Building and Setting Up a NOC: The Critical First Steps

Our 4-step NOC business analysis framework

A targeted business analysis is vital in laying the groundwork for a successful NOC. This analysis encompasses four critical areas, each contributing to NOC operations' overall effectiveness and efficiency.

1. Define and articulate your company's support requirements

The first step is understanding your customers' support requirements (and, if external, your customers'). This involves identifying who and what your NOC is supporting, encompassing the nature and size of your end-user and/or customer base and the specifics of your internal infrastructure needs.

• Assess your end-user or customer base. Evaluate the size and characteristics of the groups the NOC will serve to determine the most suitable process model for support. This varies significantly between direct support for an enterprise’s own infrastructure versus a communications service provider supporting multiple customers. For a telecom provider, this might involve analyzing customer usage patterns to predict peak load times and tailor support accordingly. For instance, if a significant portion of your customers operate globally, round-the-clock support becomes essential.
• Identify support gaps. Analyze your existing support functions to pinpoint any capability gaps or performance issues. This could range from staff fatigue to technology shortfalls and even overlooked areas like business continuity. (Talk to us to do this together; we're great at revealing blindspots here.) We suggest conducting a service audit by reviewing ticket resolution times over the past quarter (or longer). Identify patterns where delays occur most frequently—be it in initial response times or specific types of issues, such as network outages or security breaches. This could highlight a need for additional training, etc.
• Define your operational objectives. Clarify your long-term scalability requirements, explore options for NOC design or outsourcing, and ensure mechanisms for maintaining control over outsourced services. This involves understanding service delivery quality, security, and the alignment of internal SLAs with customer-facing SLAs. If considering outsourcing NOC support, conduct a cost-benefit analysis comparing the expenses of in-house operations against projected outsourcing costs, factoring in potential savings in CAPEX investments and from reduced downtime and improved efficiency. Additionally, evaluate the outsourced partner's ability to scale support per your growth projections. (Learn more about our shared support model, which is a main driver of outsourcing for our clients that need a NOC that keeps up with their business.)

Your output at this step should be a comprehensive Support Requirements document that includes:

• A detailed customer base profile, categorizing customers by size, type, and support needs.
• A gap analysis report identifying existing support deficiencies, potential risks, and areas for improvement.
• Operational objectives outlining long-term goals, scalability plans, and considerations for in-house vs. outsourced NOC solutions.
  
  

2. Define your Service Level Objectives (SLOs)

We suggest pausing here to read our guide to NOC service level management. Establishing precise SLOs is crucial for determining the necessary staffing levels, tool configurations, and success measurement metrics within the NOC.

Service Level Objectives (SLO) specify the service, responsibilities, and service level targets that comprise an SLA. In other words, they’re the “substance” of an SLA. For example,  a NOC service provider may establish an SLO that sets the response time for phone calls. Here, a substantive SLO may answer the phones in an average of 30 seconds measured over a month. Another SLO, this one for call handling, might indicate that the maximum time that a call can wait to be answered must be within five minutes. 

Action items:

• Establish your NOC's SLOs. Define clear SLOs for handling calls, emails, and alerts. The specificity of these objectives significantly influences staffing and the NOC's technological infrastructure. We suggest setting specific targets, such as acknowledging alerts within 5 minutes and resolving critical issues within 4 hours. Use historical data to set realistic objectives that push for improvement without being unattainable.
• Adapt to customer/user needs. Recognize that different customers may have unique SLAs, necessitating adjustable SLOs to ensure tailored support. If supporting a client with a significant online retail presence, tailor SLOs around peak shopping periods, ensuring faster response times during the holidays, for instance.
• Establish and review service SLAs. It’s essential to understand the SLAs associated with each service you offer, as this will guide the configuration of your NOC’s support capabilities. If you provide a cloud service, for example, and your SLA commits to 99.9% uptime monthly, back-calculate to determine acceptable downtime and configure NOC monitoring tools to flag any potential threats to this SLA.
• Set up a way to measure SLA adherence. Develop a methodology for measuring the support provided, identifying any measurement gaps to ensure the forthcoming NOC can adequately track and meet SLAs. Implement a dashboard that tracks real-time SLA adherence rates, highlighting services nearing their SLA thresholds and allowing preemptive action to avoid breaches.

Your output at this step should be a Service Level Objectives Framework containing:

• A list of specific, measurable SLOs tailored to different customer segments or service tiers.
• An SLA and SLO alignment guide, demonstrating how internal SLOs support contractual SLAs with customers.
• A strategy for dynamic SLO adaptation in response to evolving customer needs or service changes.
  
  

3. Select the right metrics to measure

Choosing the right metrics to track and report is essential for assessing the NOC's internal effectiveness and customer satisfaction. Read our guide to NOC metrics for a deep dive on this and which specific metrics to consider measuring.

Here are a few that every NOC should be measuring:

1. Time to Impact Assessment

2. Mean Time to Close

3. SLA Compliance

4. NOC Mean Time to Resolve (MTTR) and NOC Mean Time to Restore:

5. Tier 1 NOC Incident Resolution Rate

Action items:

• Evaluate current measurements. Determine what is currently measured and how it contributes to support quality. Identify what works, what doesn’t, and the changes needed to ensure the right metrics are tracked. We suggest reviewing the average resolution time metric for the past six months. If you notice a trend of increasing resolution times, investigate whether specific issue types, times of day, or inadequate tooling contribute to the trend.
• Determine effectiveness metrics. Decide how to measure the NOC’s effectiveness, looking to align with industry standards and address any discrepancies identified. Beyond traditional metrics like Mean Time to Recognize (MTTR), incorporate new metrics such as Mean Time to Automate (MTTA), tracking how quickly your NOC implements automation for recurring issues.
• Assess customer satisfaction. Establish a process for measuring customer satisfaction, utilizing NPS surveys or other methodologies, and integrate this feedback into service level management.  After resolving tickets, send a brief survey with specific questions about the resolution process and overall satisfaction. Analyze trends in this feedback to pinpoint areas for improvement.

A Metrics and Measurement Strategy document that outlines:

• A catalog of current and proposed metrics, including definitions, calculation formulas, and their relevance to support quality.
• A detailed plan for implementing new metrics and the phasing out of underperforming or irrelevant ones.
• A customer satisfaction measurement protocol, including survey designs, deployment schedules, and feedback integration processes.
  
  

4. Estimate Total Cost of Ownership (TCO)

Accurately estimating the TCO is critical for understanding the financial implications of establishing and maintaining a NOC. This includes both the initial setup and ongoing operational costs.

Action items:

• Calculate initial and ongoing costs. Consider the costs of establishing the NOC infrastructure and the labor costs for ongoing support. We suggest breaking down the initial setup costs, including network monitoring software and hardware, and comparing these against the operational costs, such as salaries for NOC personnel. Consider using a TCO calculator tool to ensure all factors are included.
• Factor in maintenance and upgrades. Account for the costs of maintaining and updating the NOC platform, ensuring it can meet evolving support requirements. For an existing NOC, assess the lifecycle of your current monitoring platform. If an upgrade is due in the next two years, include this in your TCO estimate. Project the cost of adding new functionalities, like AI-driven analytics, which could significantly enhance your NOC's capabilities.

Your output at this step should be a detailed TCO Analysis Report featuring:

• A breakdown of initial setup costs, categorized into hardware, software, training, and any other relevant expenses.
• An operational cost forecast, including ongoing staffing, maintenance, upgrades, and unexpected expense contingencies.
• A cost-benefit analysis comparing the projected TCO of different NOC models (in-house, outsourced, hybrid) against the expected benefits in terms of efficiency, customer satisfaction, and revenue impact.
  
  

💡 Putting it all together:

Collectively, these outputs from the business analysis process offer a blueprint for building or refining a NOC that is strategically aligned with business objectives, operationally poised to deliver high-quality support, and financially optimized for maximum efficiency and value.

Your Support Requirements document, which includes a customer base profile, a gap analysis report, and operational objectives, can serve as the foundation for the entire NOC development process. This document ensures that NOC services are designed to meet the specific needs of both internal operations and the customer base, guiding staffing and technology planning to fill identified capability gaps, and supporting strategic decisions regarding in-house versus outsourced operations based on scalability requirements.

The Service Level Objectives Framework aids in setting up NOC processes and workflows to achieve these objectives, aligning internal SLOs with customer-facing SLAs to support contractual commitments, and establishing a performance tracking baseline to ensure compliance with SLOs.

The Metrics and Measurement Strategy document is created to facilitate the effective tracking and reporting of key performance indicators. This strategic approach to measurement is vital for the continuous improvement of NOC operations, allowing for the identification of improvement areas based on metric performance, integrating customer feedback to enhance service quality, and ensuring that customer satisfaction levels are meticulously monitored and acted upon.

Lastly, the TCO Analysis Report provides a detailed understanding of the financial aspects of establishing and maintaining a NOC, including initial setup costs and ongoing operational expenses. This report is instrumental for budgeting and financial planning, enabling organizations to make informed decisions on the most cost-effective model for NOC operations and offering a solid basis for justifying investments to stakeholders by highlighting the anticipated return on investment.

  Worksheet

Process note: The NOC's operational strategy needs to be closely aligned with the company's broader business strategy. Consider initiating an initial strategy deployment project to clarify the company's objectives and promote alignment throughout the organization. This approach helps maintain a cohesive operational strategy. For reference, consider strategy deployment methods such as Hoshin Kanri or VSEM.

• How will our NOC and Day 2 Support model address our strategic goals? Is the NOC intended to be the “one-stop shop” for all customer or user interactions, or is the NOC just one functional component in the overall customer service organization, working with other service desks and support teams?
• What are our customers’ expectations for the NOC (and Day 2 Support if relevant)?
• What are our current and anticipated customer demands? How will those demands change over time? Consider new customer activations. What quantities are expected or predicted? Can we model the customer growth rate over time and the corresponding activation, incident, and change volumes? (Remember that changes typically account for 70% - 80% of the incidents that arise in a network, even a new one.) How should network complexity be considered when considering our incident volume and the effort required to address these incidents?
• What are our long-term scalability requirements for the NOC? In other words, can we determine the necessary effort and labor and the required size of the support teams based on the anticipated volumes of activations, incidents, and changes?

• Do we know all the options available to design, build, or outsource the NOC to achieve our objectives? Service delivery quality, like security, must be designed in rather than handled as an afterthought.

• How will we maintain control and oversight of outsourced service providers that interface with this operation? SLAs and a comprehensive governance framework are a minimum. How will we ensure our internal SLAs are back-to-back with our customer-facing SLAs? How will we explicitly address scalability and service delivery quality in supplier contracts? (Don't commit to service terms that reduce your flexibility if the partner demonstrates they cannot meet your objectives.)
• What documentation do we need for each customer's activation, the NOC team, the field team(s) turning up the services, and suppliers who are part of the overall service operation? Where will the documents be stored, and how will they be controlled? How will the documents be maintained and updated? Who will be responsible for making those updates?
• What short-term tactical requirements must be addressed before our first customer is onboarded? Put another way, what minimum items must we complete before the first customer can be onboarded?
• How will we manage our operation and support model as the customer base increases?

 Worksheet

• What specific service offerings within our current or forthcoming service catalog will the NOC support or be involved with? Depending on the infrastructure, connectivity services may include Dedicated Internet Access, Ethernet, and other similar offerings. Additionally, value-added services like managed firewall, managed Wi-Fi, and SD-WAN could be provided. Other bundled services, such as Unified Collaboration, may also be considered part of the company's offerings.
• What specific operational services will the NOC need to provide to deliver support for each service offering? Typical examples include incident management (reactive), circuit monitoring (proactive), problem management, and capacity management.
• What will the NOC require to support each of those service offerings and operational services? We suggest walking through the operational process for each service to identify how it will be delivered. Identify all key process inputs and dependencies to fulfill the process and provide the required outcomes. 
• What critical IT components or infrastructure do these services depend on? (i.e., map the dependencies.) Examine the hosting or housing of components and their interconnections for service delivery. Are there any single points of failure that need to be addressed? Are any third parties or suppliers responsible for the components or connectivity, and do their contracts support the required SLAs?
• What are the potential failure points in that list, and how can we address them proactively?
• What resources will be required to support these services—and how many?
• How will these services be integrated with other services or systems?
• What are the training requirements for the staff responsible for supporting these services?

 Worksheet

• What are the specific service level targets for each supported or impacted service identified above? Are there any unique service levels for specific client categories? If so, how will we address the management complexity, particularly if we scale?
• What metrics will we need to measure and report on for those service-level agreements?
• How will we measure service levels and report on them to customers? What tools and processes will we use?
• What is our threshold for escalation, and how will issues be prioritized and resolved?
• What is our process for requesting changes to service levels or adding new services, and how will we accommodate those requests?
• How will we collect customer feedback and incorporate it into service-level management?
• How will we continuously improve our services and service levels?

 Worksheet

• What operational KPIs will be required to track and monitor the health of the NOC operation in delivering on SLAs? Basic incident management metrics such as Time-to-Ticket, Time-to-Impact Assessment, and Time-to-Resolution and Closure are all good foundational measurements for Incident Management. Read our in-depth metrics guide for insight into utilization metrics.
• What operational metrics must we establish to maintain a staffing model that aligns with expected utilization and performance targets? Before scaling your business, measuring staff utilization and monitoring effort distribution across various tasks over time is essential. How will you assess the time spent on phone calls for incidents compared to managing supplier changes, for example? How can you determine when additional capacity might be needed or identify whether your efficiency is declining rather than improving?
• How will the NOC report on and communicate performance and service level data to stakeholders?
• What specific vendor SLAs must be defined, and how can they be managed to ensure alignment with business requirements?
• How will we align with our customer SLAs and ensure we meet their requirements and expectations?

 Worksheet

• Who will own accountabilities for various functions, and what will the RACI matrix look like across the organization? We suggest developing the initial RACI before onboarding customers and outlining the intended future RACI that will be implemented once a specific business or volume threshold is reached. This proactive planning enables the organization to foresee and prepare for organizational changes and identify and recruit talent as necessary.
• What staffing will be required in the NOC to support and manage the supplier and vendors, even if we outsource part or all of the operation? Effective oversight demands proactive management. In instances of customer escalation, it is crucial to have individuals capable of assuming responsibility for resolving those issues independently from the suppliers within your supply chain.
• What specialized skills and resourcing will we need for platform administration and configuration, and how can this function sit alongside the NOC to ensure processes and workflows can be embedded and updated? Whether your NOC team is in-sourced or outsourced, it is important to thoroughly examine the management, configuration, and maintenance of the platform. How will we upgrade and patch components? What impact does that have on service delivery? How will new technologies be integrated over time, and by whom? How do changes in service offerings affect the CMDB, and who is responsible for managing those changes
• What training and development plan needs to be established for internal teams?

 Worksheet

• Is our infrastructure designed for secure, remote accessibility for vendors and suppliers? If so, how will we manage and maintain its security?
• Do we have full audit logging capabilities to track events, changes, and remote accesses?
• Who will be alerted in the event of accesses, changes, or suspicious activity? In the event of suspicious access or confirmed breach, what is our process to contain and manage the threat?
• What are our security obligations to our client base and regulatory bodies?
• Do we have the right security expertise available, or are we on retainer to manage threats and incidents? 
• Can we remotely access and troubleshoot any issues that may arise with our client's infrastructure?
• Have we considered using technology to reduce or eliminate the need for truck rolls and unnecessary resolution times, such as active demarcation points that enable remote troubleshooting, especially at customer hand-offs?

Here's a quick look at our Ops 3.0 platform, for example:

Alarm Sources/NMS: Our platform ingests alarm and event information directly from your NMS infrastructure (such as LogicMonitor, New Relic, Nagios, or Dynatrace), enabling us to receive alarms from a simple network monitoring tool or a whole suite of monitoring tools (everything from application management to traditional network management to optical or physical layer management systems). Hosted solutions are available if you don’t currently use an NMS or aren’t satisfied with your instance. Integrating these NMS tools with AIOps ensures seamless alarm and event management—a key service differentiator that motivates ITOps teams to work with us for NOC service.

AIOps Engine: Our alarm and event management system is powered by AIOps — machine learning that automates low-risk tasks and extracts insights from large amounts of data. Our tools correlate, inspect, and enrich alarms with metadata from our CMDB to facilitate informed action. (You can integrate your existing system with our toolset to streamline alarm correlation, enrichment, and ticket creation!) After a ticket is generated, our platform automatically identifies and attaches CIs from our CMDB, giving NOC engineers clear direction for investigation. The platform also provides relevant knowledge articles and runbooks to quickly diagnose and develop an action plan.

Integrated CMDB: Our CMDB enriches alarm data with vital configuration and business impact details, allowing precise assessment and action. The INOC CMDB includes all essential information for AIOps, ensuring seamless integration with our clients' configurations. This gives our NOC engineers the actionable information they need to make informed decisions, fast. We leverage our years of experience to enhance our clients' existing CMDB structures and capabilities, further improving efficiency and effectiveness.

Automated Workflows: Our platform's ITSM component enhances automation capabilities by attaching CIs and records from the CMDB to incident tickets created by AIOps. This process automates initial impact assessment and provides NOC engineers with a likely set of issues and impacted service areas — even before they touch the ticket.

Auto or Manual Resolution: The platform automatically resolves certain short-duration incidents, optimizing NOC efficiency by focusing on critical issues and reducing manual intervention. Incidents that can't be auto-resolved are escalated to the appropriate tier of NOC engineers for expert resolution, leveraging enriched data and detailed documentation for effective problem-solving.

Here's how this platform comes together in sequence:

 Worksheet

• Have we standardized our workflows and interactions between people, teams, and suppliers based on the service processes, and have we implemented controls to ensure consistency?