Incident Response Time Calculator
Model time-to-respond from paging, acknowledgement and escalation hops, and test it against your severity SLA.
Inputs
Mean Time to Respond
93.0minutes
Response Time as a Duration
1h 33m
Out-of-Hours Penalty Applied
20minutes
Delay From Escalation Hops
30minutes
Margin Against SLA
-33.0minutes
Positive means you meet the SLA with time to spare.
SLA Verdict
Breaches SLA badly — the coverage model cannot support this severity
Step by step
Values used
Alert confirmed to page raised = 10 minutes; Mean acknowledgement time = 8 minutes; Escalation hops before the right responder = 2 hops; Delay per escalation hop = 15 minutes; Coverage model = Business hours plus on-call pager; First containment action after engagement = 25 minutes; Severity SLA for response = 60 minutes
Incident Response Time
Response time = alert-to-page + acknowledgement + out-of-hours penalty + (escalation hops × delay per hop) + first containment action.
SLA margin
SLA margin = severity SLA − response time; a negative margin is a breach, not a near miss.
Mean Time to Respond
= 93.0 minutes
Response Time as a Duration
= 93
Out-of-Hours Penalty Applied
= 20 minutes
Delay From Escalation Hops
= 30 minutes
Margin Against SLA
= -33.0 minutes
SLA Verdict
= Breaches SLA badly — the coverage model cannot support this severity
How it works
Escalation hops are the dominant, most fixable term: each handoff to the next rota, platform team or vendor adds its own acknowledgement wait, so two hops at fifteen minutes cost more than the entire paging chain. The coverage model then adds a fixed penalty representing the wait to get a human engaged out of hours. Severity SLAs are usually written before anyone checks the arithmetic, and a P1 with a sixty-minute response target is unachievable with two escalation hops and a pager rota — that gap is best found on a spreadsheet, not during a ransomware event.
Formulas
Incident Response Time
Response time = alert-to-page + acknowledgement + out-of-hours penalty + (escalation hops × delay per hop) + first containment action.
- out-of-hours penalty
- 0 min for 24×7, ~5 min follow-the-sun, ~20 min pager, ~480 min next-day
- escalation hops
- Handoffs before reaching someone able to act
- first action
- Time to the first change that limits the attacker
SLA margin
SLA margin = severity SLA − response time; a negative margin is a breach, not a near miss.
- severity SLA
- Contractual or policy response target for this severity
Frequently Asked Questions
How is Incident Response Time calculated?
Response time = alert-to-page + acknowledgement + out-of-hours penalty + (escalation hops × delay per hop) + first containment action. Escalation hops are the dominant, most fixable term: each handoff to the next rota, platform team or vendor adds its own acknowledgement wait, so two hops at fifteen minutes cost more than the entire paging chain. The coverage model then adds a fixed penalty representing the wait to get a human engaged out of hours.
Why does Incident Response Time matter?
Severity SLAs are usually written before anyone checks the arithmetic, and a P1 with a sixty-minute response target is unachievable with two escalation hops and a pager rota — that gap is best found on a spreadsheet, not during a ransomware event.
What values do I need to enter?
This calculator takes 7 inputs: Alert confirmed to page raised, Mean acknowledgement time, Escalation hops before the right responder, Delay per escalation hop, Coverage model, First containment action after engagement, Severity SLA for response. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do I cut escalation hops?
Pre-authorise containment actions for the responders who receive the page — host isolation, account disable, token revocation — and page the owning team in parallel rather than in sequence. Most escalation delay is permission-seeking, not knowledge transfer.
Is a pager rota enough for P1 incidents?
It depends on the SLA. A pager reliably adds fifteen to thirty minutes before anyone is at a keyboard. If your P1 target is sixty minutes end-to-end, that penalty plus escalation usually consumes it, which is the standard business case for staffed 24×7 coverage.