<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-on-call-rotation-management
description: >-
  Design and manage on-call rotation schedules for incident response
  teams including fair rotation algorithms, escalation policies,
  fatigue monitoring, and coverage gap detection.
domain: cybersecurity
subdomain: incident-management
tags:
  - on-call
  - rotation
  - scheduling
  - escalation
  - fatigue-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.CO-1", "RS.RP-1", "PR.IP-9"]
  frameworks: ["PagerDuty On-Call Guide", "ITIL Service Operation"]
---

# Building On Call Rotation Management

## Overview

On-call rotation management ensures continuous incident response
coverage with fair workload distribution. Effective rotation systems
prevent burnout through fatigue monitoring, detect coverage gaps before
they occur, implement multi-tier escalation, and provide responders
with clear schedules and swap capabilities.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Responder roster | Team members with skills and availability |
| Coverage requirements | 24/7 or business-hours, timezone distribution |
| Escalation policy | Timeout-based escalation tiers |
| Alerting platform | PagerDuty, Opsgenie, or equivalent |

## Key Concepts

### Rotation Types

| Type | Description | Best For |
|------|------------|---------|
| Weekly | One person per week | Small teams (3-5) |
| Daily | Rotate daily | Medium teams (5-10) |
| Follow-the-sun | Timezone-based handoff | Global teams |
| Split shift | Day/night split | 24/7 with regional teams |

### Escalation Policy

```
ALERT TRIGGERED
       │
       ▼
┌──────────────┐   No ACK    ┌──────────────┐
│ Tier 1:      │──(5 min)───▶│ Tier 2:      │
│ Primary      │             │ Secondary    │
│ On-Call      │             │ On-Call      │
└──────────────┘             └──────┬───────┘
                                    │ No ACK
                                    │ (10 min)
                              ┌─────▼────────┐
                              │ Tier 3:      │
                              │ Team Lead /  │
                              │ Manager      │
                              └──────┬───────┘
                                     │ No ACK
                                     │ (15 min)
                              ┌──────▼───────┐
                              │ Tier 4:      │
                              │ VP / Director│
                              │ (Page all)   │
                              └──────────────┘
```

### Fatigue Metrics

| Metric | Threshold | Action |
|--------|-----------|--------|
| Pages per shift | > 20 | Review alert tuning |
| Off-hours pages | > 5 per night | Escalation policy review |
| Consecutive on-call days | > 7 | Mandatory rotation |
| Incident-free recovery | < 24 hours | Schedule swap |
| MTTR impact | > 2x baseline | Fatigue intervention |

### Coverage Heat Map

```
         Mon  Tue  Wed  Thu  Fri  Sat  Sun
00-06:   ██   ██   ██   ██   ██   ░░   ░░
06-12:   ██   ██   ██   ██   ██   ██   ░░
12-18:   ██   ██   ██   ██   ██   ██   ██
18-24:   ██   ██   ██   ██   ██   ░░   ░░

██ = Full coverage  ░░ = Gap detected
```

## Workflow

1. Define coverage requirements and team availability
2. Generate rotation schedule with fair distribution
3. Configure escalation policy tiers
4. Detect and resolve coverage gaps
5. Monitor responder fatigue metrics
6. Enable schedule swaps and overrides
7. Report on rotation health quarterly

```bash
# Generate rotation schedule
node agent.js generate-schedule --team security-ir \
  --rotation-type weekly --start-date 2026-02-01

# Check for coverage gaps
node agent.js check-coverage --team security-ir \
  --period next-30-days

# Monitor fatigue metrics
node agent.js fatigue-report --team security-ir
```

## Verification

- [ ] 24/7 coverage maintained with no gaps
- [ ] Fair rotation distribution across team members
- [ ] Escalation policy tested monthly
- [ ] Fatigue thresholds monitored and enforced
- [ ] Schedule published 30 days in advance

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- PagerDuty On-Call Guide
