Command Before Crisis: Building the Incident Structure That Runs Before Anything Goes Wrong

Most events deploy security personnel. Very few deploy a command structure. The distinction is invisible when conditions are normal. When they are not, the gap between having people on the floor and having a decision architecture that governs them is the gap where response breaks. Personnel without command is coverage. Command without personnel is a plan with no one to execute it. The events that perform well under pressure have both, and the relationship between them was established before the show opened.

The difference between personnel and command.

Incident command is not a law enforcement concept. It is a management system developed by public safety agencies for a specific kind of environment: dynamic, high-stakes, involving multiple parties who need to coordinate quickly under conditions that are changing. Law enforcement adopted it. Fire services adopted it. Emergency medical services adopted it. Private security has been slow to adopt it, which is one of the reasons that large-scale security failures at public events have a consistent pattern: not enough personnel is almost never the problem. No one knowing who makes the next decision almost always is.

Span of control is the foundational principle. No supervisor should be managing more than seven people, and five is the practical limit in high-pressure conditions. Beyond that threshold, communications degrade, decisions slow, and critical information stops reaching the person who needs to act on it. A large festival with five hundred security personnel and no command architecture does not have one team. It has five hundred individuals whose coordination depends entirely on each person's individual judgment. That is not a security program. It is a deployment.

Span of control at scale.

Unified command is how multi-agency events are governed. A large event typically involves venue security, private protection teams, local law enforcement, and EMS. Each of those agencies has its own authority, its own communication protocols, and its own priorities. Unified command does not override agency authority. It establishes the shared operational picture and the communication architecture that allows multiple agencies to act in concert rather than in parallel. The difference between those two conditions, when something goes wrong, is the difference between a coordinated response and four agencies doing four different things in the same space.

Unified command and the multi-agency environment.

The command layer is pre-operational. It is not built when something goes wrong. It is built during the planning phase, documented in the operations order, and briefed before the event opens. Every position in the command structure knows their role before the first guest arrives. They know their span of responsibility, their trigger conditions, and their escalation path. They know who they report to and who reports to them. When the environment changes, the structure does not need to be invented. It needs to be activated. That activation takes seconds when the groundwork has been laid. It takes minutes when it has not. In most serious incidents, that difference is the margin.

The command layer is built before the show opens.

The 2015 attack I served as initial Incident Commander during taught me one thing above all others: the quality of the response was almost entirely determined by the quality of the preparation. The coordination that happened in the first thirty seconds was possible because everyone in the command structure already knew their role. The decisions that were made quickly were possible because the decision authority had been established before anything happened. You do not build command under pressure. You activate it. The events that come through crisis without compounding it are the ones where someone, during the planning phase, asked the question that most planners skip: not who is on the floor, but who is in command when the floor changes.