🚨 Incident Command Language

Assuming command is the formal verbal act by which an engineer takes over as Incident Commander. The standard phrase is "I'm assuming IC" followed by a brief situation summary. This explicit handoff language — borrowed from emergency management — ensures there is never ambiguity about who holds decision-making authority during an active incident.

"Mitigated" means the immediate customer impact has been stopped or reduced, but the root cause may still exist — for example, traffic has been rerouted away from a broken service. "Resolved" means the incident is fully closed: root cause addressed, systems restored to normal operation, and monitoring confirms stability. Using these terms precisely avoids premature closure and sets the correct expectation with stakeholders.

A typical declaration is: "I am declaring this a SEV-1. We have a complete outage affecting all users in the EU region. I'm paging the on-call escalation chain and opening an incident bridge now." The key elements are: the severity label, a one-sentence impact statement, and the immediate actions being taken. Clear, concise language is essential because the incident bridge may include engineers who are still waking up.

An incident bridge is a live communication channel — typically a video call or phone conference — where the incident response team coordinates in real time. Standard bridge language includes structured check-ins ("Ops, what's your status?"), action assignments ("Can you own the rollback?"), and periodic stakeholder updates ("Status as of 14:32: we've identified the failing component and are executing a rollback. ETA to mitigation is 20 minutes.").

The Communications Lead (Comms Lead) owns all external and stakeholder communication during an incident, freeing the Incident Commander to focus on technical resolution. They use templated status update language such as: "We are aware of an issue affecting [service]. Our team is actively investigating. Next update in 30 minutes." They also manage incident status pages and draft executive notifications.

"Standing down" is the formal declaration that the incident is resolved and the response team is no longer on active duty. The Incident Commander typically says: "We are standing down from SEV-1. Service has been restored and we are monitoring for recurrence. The post-mortem will be scheduled within 24 hours." This phrase signals responders that they can return to normal work.

A post-mortem (also called a blameless retrospective) is a structured analysis of an incident written after resolution. Key vocabulary includes: timeline, contributing factors, root cause, action items, detection gap, and mean time to detect (MTTD) / mean time to resolve (MTTR). The phrase "blameless" signals that the goal is systemic improvement, not individual fault-finding.

Escalation language is direct and structured: "I'm upgrading this incident from SEV-2 to SEV-1. Impact has expanded to the payments service and we now have complete transaction failure. I'm notifying executive stakeholders and paging the payments on-call." Always state the new severity, the reason for escalation, and the immediate actions triggered by the escalation.

Unified command is an ICS structure where multiple teams with authority over different parts of the incident share command jointly. In IT, it is used when an incident spans organisational boundaries — for example, a cloud provider outage affecting a client's platform may require unified command between the provider's SRE team and the client's operations team. Decisions require agreement from all command members.

The on-call escalation chain is the ordered sequence of people paged when an incident cannot be resolved at the current support tier. It typically follows this pattern: first the on-call engineer, then the on-call lead, then the engineering manager, then the VP of Engineering. You might say: "The primary on-call hasn't acknowledged in 5 minutes — I'm escalating to the secondary." Understanding this chain and its vocabulary is essential for effective incident communication.