How to Fill Out and Submit the SITREP Form (ICS 209)

To fill out ICS Form 209, download the current fillable PDF from FEMA’s Incident Command System forms page, gather your incident data before you start typing, complete the roughly 20 required blocks (marked with an asterisk on the form), get the report approved by the incident commander, and submit it through your agency’s designated channel for each operational period.¹ The form itself is a 53-block Incident Status Summary designed for significant incidents that require mutual aid or multi-agency coordination.²

Where to Download the Form

FEMA hosts the complete ICS form library at its training resource site, including ICS Form 209 (v3).¹ Use the PDF version. It has fillable fields and drop-down menus that reduce data-entry errors during a high-stress incident. For wildland fire incidents, the SIT-209 online portal at wildfire.gov collects and stores ICS-209 data electronically to support resource-placement decisions across the interagency system.³

Is the 209 the Right Form for Your Incident?

FEMA’s instructions note that most incidents are short-lived and don’t need the level of detail the 209 demands.² It’s built for situations that consume scarce resources, trigger significant mutual aid, or attract oversight from higher levels. For wildland fire, the National Interagency Mobilization Guide sets concrete thresholds: fires exceeding 100 acres in timber, 300 acres in grass, or any fire assigned a Type 1 or Type 2 Incident Management Team.⁴

For smaller or shorter incidents, ICS Form 201 (Incident Briefing) is the lighter alternative, covering situation summary, objectives, and resource assignments without the full 53-block depth. Both forms live on the same FEMA page.¹

Gather Your Data Before Opening the Form

Trying to populate 53 blocks from memory during an active incident is where most reports fall apart. Emergency management professionals call the categories you need Essential Elements of Information: the data points that generate situational awareness and build a shared picture for everyone involved.⁵

Assemble the following before you start drafting:

The exact reporting period, down to the hour (Block 11 requires this).²
The official incident name, number, and type as recognized by the coordinating agency.
The current size or scope in the metric that fits (acreage, structures affected, population displaced).
Containment or completion percentage at the end of the reporting period.
Significant events since the last report: evacuations, growth, weather shifts, infrastructure failures.
Personnel and resource counts, plus critical needs for the next 12 to 72 hours.
Public and responder safety figures: injuries, fatalities, sheltering numbers, active threats.
Planned actions for the next operational period.

Event-specific data rounds out the picture. Healthcare incidents track bed availability and blood-bank status; infectious disease responses track PPE stockpiles; winter storms track snow-removal capacity and staffing.⁵

Completing the Blocks

The form’s 53 blocks are grouped into logical sections. About 20 are required, marked with an asterisk on the PDF; the rest are optional depending on incident type.² Skipping a required block is the fastest way to get your report bounced back.

Header (Blocks 1–15)

Blocks 1 through 4 capture the incident name, incident number, report version, and incident commander’s name and agency. Block 3 asks whether the report is Initial, Update, or Final; check the right box, because the receiving system tracks the lifecycle of each incident through these version tags.⁴ For incidents under Unified Command, list all primary commanders separated by a slash.

Block 6 records the incident’s original start date and time. It never changes across subsequent updates. Block 11 is the reporting period itself, from date/time to date/time. Confusing the two throws off every timeline analysis done with your data.

Blocks 12 through 15 cover preparation and routing: who prepared the report, the date and time of submission, who approved it, and the primary organization receiving it. All four are required. If you’re not the incident commander, get the approval signature in Block 14 before submitting. Unsigned reports have no authority.

Location and Situation (Blocks 16–30)

Blocks 16 through 27 pin down the incident’s location through state, county, city, jurisdiction, coordinates, and narrative. Block 25 (required) is a short plain-language description of where the incident is. “3 miles NE of Springfield along Highway 14” works better than a bare set of GPS coordinates.

Block 28 is the heart of the report: the narrative summary of significant events for the reporting period. Stick to factual observations. “Fire crossed Highway 9 at approximately 1430 and moved northeast into unburned timber” is useful. “The fire seemed out of control” is not. Use active voice, name the actors, and include times.² Blocks 29 and 30 cover hazardous materials involved and damage assessment data; complete these when applicable.

Status and Threat (Blocks 31–35)

Blocks 31 and 32 are both required. They capture the current status of the public and responders: injuries, fatalities, evacuations, and shelter numbers. Block 34 (also required) addresses how you’re managing threats to life, safety, and health. Leadership looks at these blocks first, so be precise with numbers. Avoid language like “several injuries.” If you know the count, state it. If you don’t, say the count is unconfirmed and give your best estimate with a qualifier.

Strategy and Future Actions (Blocks 36–47)

Block 36 projects how the incident will evolve: growth potential, movement, escalation. Block 37 lists strategic objectives. Block 39 details critical resource needs within 12-, 24-, 48-, and 72-hour windows. That block drives resource-ordering decisions above you, so be specific. “Need 3 Type 3 engines within 24 hours for structure protection on south division” gives the ordering system something to act on. “Need more engines” does not.² Block 41 captures planned actions for the next operational period. If any incident name changes, mergers, or anomalies occurred, note them in Block 47 (Remarks).⁴

Resource Summary (Blocks 48–53)

The final section tallies assigned resources: agencies, equipment types, and total personnel. Block 51 (Total Personnel) should equal the sum of assigned resources and additional personnel. If the numbers don’t add up, expect a callback. Double-check the math before submitting.

Writing Style That Works

The best reports put the single most important piece of information in the first sentence of each section, then layer in supporting detail. A commander scanning fifteen reports shouldn’t have to read three paragraphs of background to find out that a levee is about to fail. Practical rules:

Active voice, past or present tense. “Crew 4 completed structure protection on Pine Street at 1600,” not “Structure protection was completed.”
Quantify everything. Replace “some” with a number, “most” with a percentage. If the exact figure is unknown, give a range and flag it as estimated.
Keep observations in Block 28 and projections in Block 36. Don’t mix the two.
Use the 24-hour clock and a standardized date format. “0830,” not “8:30 AM.” “06/15/2026,” not “June 15th.”
Define abbreviations on first use. Acronym overload makes reports unreadable for incoming personnel who weren’t there yesterday.

Submission Frequency and Distribution

ICS 209 forms are typically completed once daily or once per operational period, plus the initial submission when an incident first qualifies. Organizational guidance may adjust this frequency, especially when operational periods are extremely short and filing a new 209 each period isn’t practical.² For wildland fire, the standard is daily submission during full suppression and weekly (every Thursday) for fires managed under monitoring or confinement strategies, with more frequent updates if significant activity occurs.⁴

The SIT-209 application at wildfire.gov is the primary electronic portal for wildland fire incidents, collecting daily fire activity and large-incident summary data across the interagency system.³ Other agencies use their own secure portals. When digital systems go down (and during large-scale emergencies, they sometimes do), have a backup: a primary channel, an alternate, a contingency, and an emergency fallback method.

However you transmit the report, confirm receipt. An automated acknowledgment from a digital portal counts. A verbal confirmation over radio counts. A report no one reads is worse than no report at all, because it creates a false sense of shared awareness.

Accuracy and Record Retention

Every entry on a report submitted to a federal agency falls within federal jurisdiction, and knowingly including false information carries serious consequences. Under 18 U.S.C. § 1001, anyone who willfully falsifies a material fact or makes a materially false statement in a matter within federal jurisdiction faces up to five years in prison, a fine, or both. If the false statement involves domestic or international terrorism, the maximum imprisonment rises to eight years.⁶ If you don’t have a confirmed number, say it’s estimated. Never fabricate data to fill a blank field.

Federal regulations require recipients of federal awards to retain all records, including supporting documentation, for at least three years from the date of their final financial report. If litigation, an audit, or a claim is active when that three-year window expires, records must be kept until the matter is fully resolved.⁷ Even outside federally funded operations, treat every report as a document that may be reviewed in an after-action investigation, congressional inquiry, or legal proceeding. Archive each version with its original timestamp intact.

Mistakes That Get Reports Bounced

Mixing observations with projections. When Block 28 bleeds into Block 36, the reader can’t tell fact from forecast.
Skipping required blocks. Leaving any of the roughly 20 required fields blank stalls processing and may trigger a resubmission request.
Inconsistent naming. If Block 1 says “Riverside Fire,” Block 28 shouldn’t say “Riverside Complex” unless a formal name change occurred and is documented in Block 47.⁴
Vague resource requests in Block 39. Specify type, quantity, purpose, and time window.
Submitting without approval in Block 14. Unapproved reports create confusion about whether the information is authoritative.
Confusing incident start time with reporting period. Block 6 is locked to the original start date. Block 11 is the window you’re reporting on.

A good report won’t win any writing awards. It gets the right numbers to the right people at the right time, in a format they can compare against yesterday’s report without hunting for changes. Collect data first, write second, confirm receipt third.

1
Federal Emergency Management Agency. ICS Forms
2
Federal Emergency Management Agency. ICS Form 209 – Incident Status Summary
3
Wildland Fire Application Information Portal. SIT-209
4
National Interagency Fire Center. ICS-209 User Guide
5
ASPR TRACIE. Technical Assistance Request: Essential Elements of Information
6
Office of the Law Revision Counsel. 18 USC 1001 – Statements or Entries Generally
7
eCFR. 2 CFR 200.334 – Record Retention Requirements