The National Incident Management System (NIMS) represents a core set of doctrine, concepts, principles, terminology, and organizational processes that enables effective, efficient, and collaborative incident management. The Incident Command System (ICS), as a component of NIMS, establishes a consistent operational framework that enables government, private sector, and nongovernmental organizations to work together to manage incidents, regardless of cause, size, location, or complexity. This consistency provides the foundation for the use of ICS for all incidents, ranging from daily occurrences to incidents requiring a coordinated Federal response. Many domestic incidents, such as natural disasters or industrial accidents, have an obvious cause and origin. However, other domestic incidents, such as large-scale fires, public health emergencies, explosions, transportation incidents (e.g., train derailments, airplane crashes, bridge collapses), active shooters, terrorist attacks, or other incidents causing mass injuries or fatalities, require an intelligence or investigative component to determine the cause and origin of the incident and/or support incident/disaster operations. The scalability and flexibility of NIMS allows the Intelligence/Investigations (I/I) Function to be seamlessly integrated with the other functions of ICS. The I/I Function within ICS provides a framework that allows for the integration of intelligence and information collection, analysis, and sharing, as well as investigations that identify the cause and origin of an incident regardless of source. If the incident is determined to be a criminal event, the I/I Function leads to the identification, apprehension, and prosecution of the perpetrator. The I/I Function can be used for planned events as well as incidents. This document includes guidance on how various disciplines can use and integrate the I/I Function while adhering to NIMS concepts and principles. It includes information intended for the NIMS practitioner (including the Incident Commander/Unified Command IC/UC]) that assists in the placement of the I/I Function within the command structure; provides guidance that may be used while implementing the I/I Function; and has an accompanying Intelligence/ Investigations Function Field Operations Guide (I/I FFOG). While this document provides an example of the I/I Function at the Section level, the IC/UC has the final determination of the scope and placement of the I/I Function within the command structure. The guidance provided in this document is applicable for both domestic incidents that use conventional unclassified information (e.g., open source information, criminal histories, medical records, or educational records)1 and terrorism incidents where information is often classified and requires the use of national intelligence capabilities.