If you are starting from zero, or starting again after a failed attempt, begin with three metrics. They come from the DORA framework and a decade of cross-industry research. They are simple to collect, hard to game in isolation, and genuinely useful for making decisions.[1]
1. Cycle time
Cycle time measures how long it takes for a code change to go from first commit to running in production. It captures everything: development, code review, testing, deployment, and any waiting time in between.
What it actually tells you: where your bottlenecks are. A long cycle time almost never means your developers are too slow. It usually means work is sitting in queues, reviews are taking days, environments are broken, or the deployment process has too many manual gates. Cycle time is a system metric, not a people metric. When it improves, it means the system around your team is getting better.[3]
2. Deployment frequency
Deployment frequency measures how often your team ships code to production. DORA defines it as the number of successful releases over a given period, typically measured as daily, weekly, or monthly.[4]
What it actually tells you: how confident your team is in their release process. Teams that deploy frequently tend to ship smaller changes, which are easier to review, easier to test, and easier to roll back if something goes wrong. Low deployment frequency is usually a sign that releasing is painful, risky, or both. It is a proxy for the health of your entire delivery pipeline, not a measure of how hard people are working.
3. Incident rate (and recovery time)
Incident rate tracks how often things break in production. Paired with mean time to recovery (MTTR), which measures how quickly the team restores service after a failure, it gives you a picture of your system's reliability and your team's ability to respond under pressure.[5]
What it actually tells you: the quality of what you are shipping and how resilient your systems are. A high incident rate paired with a low MTTR suggests the team is shipping too fast with too little testing, but recovering well. A low incident rate with a high MTTR suggests the system is stable until it is not, and when it breaks, the team struggles. Both patterns point to different, specific improvements.
These three metrics work as a set. Cycle time without deployment frequency can be gamed by pushing incomplete work. Deployment frequency without incident rate rewards speed at the expense of quality. Track them together and they keep each other honest.