I recall many years ago you got something like this - can't find it.
I suppose these days things are a lot more complex....
BTW - sub-second response is required.
Not trying to be difficult, but without more information that's a meaningless requirement:
- how many objects is the server handling (databases, tables, indexes, etc)
- how much data is being stored & read (100 rows, 10000000 rows)
- what kind of data is being stored (e.g. character based data is not as efficiently handled as numeric data; xLOBs are nightmarish)
- how efficient is the database design (properly (de)normalised, properly indexed, lotsa triggers, etc)
- how efficient are the queries (lotsa LIKE statements?)
- how many lusers have you let loose on your database ("1 is too many..."

)
- what do the different lusers do (transactional users impact the server differently to report users)
- how is the application written (does it use hitlists or full table reads)
- what's the backup strategy in use (you DO have one, right?)
These are just some questions - off the top of my head - that I'd want answered before beginning to consider sizing. The answers to the questions will lead to more questions, etc, etc.