Designing an on-call rotation and its handover

Goal

Keep a service answerable around the clock without burning out the people who answer, and make every shift start with what the previous one learned.

Prerequisites

Alerts that page only for symptoms needing a human, runbooks for the pages that exist, an escalation path that ends with someone who can decide, and agreement on the response time the service actually needs (the SRE book gives 5 minutes for user-facing, time-critical services and 30 minutes for less sensitive ones as typical values).

Steps

1. Define the roles. A primary who acknowledges and triages, a backup who takes fall-through pages and can be called for help; PagerDuty recommends the backup shift follow directly after a primary shift so context carries over, and that the third escalation level be the whole team.
2. Bound the load. The SRE book's rule for its teams is that no more than 25% of an engineer's time is spent on-call and at least 50% on engineering; from that and a primary/backup pair it derives a minimum of eight engineers for a single-site 24/7 rotation. Smaller teams must narrow the hours, share the rotation with a neighbouring team, or accept a weaker guarantee, and say which.
3. Choose shift length and start time so that shifts change during working hours; publish the schedule months ahead and allow self-service swaps. Let new members shadow a full rotation before they are primary.
4. Set a pager budget. The SRE book's bound is two incidents per 12-hour shift, derived from its estimate that an incident takes about six hours including follow-up; when a team is over that bound, the chapter says the team and its leadership put concrete objectives into quarterly planning to bring the load back to a sustainable level.
5. Make the primary's week an on-call week: interrupt-type work belongs to it, and project deadlines do not.
6. Write the handover. At every shift change the outgoing primary records: open incidents and their state, alerts that fired and why, anything flapping or likely to recur, planned changes during the next shift, and runbook gaps found. PagerDuty's guidance is a short summary to the next on-call; a written one survives the next 2 a.m. page.
7. Review monthly: pages per shift, share of pages with a runbook, time to acknowledge, and the handover notes' recurring items, which are the backlog of reliability work.

Expected result

A rotation people can live with for years, and a handover trail that turns repeated pages into engineering tickets.

Limits and test basis

Compensation and legal limits on standby time differ by country and are not covered. Numbers above are the cited sources' figures for their teams, not measurements from any other environment.

Shrink the pager before the rotation

The eight-engineer minimum is derived from a load of two incidents per shift. A team below that size should first ask whether the load is real. Replace cause-based pages with alerts on the service-level objective, using the multi-window, multi-burn-rate rules from the SRE Workbook, so that a page means the error budget is being consumed fast enough to need a person now and everything else becomes a ticket for working hours. With pages per shift near zero, on-call time is standby rather than work, and a team of four can hold a 24/7 rotation inside the 25% bound. Re-measure pages per shift for a month after the change; only if SLO-based pages still exceed the budget does the rotation need more people or narrower hours.