isa.org
We are working to deploy and improve the ICS4ICS Program and need your help in these areas:
- Update the ICS4ICS Exercise materials used at S4 to ensure they can be used globally
- We are working with several people to conduct ICS4ICS Exercises in numerous countries and industry sectors, and we seek more volunteers
- Create the next version of ICS4ICS that addresses more complex Type 2 incidents impacting multiple assets/sites for a company. We will also add mutual aid processes, IT recovery for the ICS4ICS, and many other capabilities
- Presenting ICS4ICS at various events to create awareness about the program
- You can obtain credentials to perform the various ICS4ICS roles
- If you are interested in receiving more information about ICS4ICS, please sign-up for the newsletter
If you would like to help with these efforts, please complete the form
ICS4ICS Exercise Materials
ICS4ICS Exercises are designed to help people understand how ICS4ICS processes and tools are used to improve the response to industrial control system cybersecurity incidents by leverage FEMA and DHS CISA capabilities.
ICS4ICS Exercise Resources:
ICS4ICS Exercise materials were created based on the materials provided by FEMA
The FEMA ICS Resource Center provided valuable information used by the ICS4ICS Team: ICS Resource Center (fema.gov)
Host an ICS4ICS Exercise
If you would like to host an ICS4ICS Exercise in your country, region, or industry sector, please volunteer to help setup an ICS4ICS Exercise


ICS4ICS Exercise Package
ICS4ICS Exercise Package guides the exercise: Situation Manual
The ICS4ICS Exercise Package was created based on: CISA Tabletop Exercise Package | CISA




This is the ICS4ICS Exercise presentation with speaker notes.
ICS4ICS Exercise Presentation
The ICS4ICS Exercise Package was created based on the CISA tabletop exercise package
ICS4ICS Forms
ICS4ICS Forms were completed to help guide the ICS4ICS Exercise: ICS Resource Center (fema.gov)
- ICS Form 201 – Incident Briefing
- ICS Form 202 – Incident Objectives
- ICS Form 204 – Assignment List
- ICS Form 207 – Organizational Structure
- ICS Form 213RR – Resource Request Message
- ICS Form 215 – Operational Planning Worksheet
- ICS Form 215A – Incident Action Plan Safety Analysis
FEMA ICS forms are used in the ICS4ICS process.
Note: You can obtain all FEMA ICS forms in a single download: NIMS ICS Forms Booklet

