Shrinking the Red Slice
Why Red Teaming and Community Lifelines Are Operational Infrastructure
This is the third article in Ground Truth, a five-part series by Jim Featherstone on the structural challenges of crisis and emergency management.
Every crisis and emergency management organization operates with a red slice: the small share of its situational awareness devoted to what it doesn’t know it doesn’t know. Small in percentage. Catastrophic in consequence. That is where most operational failures originate, and it is smaller only for the organizations that work at shrinking it on purpose.
The Three Categories of What We Know
In 2002, Donald Rumsfeld made an observation that was mocked at the time and has since been quietly vindicated by anyone who has run an operation under real uncertainty. Known knowns. Known unknowns. Unknown unknowns, the ones we don’t know we don’t know.
He was talking about intelligence. He was describing crisis and emergency management.
Picture your organization’s situational awareness as a pie chart. Roughly 75% green, what you know. About 20% is yellow: the gaps you’ve identified. And 5% red, what you don’t know you don’t know. Five percent sounds small. It isn’t. The red slice is where most catastrophic operational failures originate.
Every organization believes its red slice is smaller than it actually is. By definition, you cannot see what you cannot see.
Confidence Is Not Protection
The Maginot Line was built by highly competent engineers with complete confidence in their analysis. Their confidence was their vulnerability. The line was not defeated. It was bypassed because the operating assumption that Germany would attack the same terrain it had crossed in 1914 was invisible to the engineers who built the defense. They did not know they were assuming it.
The same dynamic surfaces repeatedly in crisis after-action reviews. Not incompetence. Invisible assumptions. The exercises passed. The plans validated. The team was well-trained. And then a decision surfaced that no one had anticipated, and the plan had no answer for it.
That is what a red-slice failure looks like from the inside.
The Structural Problem: The Default to Law and Fire
Crisis and emergency management has a default instinct. When something goes wrong, defer to Law Enforcement and Fire. That instinct is understandable. Those disciplines are trained for immediate life safety, and they show up first.
But defaulting to Law and Fire narrows the field of vision at exactly the moment when breadth of perspective matters most. And the narrowing is not random. It is structural. It reflects how crisis management is organized, staffed, and exercised.
FEMA’s Community Lifelines construct offers a direct corrective. Introduced in the National Response Framework and updated in 2024, the Lifelines framework identifies eight categories of essential services that communities need to survive and recover. Safety and Security, the domain of Law and Fire, is the first. It is not the only one.
The Eight Community Lifelines
Each lifeline implies disciplines, community organizations, and private-sector entities that, by default, rarely sit at the crisis-management table.
Safety and Security. Law enforcement, fire service, search and rescue, government continuity.
Food, Hydration, and Shelter. Grocery supply chains, food banks, commodities logistics, shelter operators, and voluntary organizations.
Health and Medical. Hospitals, EMS, public health, pharmacies, behavioral health, home health providers.
Energy. Utilities, fuel distributors, generator operators, energy regulators.
Communications. Telecommunications carriers, broadcasters, and alert and warning systems.
Transportation. Road and bridge operators, transit agencies, ports, logistics and freight networks.
Hazardous Materials. Environmental health agencies, hazmat contractors, industrial facility operators.
Water Systems. Water utilities, wastewater treatment, stormwater management, and infrastructure repair contractors.
Every absent perspective is a gap in situational awareness. Gaps in situational awareness are unknown unknowns. Unknown unknowns are the red slice.
A Concrete Example: Hydration, Water Infrastructure, and the Grocery Gap
The 2024 separation of Hydration (within Food, Hydration, and Shelter) from Water Systems reflects an operationally significant distinction that crisis plans routinely blur.
Hydration is an immediate life-safety challenge, from hours to days. The logistics lift is distribution: bottled water, ice, points of dispensing, and last-mile delivery to populations who cannot self-evacuate. The partners needed are grocery supply chain operators, voluntary organizations, logistics networks, and local commodities distributors.
Water Systems infrastructure is a restoration and recovery challenge, from weeks to months. The logistics lift is repair and regulatory navigation: utility contractors, environmental clearance, permitting, and infrastructure assessment. The partners needed are utility managers, public works officials, environmental regulators, and specialized contractors.
Both are critical. Neither is the other. A response plan that addresses one and assumes it covers both has a red-slice failure built into it before the disaster arrives.
The people who know how to activate existing distribution infrastructure, the grocery operators, regional distributors, and local logistics networks, are almost never in the room when crisis managers plan.
A 2017 CNA analysis found that in U.S. urban markets with distribution infrastructure intact, the food already held in commercial grocery networks could cover disaster survivors through the critical first two to four weeks post-disaster. The problem is not supply. It is the delivery and the activation of existing distribution infrastructure.
Yet few jurisdictions formally designate grocery stores as critical infrastructure in their pre-disaster planning frameworks, despite the Food, Hydration, and Shelter lifeline pointing directly to that infrastructure. When COVID-19 forced the designation through the CISA Essential Critical Infrastructure Workers guidance, it was reactive. For most jurisdictions, it remains so.
The gap between reactive designation and proactive relationship-building, the pre-built partnerships that would allow grocery distribution infrastructure to be activated immediately post-disaster, is itself a red-slice failure. Visible in advance. Preventable in advance. Routinely missed.
A National Academies review of the 2017 hurricane season, commissioned by FEMA, found that government relief supply chains, when sustained beyond immediate need, can compete with and displace the commercial networks communities need to restore normalcy. The default posture, government fills the vacuum, becomes the obstacle to recovery.
Grocery stores were designed, from their first brick, to receive, store, and distribute food and water at scale. Getting them back online meets the immediate need and restarts the local economy in a single move. That requires treating grocery operators as genuine planning partners, not as vendors to be contracted after the fact.
That same National Academies review went further, suggesting that FEMA could be evaluated on the strength of an area's recovery, including the number of local grocery stores, pharmacies, and gas stations reopened, rather than on the volume of relief supplies pushed into an area. The idea has been on the federal table since 2020. Most jurisdictions still have not made grocery operators a planning partner.
Two Mechanisms That Actually Shrink the Red Slice
Red Teaming
Red teaming is structured adversarial analysis, the deliberate practice of challenging your own assumptions before the disaster does it for you. When done correctly, it converts unknown unknowns into known unknowns, which can then be addressed. It is not pessimism. It is operational hygiene.
Red teaming is not the same as an unhappy participant’s post-exercise critique. It is a designated function within planning and exercise cycles, staffed by people whose job is to attack the plan, and protected from the political dynamics that suppress dissent within normal review structures. Without that protection, red teaming devolves into performance and stops producing new information.
Inclusive Collaboration
Inclusive collaboration is a knowledge-based imperative. Every community, discipline, and lived experience carries knowledge that formal training does not. When those perspectives are excluded, the red slice grows. When they are included, it shrinks.
The Community Lifelines framework makes this concrete. It is a ready-made map of the disciplines and partners whose perspectives are needed to keep the red slice as small as possible. Using it as a planning guide for who should be at the table, not just who should be notified, is one of the highest-return changes an organization can make.
What This Requires
Five commitments turn the argument into operational practice.
Institutionalized red teaming. Scheduled, protected, and culturally safe adversarial analysis embedded in planning, exercise design, and after-action review. Not a one-time consultant engagement. A permanent function.
Lifelines-based collaboration architecture. Using all eight Community Lifelines as the planning guide for partner engagement. Identifying in advance the organizations and disciplines each lifeline implies, and building relationships before the disaster.
Proactive critical infrastructure designation. Formally designating grocery stores and food distribution networks as critical infrastructure in pre-disaster plans, with pre-built relationships and activation protocols, not post-disaster contractor agreements.
Honest after-action accounting. Explicitly asking: What surprised us that didn’t need to? What perspectives were absent? What were we assuming that turned out to be wrong?
Exercise design that breaks plans. Tabletop exercises engineered to find the edges of the framework, not to confirm that it works under favorable conditions.
The Case in One Sentence
Uncertainty in crisis and emergency management is permanent. The size of your unknown unknowns is not. The organizations that shrink their red slice will outperform those that don’t, every time.
Red teaming and inclusive collaboration are not soft practices. They are not optional enhancements. They are the operational infrastructure of organizational learning, and FEMA’s Community Lifelines framework is one of the most useful tools available for making that learning systematic.
The disaster will always have a vote. The question is whether you have done everything you could to see it coming.
Key Takeaways
What is the red slice in crisis management?
The red slice is the portion of an organization’s situational awareness devoted to unknown unknowns: the assumptions, gaps, and blind spots the organization is unaware of. It is typically small in percentage and catastrophic in consequence, because it is where most operational failures originate.
Why do most crisis plans have red-slice failures built into them?
Because crisis management structures default to a narrow set of disciplines (Law Enforcement and Fire) at exactly the moments when breadth of perspective matters most. Missing disciplines are not neutral. They are gaps in situational awareness that surface only under real conditions.
What is red teaming in emergency management?
Red teaming is structured adversarial analysis, staffed and scheduled as a permanent function within planning and exercise cycles. Its job is to attack the plan’s assumptions before a real event does. Done correctly, it converts unknown unknowns into known unknowns that can then be addressed through planning, training, or resource decisions.
What are FEMA’s eight Community Lifelines?
Safety and Security; Food, Hydration, and Shelter; Health and Medical; Energy; Communications; Transportation; Hazardous Materials; and Water Systems. Each identifies essential services communities need to survive and recover, and each implies a set of disciplines and partners that should be represented in pre-disaster planning.
Why should grocery stores be designated as critical infrastructure?
Commercial grocery networks were built to receive, store, and distribute food at scale. A 2017 CNA analysis found that in U.S. urban markets with distribution infrastructure intact, the food already in those networks could cover survivors through the first two to four weeks. The constraint is delivery, not supply, and the gap is the absence of pre-built relationships.
How is inclusive collaboration different from stakeholder engagement?
Stakeholder engagement typically notifies partners of decisions. Inclusive collaboration puts those partners at the table when the decisions are being made, because their knowledge changes what the plan can see. Under the Lifelines framework, it is a planning input, not a courtesy.
For Further Reading
Ground Truth 1, The Disaster Always Has a Vote, argues that fixed plans fail against conditions that will not hold still, and that adaptive frameworks outperform them.
Ground Truth 2, A Forced Fit: Why HSEEP is the Wrong Framework for Executive Crisis Leadership, examines what happens when a compliance-driven validation framework is applied to a development challenge.
FEMA’s Community Lifelines framework, updated in 2024, is the source construct for the eight-lifeline planning architecture referenced here.
Palin, P. J. (January 2017), The Role of Groceries in Response to Catastrophes, CNA Institute for Public Research, is the most detailed treatment of grocery infrastructure in disaster response. It is analytic work from a nonprofit research institute rather than peer-reviewed research, and its findings are scoped to dense U.S. urban markets with distribution infrastructure intact.
National Academies of Sciences, Engineering, and Medicine (2020), Strengthening Post-Hurricane Supply Chain Resilience, documents commercial-network capacity and the risk of relief-chain displacement. See Chapter 4, Section 4.1, and Recommendation 1.
About James “Jim” Featherstone
Jim is a seasoned public safety and emergency management leader with over 30 years of experience. He began his career with the Los Angeles Fire Department in 1986 and later served as Interim Fire Chief. He was appointed General Manager of the Los Angeles Emergency Management Department in 2007, leading citywide preparedness and resilience efforts until 2016.
After retiring, he served as Executive Director of the Los Angeles Homeland Security Advisory Council, advancing regional collaboration across Southern California. In 2025, he returned to public service at the Mayor’s request to support Los Angeles’ wildfire response and recovery efforts. Jim currently serves as an Executive Consultant to Emergency Management for Bent Ear Solutions and is the founder and owner of Themata Strategic.
About Bent Ear Solutions
Bent Ear Solutions (BES) was built by and for emergency managers and helps government agencies and critical infrastructure operators get more out of the technology and processes they already have.
BES specializes in operationalizing frameworks, plans, and policies through an organization’s existing technology, supporting quick and accurate decision-making. This takes situational awareness to the next level by improving interoperability, cross-collaboration, and notification in the precise configuration your team needs.
Kentucky Emergency Management runs that approach statewide across all 120 counties, built on the ArcGIS and Microsoft 365 licenses the commonwealth already held, with no new platform fees. The lifeline partners were already reachable. What changed was the architecture connecting them.
