Leadership, Command, and the ICS Framework: The Critical Gaps Security Managers Can’t Ignore
How security leaders take charge when emergencies hit without warning
By Cyprian Musanya
In every major crisis, leadership determines whether order holds or confusion takes over. Security personnel operate in environments where confusion, fear, and incomplete information dominate. When an incident strikes, a manager’s ability to lead and command determines whether their staff acts with coordination or spirals into chaos.
The reality is clear. In Nairobi, during the Westgate Mall attack (2013), initial reports described a mix of bravery and disarray. Some private security personnel evacuated civilians effectively, while others froze, uncertain about authority. Multiple security agencies responded without a unified command, and delays in action cost lives. The siege lasted nearly four days, resulting in 71 deaths and 200+ injuries. Friendly fire incidents further complicated operations, showing how gaps in coordination and command can be deadly.
Similarly, the DusitD2 attack (2019) unfolded over 22 hours. Armed militants struck the hotel complex with explosives and gunfire. Security responders, including Kenya’s General Service Unit, acted with greater coordination than in Westgate, neutralizing the attackers and saving lives. Investigations highlighted the importance of prior intelligence, preparedness drills, and clear operational roles.
Moments like these underline why senior security managers must master leadership, command, and the Incident Command System (ICS). These are the systems that keep responses coordinated and effective.
What Leadership Means in Security
Leadership is more than giving instructions. It is the ability to influence and guide people toward a shared goal, even under extreme stress. Security leaders rarely have perfect information or time. They must act decisively and inspire their personnel to follow.
John C. Maxwell wrote: “A leader is one who knows the way, goes the way, and shows the way.” In high-risk settings, this principle is survival. Your staff mirrors your composure, clarity, and decisiveness.
Preparation is essential. Personnel will perform as well as the training, briefings, and trust built long before a crisis hits.
What Command Brings to the Table
If leadership inspires, command establishes order. It provides the lawful authority to direct people and resources, creating structure amid chaos.
Security managers exercise command to:
Define roles and responsibilities.
Eliminate duplication or conflicting decisions.
Ensure accountability for actions and reporting.
Without clear command, leadership risks becoming mere suggestion. In an emergency, both influence and authority are needed.
The Role of the Incident Command System (ICS)
The United States’ Federal Emergency Management Agency (FEMA) developed ICS after wildfires revealed fatal communication failures. Since then, ICS has been applied to natural disasters, terrorist attacks, and other emergencies. Its principles fit private security as well.
ICS provides a clear structure for managing incidents. Flexible and scalable, it lets units integrate seamlessly with law enforcement, medical personnel, and fire services.
Key ICS principles include:
Unity of Command: Each individual reports to only one supervisor.
Common Terminology: Avoids jargon and ensures clear instructions.
Modular Organization: Expands or contracts depending on incident scale.
Integrated Communications: Establishes reliable information-sharing across members.
In a crisis, ICS acts as the antidote to chaos.
Communication in the Heat of an Incident
When shots ring out or alarms sound, communication becomes oxygen. Without it, even skilled personnel freeze.
Effective incident communication involves:
1. Initial Briefings
Explain the situation, known threats, and objectives.
Assign roles per ICS principles.
Ensure every member knows their reporting line.
2. During the Incident
Use plain language; avoid confusing codes.
Keep channels disciplined, no unnecessary chatter.
Update assignments as situations evolve.
3. After the Incident
Conduct structured debriefs.
Document timelines, decisions, and outcomes.
Capture lessons while details are fresh.
In Westgate, competing commands and unclear communication delayed operations, contributing to casualties. The DusitD2 response showed the advantage of shared terminology and established reporting lines.
After-Action Reviews: Turning Experience into Actionable Learning
Once the dust settles, the work continues. Every incident—well or poorly handled—carries lessons shaping future responses.
An After-Action Review (AAR) asks:
What was planned?
What actually happened?
Why did it happen that way?
What will we do differently next time?
AARs must be honest but constructive. Mistakes are only wasted if they aren’t documented and analyzed.
Practical Training for Security Managers
Preparation must be hands-on. Senior managers benefit most from exercises that replicate real crises:
Tabletop Exercises: Walk through hypothetical scenarios step by step. Example: a bomb threat in a corporate headquarters.
Role-Play Briefings: Deliver urgent instructions under incomplete information.
Simulated Incident Command: Assign ICS roles in a live drill with evolving threats.
After-Action Writing Drills: Document mock incidents with timelines and decisions.
These exercises build muscle memory. Under real stress, preparation makes the difference between chaos and coordinated action.
Lessons from Nairobi: Westgate & DusitD2
Westgate Mall (2013): Multi-agency coordination gaps, delayed response, and friendly fire showed that authority and communication must be pre-planned.
DusitD2 (2019): Swift, coordinated response and prior intelligence mitigated casualties, proving the value of preparedness and ICS training.
Incidents do not reward intention—they reward readiness.
Insights Gained
Leadership gives direction, command enforces order, and ICS ties the operation together.
Every senior security manager should ask: If my site is attacked today, will my staff know who leads, what to do, and how to communicate?
If the answer is anything less than yes, now is the time to close gaps.
👉 If you want to assess your emergency status, contact me via WhatsApp: +254725614183 for Leadership and Command in Security Operations: Training Manual for Senior Security Managers.
🔗 Connect with me on LinkedIn: Cyprian Musanya