Emergency Services Sector

Sector Detail

The Emergency Services Sector is comprised of highly skilled and trained personnel, in both paid and volunteer capacities, along with related physical and cyber resources, that provide a wide range of prevention, protection, mitigation, response, and recovery activities. The ESS is geographically distributed across every jurisdiction in the Nation at the federal, state, local, tribal, and territorial levels of government, as well as private-sector resources.

The ESS is composed of five subsectors:

Emergency Management

Emergency Management is an essential government service whose purpose is to apply resources and efforts to mitigate, prevent when possible, protect where feasible, and to respond and recover from all threats and hazards that impact the safety and security of the nation. Emergency Management can be found at the federal, state, local, tribal, and territorial levels of government, and in the private sector. Specialized capabilities frequently include emergency planning and emergency response coordination.

Emergency Medical Services

Emergency Medical Services, commonly known as EMS, is a system that provides pre-hospital, emergency medical care for serious illness or injury and is a system of coordinated response and victim transport. Emergency Medical Services can be found at the federal, state, local, tribal, and territorial levels of government, and in the private sector. EMS personnel are frequently in volunteer or paid positions. Specialized capabilities frequently include medical air and water transportation and ambulance transportation.

Fire and Rescue Services

Fire and Rescue Services respond to natural disasters, such as earthquakes, floods, tornadoes, and hurricanes, as well as to man-made catastrophes, such as hazmat spills, arson, and terrorism, and perform fire suppression, fire prevention, hazardous materials control, emergency rescue, building code enforcement, and public fire safety education. Fire and Rescue Services can be found at the federal, state, local, tribal, and territorial levels of government, and in the private sector. The personnel are frequently in volunteer or paid positions. Specialized capabilities frequently include code enforcement, fire inspection/investigation, technical/specialized rescue, vehicle extraction, and air and marine fire suppression.

Law Enforcement

Law Enforcement is responsible for enforcing laws, maintaining public order, and managing public safety. The primary duties of law enforcement include the investigation, apprehension, and detention of individuals suspected of criminal offenses. Law Enforcement can be found at the federal, state, local, tribal, and territorial levels of government, and in the private sector. Specialized capabilities frequently include bomb squad, canine teams, crime scene investigation, crisis negotiation, riot/crowd control, search and rescue, tactical teams (SWAT), and air and marine units.

Public Works

Public Works provides and sustains structures and services essential to the welfare and acceptable quality of life for the public, including providing water, power, waste disposal, and transportation. Public Works are usually at the state, local, tribal, and territorial levels of government, and in the private sector. Specialized capabilities frequently include construction management, facility management, solid waste management, transportation management, public utility management, and water and wastewater management.

Emergency Services Sector-Specific Plan

The2015 Emergency Services Sector-Specific Plan details how the National Infrastructure Protection Plan (NIPP) 2013 risk management framework is implemented within the context of the unique characteristics and risk landscape of the sector. The Emergency Services Sector Risk Management Agency (SRMA) developed their sector-specific plan through a coordinated effort involving its public and private sector partners. The Cybersecurity and Infrastructure Security Agency (CISA), within the U.S. Department of Homeland Security, serves as the Sector Risk Management Agency for the Emergency Services Sector. The ESS has dependencies and interdependencies with multiple critical infrastructure sectors, and the National Response Framework's Emergency Support Functions provide assistance for both the operation and protection of ESS assets.

Emergency Services Sector Profile

The Emergency Services Sector Profile has been compiled by CISA, as the Emergency Services SRMA, to present a picture of the ESS as a whole and to define critical infrastructure sector dependencies and interdependencies, in order to improve federal and sector coordination and improve ESS security and resilience.

Emergency Services Sector Landscape

The Emergency Services Sector Landscape addresses multiple factors which can affect the security and resilience of the Emergency Services Sector. These factors, which influence the current operating environment and associated decision-making processes, stem from environmental, technological, human, and physical causes. As the ESS focuses on protecting other sectors and the public, unique challenges arise in addressing the security and resilience of the ESS. The incapacitation of any of the assets, networks, or systems in this sector, whether physical or virtual, could cause significant harm or loss of life, public health issues, or long-term economic loss.

Emergency Services Sector Risk Management Agency

The Cybersecurity and Infrastructure Security Agency, within the U.S. Department of Homeland Security, serves as the Emergency Services Sector Risk Management Agency.

Emergency Services Sector Resilience Development Program

The Emergency Services Sector Resilience Development Program (ESS RDP) is a suite of existing resources and best practices that are specifically tailored to meet the unique resilience needs of the first responder community.

Emergency Services Sector Resilience Development Webinar Series

The Emergency Services Sector Resilience Development Webinar Series (ESS RDWS) is facilitated by the Emergency Services Sector Management Team and is a quarterly webinar series that focuses on topics of interest to ESS stakeholders.

Emergency Services Sector Continuity Planning Suite

The Emergency Services Sector Continuity Planning Suite (ESS CPS) provides a centralized collection of existing guidance, processes, products, tools, and best practices to support the development and maturation of continuity planning for the first responder community. The ESS CPS was created through a partnership of the Emergency Services Sector Risk Management Agency and Sector Coordinating Council (SCC). First responders can use the ESS CPS as it suits their organization to evaluate and improve their continuity capability and enhance their preparedness for emergencies.

Emergency Services Sector-Specific Tabletop Exercise Program

The Emergency Services Sector-Specific Tabletop Exercise Program is a tool allowing critical infrastructure partners to develop interactive, discussion-based exercises for their communities of interest, be it at the sector or facility level. The Program affords the opportunity for public and private critical infrastructure stakeholders and their public safety partners to exercise information sharing processes and incident management plans, programs, policies, and procedures in order to address potential gaps, vulnerabilities, and other pertinent issues.

Emergency Services Sector Cybersecurity Initiative

The Emergency Services Sector Cybersecurity Initiative is an ongoing effort to enable the Emergency Services Sector to better understand and manage cyber risks and to coordinate the sharing of cyber information and tools between subject matter experts (both inside and outside the federal government) and the ESS disciplines.

Reporting a Cybersecurity Incident

The CISA Services Portal provides a secure means for constituents and partners to report incidents, phishing attempts, malware, and vulnerabilities. You have the option to either create an account to save and continue your progress and to track the progress of your issue.

• The CISA Incident Reporting System provides a secure web-enabled means of reporting computer security incidents to CISA. This system assists analysts in providing timely handling of your security incidents as well as the ability to conduct improved analysis.
• CISA’s Cyber Threat Indicator and Defensive Measures Submission System provides a secure, web-enabled method of sharing cyber threat indicators and defensive measures with DHS. This system helps analysts to process cyber threat indicators and defensive measures for further sharing with Federal Government and private sector entities.
• CISA's Malware Next-Generation Analysis platform provides automated malware analysis support for all U.S. federal, state, local, tribal, and territorial government agencies. Analysis is performed by a combination of static and dynamic analysis tools in a secure environment and results are available in PDF and STIX 2.1 data formats.
• Sponsored by CISA, Carnegie Mellon University Software Engineering Institute’s CERT Coordination Center provides a tool to Report a Vulnerability for Software or ICS Vulnerabilities and Vulnerabilities in U.S. Government Websites.

What is an Incident?

For the federal government, incident, as defined by the Federal Information Security Modernization Act of 2014 (44 USC 3552), means an occurrence that-

(A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

(B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

Federal incident notification guidelines, including definitions and reporting timeframes can be found at https://www.us-cert.gov/incident-notification-guidelines.

In general, types of activity that may qualify as an incident include but are not limited to:

• network intrusions that gain unauthorized access to a system or its data, including Personally Identifiable Information (PII) related incidents
• malicious disruption or denial of service
• the unauthorized use of a system for modifying data
• changes to system hardware, firmware, or software characteristics without the owner's knowledge, instruction, or consent

We encourage you to report any activities that you feel meet the definition of an incident.

Cybersecurity Alerts and Advisories

CISA and its partners provide multiple resources providing cybersecurity alerts and advisories.

• CISA’s Cybersecurity Alerts & Advisories webpage has the most current, publicly-releasable alerts and advisories which can be broken down by sector, audience, topic, vendor, and other categories.
• CISA’s Secure by Design Alert Series highlights the prevalence of widely known and documented vulnerabilities, with available and effective mitigations, that have not been eliminated.
• CISA’s Stop Ransomware Alerts webpage with links to:
  • Official Alerts & Statements - CISA webpage with updates to help stakeholders guard against the ever-evolving ransomware threat environment. These alerts, current activity reports, analysis reports, and joint statements are geared toward system administrators and other technical staff to bolster their organization's security posture.
  • Official Alerts & Statements - FBI webpage with updates to help stakeholders guard against the ever-evolving ransomware threat environment. These advisories, FBI Flashes, FBI Private Industry Notifications (PINs) and joint statements are designed to help cybersecurity professionals and system administrators' guard against the persistent malicious actions of cyber actors.
  • U.S. Department of the Treasury’s FinCEN Alerts/Advisories/Notices/Bulletins/Fact Sheets webpage with public and non-public advisories to financial institutions concerning money laundering or terrorist financing threats and vulnerabilities for the purpose of enabling financial institutions to guard against such threats.  Advisories often contain illicit activity typologies, red flags that facilitate monitoring, and guidance on complying with FinCEN regulations to address those threats and vulnerabilities.
• CISA’s Public Safety Emergency Communications Resources webpage with resources specifically for public safety emergency communications organizations.

Emergency Services Sector Active Shooter Guide

The purpose of the Emergency Services Sector Active Shooter Guide is to provide emergency services personnel with the basic building blocks for developing an Active Shooter Program with communities. This guide highlights resources and planning considerations, which will enhance emergency services organizations’ ability to develop or improve community planning and preparedness for active shooter incidents.

Emergency Services Sector Partnerships

Emergency Services Sector Coordinating Council

The Emergency Services Sector Coordinating Council (ESSCC) was established in July 2004 at the behest of the U.S. Department of Homeland Security. The mission of the ESSCC is to protect and promote the capabilities of the ESS to provide services to the public, the other critical infrastructure sectors, and the nation.

Emergency Services Government Coordinating Council

The mission and purpose of the Emergency Services Government Coordinating Council (ESGCC) is to provide effective interagency, intergovernmental, and cross-jurisdictional coordination of activities, strategies, and policies that are relevant to the cybersecurity, infrastructure security, and resilience of the Emergency Services Sector. The ESGCC acts as the Federal government counterpart and partner to the ESSCC to plan, prioritize, coordinate, implement, and execute sufficient and necessary sector-wide cybersecurity, infrastructure security, and resilience efforts.

Additional Resources

Xylazine Awareness for First Responders

The Xylazine Awareness for First Responders factsheet provides information about Xylazine or “tranq”, a strong sedative used in veterinary medicine. The drug is not approved for human use, yet is increasingly being mixed with controlled substances to extend the effects of opioids in recreational drug use.

Emergency Management and Response - Information Sharing and Analysis Center

The U.S. Fire Administration's Emergency Management and Response - Information Sharing and Analysis Center (EMR - ISAC) is a major information sharing hub for the dissemination of critical infrastructure protection and emerging threat information for the Emergency Services Sector (ESS).

The EMR-ISAC distributes a weekly open-source newsletter, the InfoGram, which includes short articles about the protection of critical infrastructure and emergency responders.

Distributed as needed, EMR–ISAC also shares For Official Use Only (FOUO) Bulletins containing timely, important homeland security information affecting the ESS. Personnel currently serving in positions supporting an ESS department, agency, or function may be eligible to receive these FOUO Bulletins.

The Homeland Security Information Network - Emergency Services (HSIN - ES) community is an information clearinghouse for emergency services professionals across the United States. Whether obtaining information about a significant incident or researching a potential threat to their jurisdiction, emergency services personnel know they can turn to HSIN–ES to get resources including situational awareness reports; threat and vulnerability information; critical infrastructure protection information bulletins, alerts and advisories; state, local, tribal and territorial products; training and conference information; and relevant news feeds. HSIN – ES contains a compilation of unclassified, FOUO, and Law Enforcement Sensitive (LES) products.

Security Advisors

Within each CISA Region are local and regional Protective Security Advisors (PSAs), Cyber Security Advisors (CSAs), Emergency Communications Coordinators (ECCs), and Chemical Security Inspectors (CSIs). In order to build stakeholder resiliency and form partnerships, these field personnel assess, advise, assist, and provide a variety of risk management and response services.

Emergency Communications Division

CISA's Emergency Communications Division supports and promotes communications used by emergency responders and government officials to keep America safe, secure, and resilient. CISA leads the Nation’s operable and interoperable public safety and national security and emergency preparedness (NS/EP) communications efforts. CISA provides training, coordination, tools, and guidance to help its federal, state, local, tribal, territorial, and industry partners develop their emergency communications capabilities. CISA'S programs and services coordinate emergency communications planning, preparation, and evaluation to ensure safer, better-prepared communities nationwide.

Office for State and Local Law Enforcement

The U.S. Department of Homeland Security's Office for State and Local Law Enforcement (OSLLE) was created on the recommendation of the 9/11 Commission to provide DHS with primary coordination, liaison, and advocacy for state, local, tribal, territorial, and campus (SLTTC) law enforcement.

Office for Bombing Prevention

The Office for Bombing Prevention (OBP) leads the Department of Homeland Security’s (DHS) efforts to implement the National Policy for Countering Improvised Explosive Devices (National C-IED Policy) and enhance national security by building public and private capabilities to deter, prevent, and respond to bombing incidents.

Technical Resource for Incident Prevention (TRIPwire) Portal

The Technical Resource for Incident Prevention (TRIPwire) is the Department of Homeland Security's (DHS) online, collaborative information-sharing and resource portal for bomb squads, emergency responders, military personnel, government officials, intelligence analysts, private sector security professionals, and critical infrastructure owners and operators.

Developed and maintained by the DHS Office for Bombing Prevention (OBP), TRIPwire combines expert analyses and reports with relevant documents, images, and videos gathered directly from sources to help users anticipate, identify, and prevent Improvised Explosive Device (IED) incidents. A secure, restricted-access information-sharing platform, TRIPwire is available at no cost to registered subscribers and features a publicly accessible homepage with valuable preparedness information for the whole community.

First Responder Capability

The U.S. Department of Homeland Security (DHS) Science and Technology Directorate’s (S&T) First Responder Capability program provides technical assistance and develops innovative solutions to the most pressing challenges faced by first responders, emergency managers, and incident commanders as they respond to hazardous situations. The program strengthens the abilities of our communities to protect the homeland and respond to disasters.

Fusion Centers

Fusion Centers are state-owned and operated centers that serve as focal points in states and major urban areas for the receipt, analysis, gathering and sharing of threat-related information between State, Local, Tribal and Territorial (SLTT), federal and private sector partners.

Homeland Security Digital Library

The Homeland Security Digital Library (HSDL) is the nation’s premier collection of documents related to homeland security policy, strategy, and organizational management. The HSDL is part of the Naval Postgraduate School Center for Homeland Defense and Security and is sponsored by the U.S. Department of Homeland Security’s National Preparedness Directorate, FEMA.