For decades, ICS courses have taught a familiar Logistics Section structure. Students learn that the section is organized into a Service Branch and a Support Branch, with six primary units underneath: Communications, Food, and Medical on the Service side, and Supply, Facilities, and Ground Support on the Support side.
There is nothing inherently wrong with that model. In fact, it remains an effective framework for organizing logistical support on many incidents. However, as incidents have grown in complexity and become increasingly dependent on technology, security, and integrated support systems, the Logistics Section used on many large incidents has begun to evolve.
As an instructor and practitioner who has worked extensively with all-hazards Incident Management Teams, I have frequently observed organizations built around the ICS charts taught in training courses. Yet when reviewing contemporary incident organizations, both within the wildland fire and all-hazards communities, I found increasing evidence that the Logistics Section being used in the field does not always look like the Logistics Section shown in the classroom.
The divergence is not a rejection of ICS. Rather, it may be evidence that incident managers are doing exactly what ICS was intended to support: adapting organizational structures to meet operational needs.
The Traditional Logistics Section
The traditional Logistics Section structure serves an important purpose. The two-branch model helps organize six critical support functions and provides an additional layer of supervision for span of control as incidents grow in complexity. The organizational chart looks something like this:
Service Branch
• Communications Unit
• Food Unit
• Medical Unit
Support Branch
• Supply Unit
• Facilities Unit
• Ground Support Unit
This organizational design remains deeply embedded within NIMS doctrine and is still reflected in FEMA qualification standards.1
However, several trends suggest that incident organizations are increasingly adapting this structure to reflect modern operational realities.
Trend #1: Flattening the Logistics Organization
The most significant change occurred in January 2024 when NWCG formally archived the Service Branch Director (SVBD) and Support Branch Director (SUBD) positions.2
NWCG’s rationale is particularly noteworthy. In recommending the removal of the positions, the Incident and Position Standards Committee (IPSC) documented that the Incident Logistics Subcommittee found that Service Branch Directors and Support Branch Directors were generally not being utilized in current Complex Incident Management Team business practices. Instead, incident management teams were typically assigning qualified Logistics Section Chiefs to directly manage these logistics functions. The recommendation also noted limited historical ordering activity for the positions and broad support from practicing Logistics Section Chiefs for their removal.3 Notably, the qualification requirement of a SVBD and a SUBD was a Logistics Section Chief Type 2 (LSC2), so whether an LSC established a Branch Director position or simply used a Deputy LSC, it was essentially the same thing.4
Importantly, NWCG did not eliminate the underlying functions. Communications, Food, Medical, Supply, Facilities, and Ground Support remain core logistics responsibilities. Instead, the organization removed a management layer between the Logistics Section Chief and the Unit Leaders. Current NWCG Logistics organizational charts no longer depict Service or Support Branch Directors.5
What I found most noteworthy was not that NWCG eliminated the positions, but that the change generated relatively little discussion outside the wildland fire community. Many all-hazards responders continue to view Service Branch Director and Support Branch Director positions as standard components of the Logistics Section, often unaware that many Complex IMTs had largely stopped using those positions long before they were formally archived.
Additional insight into the decision came from Travis Bailey, Emergency Management Specialist with the National Incident Management Organization, Logistics Section Chief, and former Chair of the NWCG Incident Logistics Subcommittee. During a discussion with Travis, he recalled that the subcommittee conducted extensive analysis of resource-ordering data within the Interagency Resource Ordering Capability (IROC) system while evaluating the future of the Service Branch Director and Support Branch Director positions. According to Travis, the review found that interagency teams were not using or ordering either position. Instead, teams were routinely ordering additional Logistics Section Chiefs to meet workload demands on complex incidents. One factor contributing to that trend was the realization that units such as Supply, Facilities, and Ground Support had evolved into some of the largest and most complex elements within the Logistics Section, often requiring leadership arrangements based on workload and operational tempo rather than the predefined Service and Support Branch structure. Travis noted that it is not uncommon for Complex Incident Management Teams today to roster multiple Logistics Section Chiefs to meet incident demands.
This raises an important question: if some of the nation’s most complex incidents can effectively manage logistics without Service and Support Branch Directors, are all-hazards teams activating those positions because they add value or simply because they appear on the chart?
Trend #2: Expanding Logistics Capabilities
While portions of the traditional Logistics Section have been flattened, other capabilities have expanded. Modern incident organizations increasingly face mission requirements that extend beyond the six-unit Logistics Section model taught in many ICS courses. Security support, maritime support, and technology services are examples of specialized capabilities that have emerged to meet those demands.
Security Support
NWCG maintains a Security Manager (SECM) position responsible for organizing and supervising incident security functions, protecting personnel and facilities, and safeguarding incident resources. This position typically starts as a member of the Facilities Unit but can also report directly to the Logistics Section Chief, much like a Staging Area Manager may report directly to the Operations Section Chief, or be expanded into a Security Unit Leader position.6
Security does not appear as one of the traditional six Logistics Section units commonly taught in NIMS courses. Yet modern incidents routinely face challenges involving access control, facility protection, traffic management, equipment security, camp security, and interactions with the public. NWCG’s formal recognition of a Security Unit, functioning alongside the other support units within the Logistics Section, reflects the growing importance of these responsibilities on large incidents.
This finding resonated with my own experience supporting large-scale emergency operations. During the COVID-19 vaccination mission, our team established a significant security element to support vaccination sites. Security personnel controlled access to facilities, protected vaccine supplies and equipment, safeguarded critical resources, and provided security support for incident personnel and operational sites. At the time, we placed the security function within Operations because the work was closely tied to the overall mission of delivering vaccines to the public. Reviewing NWCG’s approach caused me to reconsider that organizational decision. Many of the responsibilities assigned to our security personnel were not operational objectives themselves. Rather, they served as enabling functions that protected facilities, controlled access, safeguarded resources, and supported incident personnel. Viewed through that lens, the NWCG model treats security much like communications, facilities, supply, or ground support: a service that enables operational success rather than a tactical function that directly accomplishes incident objectives.
That does not mean Security always belongs in Logistics. During incidents involving civil unrest, dignitary protection, law enforcement operations, or force protection concerns, placing security resources within Operations may remain entirely appropriate. However, NWCG’s recognition of a Security Unit under Logistics highlights an important planning question that many all-hazards teams may not routinely ask: Is security accomplishing incident objectives, or is it enabling the people who accomplish them?
Maritime Support
Not all adaptations involve entirely new concepts. Some reflect the need to tailor logistical support to specific operating environments. In maritime incidents, for example, incident organizations may establish a Vessel Support Unit responsible for coordinating vessel assignments, fueling, maintenance, berthing, transportation, and other support functions associated with waterborne resources. While many of these responsibilities resemble those traditionally associated with Ground Support, the Vessel Support Unit provides specialized oversight for marine assets and operations, recognizing that while the Ground Support and Vessel Support functions are similar, the specific requirements are inherently different. Vessel movements, fueling requirements, maintenance schedules, berthing arrangements, crew support, and maritime transportation coordination often require planning considerations that differ significantly from those associated with ground-based resources. The U.S. Coast Guard has formally recognized this need through the establishment of a Vessel Support Unit Leader (VSUL) qualification within its ICS Position Qualification Standards and its incorporation into incident management doctrine.7
The need for this capability can be seen in large-scale maritime incidents such as the 2019 Golden Ray response in St. Simons Sound, Georgia. EMSI team member Jim Elliott, a Coast Guard-certified Marine Safety, Security and Environmental Professional, former Federal On-Scene Coordinator, Type 1 Incident Commander, and past President of the American Salvage Association, described to me how the response required sustained coordination of salvage vessels, tugs, workboats, divers, pollution-response assets, and support facilities. Unlike a conventional marine emergency in which vessels might arrive, conduct rescue operations, and depart, the Golden Ray response required long-term management of waterborne resources supporting recovery and salvage operations. Vessel-support functions included assigning and routing vessels, coordinating movements between the casualty site, staging areas, and shore facilities, arranging fuel and logistical services, coordinating maintenance and repair activities, maintaining accountability for vessel status and location, and integrating marine-resource support with other ICS functions. As incidents incorporate larger numbers of specialized marine assets, these responsibilities can represent a substantial logistical workload in their own right.
This highlights an important reality: as incidents move into specialized operating environments, logistics organizations often evolve to provide capabilities not captured in the traditional six-unit model.
Technology Support
The growth of technology represents a significant change affecting modern Logistics Sections. Historically, communications support was largely focused on voice communications and radio systems. Today, incident management teams rely on networks, servers, cloud-based collaboration tools, GIS platforms, digital planning products, cybersecurity protections, mobile devices, data management systems, and broadband connectivity. While many software applications remain the responsibility of the sections that use them, incident organizations increasingly require dedicated personnel to establish and maintain the underlying information technology infrastructure that supports those tools. Network connectivity, internet access, cybersecurity, bandwidth management, device support, and data services have become critical support functions in their own right.
In response to these demands, the all-hazards community has increasingly adopted the Information Technology Service Unit Leader (ITSL) concept. Developed through collaboration among CISA, SAFECOM, NCSWIC, FEMA’s National Integration Center, and other partners, the ITSL position is responsible for managing incident information technology services, cybersecurity, network infrastructure, applications, and technical support functions. Formal training and position task books now exist for the position.8 Regardless of the title, the underlying requirement is largely the same: modern incidents increasingly depend on specialized personnel capable of supporting complex information technology systems.
The NWCG community has approached the challenge differently. While NWCG does not currently maintain a formal ITSL position, it has increasingly recognized the need for technology support through positions such as Incident Communications Center Manager and Incident Technology Support Specialist. These positions support network infrastructure, computer systems, connectivity, data management, and technical support requirements that have become essential to modern incidents.9
The evolution of these capabilities reflects how dramatically incident support requirements have changed since the early days of ICS. EMSI founder Chuck Mills, one of the original members of the FIRESCOPE Technical Team that developed the Incident Command System and later one of the nation’s first Type 1 Incident Commanders, frequently observed that the communications and technology requirements faced by today’s incident management teams extend far beyond what the FIRESCOPE team envisioned when the original Communications Unit concept was created. In the 1970s, the primary challenge was achieving reliable voice communications and interoperability among responding agencies. Today’s incidents depend on computer networks, cloud-based collaboration platforms, digital mapping systems, mobile devices, data management tools, broadband connectivity, and cybersecurity protections. Although different communities have adopted different organizational solutions, the underlying trend is the same: modern incident communications and technology requirements have expanded far beyond the scope of the original Communications Unit concept, creating a need for specialized technical support capabilities within the Logistics Section.
Taken together, these examples illustrate how the Logistics Section continues to evolve alongside the incidents it supports. Incident organizations are increasingly adding specialized support capabilities to address operational requirements that extend beyond the traditional six-unit model taught in many ICS courses.
Trend #3: Organizing Around Outcomes
Another example of organizational evolution involves incident medical support.
The traditional model places the Medical Unit within the Service Branch of the Logistics Section. However, NWCG’s Medical Unit Leader position description explicitly allows the Medical Unit Leader to report either to the Logistics Section Chief or to the Safety Officer.10
An additional indicator of this perspective is that the Medical Unit Leader position is stewarded by NWCG’s Safety and Risk Management Committee rather than the Logistics and Equipment Management Committee. The connection between Medical and Safety is also reflected in the incident planning process itself. The Medical Unit Leader is responsible for preparing the ICS 206 Medical Plan, while the plan is reviewed by the Safety Officer in the NWCG system and approved by the Safety Officer in the NIMS version of the form. Together, these relationships reinforce the close linkage between incident medical support and responder safety objectives.10,11
As I reviewed these changes, I was reminded that ICS was never intended to be a rigid organizational template. Throughout my career, I have seen incident organizations adapted to reflect the unique demands of the situation, available personnel, and leadership priorities. NWCG’s treatment of the Medical Unit acknowledges that reality. Rather than prescribing a single reporting relationship, it allows incident leaders to place the function where it can best support responder health, safety, and operational effectiveness.
This represents an example of adapting organizational design to support operational outcomes rather than adhering rigidly to textbook organizational charts.
Some organizations have gone even further. Travis Bailey noted that all Complex Incident Management Teams within the Southwest Geographic Area Coordination Center (SW GACC) have established a Medical Section Chief position. In this model, medical functions are not assigned to either Logistics or Safety but instead operate as a separate Command and General Staff function. Whether this approach gains broader acceptance remains to be seen, but it represents another example of incident organizations adapting structures to meet operational needs rather than relying solely on traditional organizational charts.
The Logistics Section We Use
Taken individually, each of these examples may appear relatively minor. Together, however, they suggest a broader trend.
The traditional Logistics Section remains a valuable foundation. Yet the Logistics Sections being used on many modern incidents are increasingly being shaped by practical operational needs. Permanent supervisory layers are being removed where they no longer add value, but incident organizations retain the flexibility to add Deputy Section Chiefs and other supervisory positions when workload, span of control, or incident complexity warrant additional leadership capacity. Security capabilities are being formalized. Specialized support functions are emerging to support maritime, technology, and other operational requirements. Medical support is being organized around responder outcomes rather than historical placement.
The common thread is that incident organizations appear to be evolving around function rather than tradition.
Conclusion
The lesson is not that incident management teams should abandon NIMS, FEMA, NWCG, or any other doctrine or organizational charts. The lesson is that ICS was designed to be flexible.
The Logistics Section of today supports functions that were barely contemplated when many standard organizational charts were first created. Security management, maritime support, network administration, digital collaboration, cybersecurity, and responder health have become critical components of incident support. Successful teams are adapting their organizations accordingly.
The Logistics Section we teach remains an excellent starting point.
The Logistics Section we use continues to evolve to meet the demands of modern incidents.
REFERENCES
- FEMA. National Qualification System Position Qualifications: Service Branch Director.
https://www.fema.gov/sites/default/files/documents/fema_nqs-imt-service-branch-director_nims-509.pdf
FEMA. National Qualification System Position Qualifications: Support Branch Director. https://www.fema.gov/sites/default/files/documents/fema_nqs-imt-support-branch-director_nims-509.pdf - NWCG. Service Branch Director (Archived).
https://www.nwcg.gov/positions/service-branch-director
NWCG. Support Branch Director (Archived).
https://www.nwcg.gov/positions/support-branch-director
NWCG IPSC. January 2024 Updates to the NWCG Standards for Wildland Fire Position Qualifications, PMS 310-1 (IPSC 2024 01).
https://fs-prod-nwcg.s3.us-gov-west-1.amazonaws.com/s3fs-public/committee-correspondence/ipsc-m-24-01.pdf - NWCG IPSC. Recommendation to Not Transition Support Branch Director and Service Branch Director Positions to Complex (IPSC‑2023‑07).
https://fs-dev-nwcg.s3.us-gov-west-1.amazonaws.com/s3fs-public/committee-correspondence/ipsc-m-23-07.pdf - Logistics Section Chiefs & Branch Directors Endorsement Analysis.
https://fs-prod-nwcg.s3.us-gov-west-1.amazonaws.com/s3fs-public/2023-06/nimsic-logistics-section-chief-and-branch-director-endorsement-2022-04.pdf - NWCG. ICS Logistics Chart.
https://www.nwcg.gov/page/ics-logistics-chart - NWCG. Security Manager Position Description.
https://www.nwcg.gov/positions/security-manager - U.S. Coast Guard. U.S. Coast Guard Incident Management Handbook June 2025 (COMDTPUB P3120.17C). https://nrt.org/sites/73/files/INCIDENT_MANAGEMENT_HANDBOOK_COMDTPUB_3120.pdf
U.S. Coast Guard. ALCOAST 089/25 – ICS Position Qualification Standard Updates.
https://content.govdelivery.com/accounts/USDHSCG/bulletins/3d41c0c - CISA. Emergency Communications Technical Assistance and Planning Guide.
https://www.cisa.gov/sites/default/files/publications/FY2021_TA_SCIP_Guide_Signed_508.pdf
CISA. All-Hazards Information Technology Service Unit Leader Position Task Book.
https://www.kansastag.gov/DocumentCenter/View/3506/Information-Technology-Service-Unit-Leader-Position-Task-Book-PDF - NWCG. Incident Communications Center Manager Position Description.
https://www.nwcg.gov/positions/incident-communications-center-manager
NWCG. Incident Technology Support Specialist.
https://www.nwcg.gov/committee/finance-and-business-management-committee/ad-positions/incident-technology-support-specialist - NWCG. Medical Unit Leader Position Description.
https://www.nwcg.gov/positions/medical-unit-leader - NWCG. Incident Position Standards for Medical Unit Leader, PMS 350-39.
https://www-nwcg.fs2c.usda.gov/publications/pms350-39
NWCG. ICS 206-WF Medical Plan.
https://fs-prod-nwcg.s3.us-gov-west-1.amazonaws.com/icsproduct/ics-206-wf.docx
FEMA. ICS Form 206 Medical Plan.
https://training.fema.gov/emiweb/is/icsresource/assets/ics%20forms/ics%20form%20206,%20medical%20plan%20(v3).pdf