Incident Response Phrasal Verbs

Correct: roll back — revert a deployment or system change to a previous known-good state

roll back is one of the most critical phrasal verbs in incident response. It means to undo a recent change and return the system to its previous state. This is distinct from "roll out" (deploying something new) — rolling back is the emergency reversal of a roll-out.

In incident response contexts:

• "Error rate spiked — roll back the config change." ✓
• "We need to roll back to version 2.4.1 immediately." ✓
• "The IC ordered a rollback — all services should be reverting." ✓

Why B is wrong: "roll out" means to deploy something new or expand something gradually — "We're rolling out the new feature to 10% of users." It is the opposite of rolling back.

Why C is wrong: "roll over" means to move funds from one account to another, or to knock something down. Not used in deployment contexts.

Why D is wrong: "roll up" means to arrive, or to aggregate data — "The metrics roll up into a dashboard." Not used for deployment reversals.

Incident response deployment phrases:

• "Roll back the deploy — we can investigate after." (IC command)
• "Rollback initiated — ETA 3 minutes." (engineer update)
• "After the rollback, confirm services are green." (verification step)

Correct: spin up — create, initialise, and start a new compute resource, container, or service

spin up means to bring a new infrastructure component into operation. In incident response it is used when the team needs to rapidly provision additional capacity — a new instance, a new container, a new region — to respond to the failure.

In incident and infrastructure contexts:

• "Spin up a replacement instance in us-east-2." ✓
• "Can you spin up an emergency debug environment?" ✓
• "We spun up three additional nodes to absorb the traffic." ✓

Why B is wrong: "spin out" means to lose control (of a vehicle), or in business to create a separate company from a division. Not used for provisioning infrastructure.

Why C is wrong: "spin off" means to create a new independent entity from part of an existing organisation. Not an infrastructure term.

Why D is wrong: "spin down" is the correct opposite of "spin up" — it means to stop and remove a running resource. "Spin down the test environment when you're done."

Infrastructure provisioning phrases:

• "Spin up a canary instance before the full rollout." (pre-incident)
• "Spin up a replacement — the primary is unrecoverable." (incident)
• "Spin down the emergency instance once traffic normalises." (recovery)

Correct: shut down — stop a service, system, or machine completely and cleanly

shut down means to bring something to a complete stop — a server, a service, a process. In security incidents it is used for isolation: stopping a compromised service prevents lateral movement. It implies a clean, controlled stop (vs. "kill" or "terminate" which are more abrupt).

In security incident contexts:

• "Shut down the compromised node before it reaches the database tier." ✓
• "We're shutting down the affected services to contain the breach." ✓
• "All public-facing endpoints have been shut down pending investigation." ✓

Why B is different: "shut off" means to stop the flow or supply of something — electricity, water, gas — and can be used for services, but "shut down" is the standard term in IT/infrastructure contexts. Both are technically correct, but "shut down" is more standard in incident response.

Why C is wrong: "shut out" means to exclude someone from a place or opportunity — "She was shut out of the decision." Not used for stopping services.

Why D is wrong: "shut up" means to stop talking. Never used in professional technical contexts for stopping services.

Incident containment phrases:

• "Shut down the service and isolate the node." (containment step)
• "Service has been shut down — no further requests are being processed." (status update)
• "After shutdown, do a memory dump before restarting." (forensics step)

Correct: bring up — introduce a topic, piece of information, or status update into the discussion

bring up in incident call contexts means to introduce a specific piece of information that the group needs to consider — a status, a finding, a concern. The IC asked the engineer to "bring up" the upstream status, meaning: share it with the group and put it on the table for discussion.

In incident call contexts:

• "Can you bring up the status page for the payment provider?" ✓
• "She brought up the replication lag metric just as we were discussing options." ✓
• "Bring up the error logs on your screen so we can all see them." ✓

Note on dual meaning: In IT, "bring up" also has a technical meaning — to start a service: "Run docker compose up to bring up all services." In the context of an incident call, the IC is asking for information to be shared, not a service to be started. Context determines meaning.

Why B is wrong: "bring in" means to involve an additional person or resource — "Let's bring in the DBA team." Not used for introducing information.

Why C is wrong: "bring on" means to cause something to happen — "What brought on the outage?" Not used for introducing information in calls.

Why D is wrong: "bring about" means to cause a change or result — "The new process brought about significant improvements." Not used in incident call communication.

Incident call communication phrases:

• "Bring up the monitoring dashboard — what's the current error rate?"
• "She brought up the circuit breaker status to the group."
• "Can you bring in someone from the database team?" (involving a person)

Correct: hand off — transfer ownership or responsibility to another person, especially in an ongoing situation

hand off (also written as "handoff" as a noun) is the standard term in incident management for transferring the active incident, its context, and ongoing responsibilities to another engineer or team. It is used specifically for ongoing situations — live incidents, on-call shifts, active investigations — not just completing a task.

In incident response and on-call contexts:

• "The night engineer will hand off to the day team at 08:00." ✓
• "Prepare a handoff summary before your shift ends." ✓
• "The IC handed off to Priya after 3 hours to prevent fatigue." ✓

Why B is similar but different: "hand over" is also used for transfers of responsibility — "She handed over the project to the Berlin team" — and is broadly interchangeable with "hand off" in many contexts. However, "hand off" is the more specific term in on-call and incident management, implying an active, time-sensitive transfer with a full context briefing.

Why C is wrong: "hand out" means to distribute something to multiple people — "She handed out the agenda." Not used for responsibility transfers.

Why D is wrong: "hand in" means to submit something — "Please hand in your pull request for review." Not used for responsibility transfers.

On-call and incident handoff phrases:

• "Handoff to the day team at 07:00 — bring the incident summary." (instruction)
• "I'm handing off — here's the current status and open questions." (the handoff statement)
• "After the handoff, stay available for 30 minutes in case questions come up." (process)