> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pharussecurity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# On-call rota

> Set up a weekly on-call rota with a primary, a backup and a final escalation, so someone answers when a CRA clock starts on a Friday night.

<Info>
  **Plans:** Core and Plus, and the free trial. **Who:** owners and admins set up the rota and overrides; every member can see it.
</Info>

The CRA's 24-hour early warning runs from the moment you become aware of an actively exploited vulnerability (CRA Art. 14(2)(a)), weekends and public holidays included. The rota tells Pharus who to page when that happens: a primary and a backup for each week, and one person for the final escalation. How the page itself goes out, and how it escalates, is on [Paging](/on-call/paging).

The rota is under **Settings → On-call**.

## How the rota works

* **One row per week.** Each row of the **Weekly rota** has a **Primary** and, if you want, a **Backup**. Pharus goes through the rows in order and starts over after the last one.
* **Handoff to handoff.** A rota week starts on the **Handoff day** at the **Handoff time (Oslo)**, Monday 08:00 by default, and runs until the next handoff. The handoff stays at the same Oslo time when the clocks change for summer time.
* **Where it starts.** Row 1 covers the rota week that contains the date in **First week starts**.
* **Overrides win.** An override replaces the primary or the backup for its period, whatever the row says. If two overrides for the same role overlap, the one that started last applies.
* **Final escalation.** One person, the same every week, who is paged if neither the primary nor the backup acknowledges.

## Set up the rota

<Steps>
  <Step title="Open the on-call settings">
    Go to **Settings → On-call**. Without a rota, **Now on call** says **No rota yet**.
  </Step>

  <Step title="Add the weeks">
    Under **Weekly rota**, pick a **Primary** for each week and, optionally, a **Backup** (or leave **No backup**). Select **Add week** for another row, up to 52. **Move up**, **Move down** and **Remove week** change the order.

    Primary and backup must be different people, and everyone on the rota must be a member of the company. Any member can be on the rota, whatever their role.
  </Step>

  <Step title="Set the handoff">
    Choose the **Handoff day**, the **Handoff time (Oslo)** in 24-hour time, and the date in **First week starts**.
  </Step>

  <Step title="Set the escalation">
    * **Escalate to backup after**: minutes without acknowledgement before the backup is paged, from 1 to 240. The default is 15.
    * **Final escalation**: the member paged if neither primary nor backup acknowledges, or **Nobody**.
    * **Final escalation after**: minutes from the start of the page, from 5 to 1 440. The default is 120.
  </Step>

  <Step title="Save">
    Select **Save rota**. Each save is recorded in the [audit trail](/reports/audit-trail) as "Updated the on-call rota".
  </Step>
</Steps>

<Note>
  If someone on the rota has no phone number, the rota warns you: pages go out by SMS, so ask them to add one under **Your profile**. They also have to verify it; see [Verify your phone number](#verify-your-phone-number).
</Note>

## See who is on call

The top of **Settings → On-call** shows:

* **Now on call**: the **Primary** and the **Backup** right now, until when, and an override with its reason if one applies. Underneath, the escalation in words, for example "Escalates to the backup after 15 min without acknowledgement, then to Kari Nordmann after 120 min."
* **Paging**: whether everyone on the rota has a verified mobile number, and who doesn't. Owners and admins can send a test page from here; see [Paging](/on-call/paging#send-a-test-page).
* **Next 8 weeks**: each rota week from handoff to handoff, with who is primary and backup, Norwegian public holidays, overrides and today marked.

## Weekends and public holidays

The rota has no office hours. Whoever has the week is on call around the clock, including the weekend and any public holiday in it, because the reporting clocks run then too.

The **Next 8 weeks** calendar marks Norwegian public holidays: New Year's Day, Maundy Thursday, Good Friday, Easter Sunday, Easter Monday, Labour Day (1 May), Constitution Day (17 May), Ascension Day, Whit Sunday, Whit Monday, Christmas Day and Boxing Day. Pharus uses the Norwegian calendar only, and a holiday doesn't change who is on call. When someone else should cover a holiday or a day off, add an override.

## Cover a holiday or swap a shift

Overrides are for holidays, swaps and sick days. You need a saved rota first.

<Steps>
  <Step title="Open the form">
    Under **Overrides**, select **Add override**.
  </Step>

  <Step title="Fill it in">
    * **Replaces**: **Primary** or **Backup**.
    * **On call instead**: the member who covers.
    * **From (Oslo)** and **To (Oslo)**: the start and end, in Oslo time. The end must be after the start.
    * **Reason**: optional, for example "Easter". It shows next to the name in **Now on call**.
  </Step>

  <Step title="Save it">
    Select **Add override**. It appears in the list and on the calendar.
  </Step>
</Steps>

The list shows overrides that are running or still to come. To take one back, select **Remove override** on its row. Adding and removing overrides are recorded in the audit trail.

## Verify your phone number

Pharus pages only members who have verified their mobile number with a code by SMS. Everyone on the rota, including the backup and the final escalation, does this for themselves:

<Steps>
  <Step title="Add your number">
    Go to **Settings → Your profile**, enter your **Mobile number** in international format (for example +47 912 34 567) and select **Save profile**.
  </Step>

  <Step title="Get a code">
    Under **Paging**, select **Send code**. Pharus texts you a 6-digit code. It expires in 10 minutes.
  </Step>

  <Step title="Verify">
    Enter the **Code from the SMS** and select **Verify number**. The status changes to **Verified** with the date.
  </Step>
</Steps>

* You can ask for 3 codes in 15 minutes, and try each code 5 times.
* Changing your number clears the verification. Save the new number, then verify it.
* Until you verify, the status reads "Not verified — you won't be paged until you verify", and paging skips you and moves on to the next person in the chain.
* Pages arrive in the language you choose under **Your profile**, or the company's default language.

## Who can do what

| Task | Who |
| - | - |
| See the rota, overrides and calendar | Every member |
| Change the rota and the escalation settings | Owners and admins |
| Add and remove overrides | Owners and admins |
| Send a test page | Owners and admins |
| Verify your own phone number | Every member |

Members see the rota read-only, with the note "Only owners and admins can change the rota."

## After a move to Starter

Starter has no on-call. If a workspace moves to Starter after the trial or from Core, the rota is kept and the calendar still shows who has which week, with the note "Your rota is kept and shown below, but nobody is paged on this plan." Alerts and deadline warnings then go to owners and admins by email only. See [Plans](/plans).

<Note>
  Whoever is paged should be able to file in ENISA's Single Reporting Platform (SRP), which only takes filings from named people with EU Login. If nobody on the rota is recorded as an assigned representative under **Settings → Company**, **Settings → On-call** says so.
</Note>

## Related

<CardGroup cols={2}>
  <Card title="Paging" icon="message-square-text" href="/on-call/paging" />

  <Card title="Notifications" icon="bell" href="/notifications/overview" />

  <Card title="Reporting clocks" icon="alarm-clock" href="/incidents/clocks" />

  <Card title="Members and roles" icon="users" href="/workspace/members-and-roles" />
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.