The responsibility matrix
Every NOC conversation should start by placing six steps. For each, the question is the same: the provider, your team, or shared - and if shared, split by what rule?
| Step | What it is | The question to settle in writing |
|---|---|---|
| Monitoring | Collecting signals from endpoints, servers, network, backup | Which sources, which tooling, who maintains the monitors? |
| Acknowledgement | A human (or system) registers the alert; clocks start | Is acknowledgement automated or human, and within what target? |
| Triage | Classifying: severity, deduplication, noise filtering | By whose severity definitions? What may be closed as noise without you? |
| Remediation | Acting on the cause: restarting, patching, fixing | Which actions are in scope, from a written catalogue - and which are forbidden? |
| Escalation | Handing the incident to the next tier - often your team | Trigger, channel, time, and who on your side receives it? |
| Resolution | The incident is closed to an agreed definition | Who declares it, and does closure require your confirmation for client-visible issues? |
Two failure patterns hide in this matrix. Monitoring-only sold as NOC: alerts arrive, nothing acts - you have bought a notification service. And remediation without boundaries: a provider fixing things in client environments without a written action catalogue and change authority rules. Both are resolved by the matrix, not by the service name.
A coverage claim is not an SLA, and acknowledgement is not resolution: "24x7 NOC" tells you the lights are on, not that anyone qualified will fix your 3 am storage failure within any particular time. The service pages linked below take each layer apart.
Service boundaries worth fixing early
- Scope edge - endpoints, servers, network devices, backup jobs, cloud workloads: which are in, at which depth?
- Tooling residence - their stack or yours? Where alerts, tickets and history live decides visibility and exit cost.
- Security boundary - what access the NOC has into client environments, under whose accounts, with what audit trail.
- Retained authority - emergency changes, client communication, maintenance approval: what never moves to the provider.
For backup operations, use the backup monitoring and recovery guide to separate failed-job work, restore verification, recovery approval and application acceptance. A backup alert, a verified point and a completed recovery require different completion conditions.
For scheduled changes, the patch management guide defines update approval, restart authority, completion checks and the owner of failed or offline devices. A monitoring window and an approved change window answer different questions.
For Auvik environments, the Auvik NOC guide connects the exact purchase to collector health, site-specific notification routes and an accepting PSA ticket.
For NinjaOne scheduled work, the NinjaOne NOC guide separates task targeting, run-as identity, Windows patch closeout and maintenance suppression before a proposal.
For Atera environments, the Atera NOC guide compares ticket handling, endpoint actions and staffed capacity, then defines roles, offline maintenance and reboot handback.
What providers publish
Of the 32 providers in the directory, 30 publish service hours, 26 a charging basis or price, and 6 a minimum. Ten publish a notice period. These company-level answers can cover different services; use the source-linked study and ask for terms for the exact service you want.
Choose your route
Three buying scenarios to separate
| Operational problem | Scope to purchase | First exclusions to resolve |
|---|---|---|
| Engineers are interrupted by noisy alerts | Validation, triage and approved routine fixes | Suppression duration, unsupported alerts and approval-dependent changes |
| Maintenance occupies the retained team | Bounded patch and backup operations | Patch rollback, restore testing and business authorization |
| Nights have no accepting infrastructure owner | Staffed coverage and accepted escalation | Calendar, contact failure and unresolved morning handoff |
Three examples show how NOC scope differs: Worksent offers shared or dedicated engineer pods; Infrassist prices its managed NOC by device; Uptime separates server alert triage from remediation. ConnectWise NOC has a ConnectWise RMM dependency.