Use one incident map
| Starting signal | Initial operational question | Boundary to define |
|---|---|---|
| Server health alert | Is an approved infrastructure fix available? | NOC action authority and business change approval |
| User cannot log in | Is identity verified and is the request within desk scope? | Help desk authentication and application escalation |
| Suspicious endpoint behavior | Is security investigation or containment required? | SOC containment authority and incident communications |
| Backup job failure | Is this a routine job error or a recoverability concern? | Monitoring, repair and restore-test ownership |
| Unavailable application | Is the cause network, vendor, identity or security related? | A single incident owner across teams |
The table is an illustrative routing aid. A supplier may offer more or fewer actions than its category suggests. Monitoring an endpoint does not establish permission to isolate it. Handling a user call does not establish permission to disclose incident details. Put those actions in the responsibility matrix explicitly.
Avoid a gap between queues
Select one coordinating owner for a cross-service incident. Each handoff should contain the affected tenant and asset, observed signal, actions already taken, remaining uncertainty, severity, communication state and the next decision needed. The receiving team should accept the handoff; sending an email is not evidence of acceptance.
For an illustrative test, create an application outage with a suspicious endpoint signal. The desk gathers user impact, the NOC checks permitted infrastructure evidence and the security team evaluates the signal. No team should silently close the parent incident because its own task is complete. The parent closes only after the agreed owner verifies the outcome and records unresolved follow-up work.
Price distinct obligations
Ask for separate service lines and intake rules. A NOC price per enrolled endpoint cannot be compared directly with a help desk price per user or a security service priced by log volume. Count the internal time needed to coordinate vendors and approve changes. Confirm whether a cross-service escalation generates another billable unit or waits in a separate queue.
Keep business accountability, client commitments and major change authorization assigned even when execution is outsourced. Use the NOC guide, help desk guide and SLA worksheet to define the purchase. Before enrolling clients, run a NOC pilot and a help desk pilot against the shared handoff rules.