A single-site on-call rotation needs at least eight people to be sustainable, according to Google's SRE book. If two sites share the pager, six can work. Below that, each person carries the pager too often, and the rotation becomes a burnout machine instead of a safety net.
Where the number comes from
The SRE book states that the minimum for on-call duty from a single-site team is eight engineers. The book describes each engineer as on call for about one week per month. For dual-site teams it gives a reasonable minimum of six.
These figures come from an engineering organisation running production services. They are a useful reference point, not a law. Treat them as a way to test your own plan.
What a small team does instead
Most security teams are smaller than eight. That does not mean you give up on a rotation. It means you change something else.
- Widen the pool. Add trained engineers from adjacent teams who can take first-line triage, with security staff as escalation.
- Narrow the scope. Page only for events that need a human within the hour, and push everything else to a queue handled in working hours.
- Share with another site. Two groups in different time zones can each cover their daytime.
- Buy the gap. Use an external monitoring service for overnight triage, with a written escalation path to your people.
The cost of getting it wrong
An understaffed rotation does not fail loudly. People stop sleeping well in the weeks they carry the pager, stop volunteering to swap, and start dreading calendar invites. Attrition follows, which shrinks the pool further. That loop is why the minimum matters.
A quick sizing exercise
- Count the people who are genuinely able to handle first response today.
- Divide 52 weeks by that number to see how many weeks a year each person is on call.
- If the answer is more than about six weeks per person per year, change the scope or the pool before you change the schedule.
The six week figure is a planning heuristic of ours, not from the source. Adjust it with your team.
Common mistakes
Teams often count everyone with the word security in their title, including people who cannot respond to an incident. Count only those who can actually handle a first page.
Another mistake is adding a secondary on-call and calling the problem solved. A second pager doubles the number of people disturbed unless the secondary is rarely called. Define what the secondary does: a backup if the primary does not answer, or a source of advice.
A third is ignoring leave. If four of your eight are away at any one time over summer, you effectively run a team of four. Plan the rota around real availability, and revisit it when someone joins or leaves.
Quick check
Can a team of four run a sustainable on-call rotation?
Not by itself at the book's numbers. A team of four can reduce pages sharply, add trained helpers from other teams, or share the load with a second site.
Does the minimum change if pages are rare?
Yes. The minimum assumes a real incident load. If your pager is nearly silent, a smaller group is less risky, though knowledge sharing still matters.
Sources
Last reviewed: 19 October 2026.
