A network operations center (NOC) is the team, tools and processes that watch an organization’s networks and services, spot problems and, depending on scope, either alert your team or lead the response to keep them running. Large carriers and enterprises run their own NOCs; many mid-sized organizations use one operated by a managed service provider instead. Coverage is often 24x7, but hours and scope depend on how the NOC is set up or what the contract says.
At a glance
- A NOC monitors network devices, circuits, servers and services for faults and performance problems.
- Depending on scope, it may only alert you, or it may triage, troubleshoot and work with carriers and vendors to restore service.
- It can be in-house, outsourced to a provider, or co-managed between the two.
- It focuses on availability and performance; security threat detection is the job of a security operations center (SOC).
- The value depends on what the NOC is authorized to do, not just what it can see.
What problem it solves
Networks fail at inconvenient times. Without someone watching, a branch circuit can be down for hours before anyone reports it, a slowly failing switch goes unnoticed until it stops, and an overnight outage is discovered when the first shift arrives. When problems do get noticed, they often involve a carrier, an equipment vendor and an internal team, each assuming someone else is handling it.
A NOC closes those gaps by detecting problems from monitoring rather than user complaints. What happens next depends on the service. A full-service NOC can follow a defined process to restore service, own the incident until it’s closed, and investigate root cause so recurring problems are fixed for good. A monitoring-and-notify service alerts you and leaves the fix, and the follow-up, to your team. If you need the first, require incident ownership and root-cause reporting in the contract.
How it works
Monitoring. NOC tools collect status and performance data from routers, switches, firewalls, Wi-Fi, circuits, servers and cloud services, using methods such as SNMP, flow data, APIs and synthetic tests. Thresholds and rules raise alerts; event correlation helps group related alerts into a single incident.
Triage and response. NOC engineers acknowledge alerts, decide on severity and follow runbooks: documented steps for known problems. In a full-service NOC they also troubleshoot remotely, open and chase tickets with carriers and vendors where authorized, and escalate to specialists or your team when needed. If on-site work is needed, they dispatch field support.
Change and maintenance. Many NOCs also carry out approved changes, firmware updates and maintenance in scheduled windows, under change control.
Communication and reporting. The NOC notifies stakeholders during incidents and reports on availability and trends. Written root-cause analysis of major incidents is common in full-service contracts but not universal, so specify it if you need it.
Staffing models. Some NOCs are staffed around the clock; others cover business hours and use on-call engineers after hours. A provider’s NOC serves many customers from shared staff and tools, which keeps costs down but means your environment must be documented well. See our NOC solution page for how outsourced options compare.
When it matters for buyers
- When outages cost money outside business hours. Retail, healthcare, logistics and online services are typical.
- When you have many sites or circuits. Watching them by hand stops working well before the hundredth site.
- When the internal team is small. Covering nights and weekends burns out a team of two or three.
- When you’re buying managed network services. The NOC behind the service decides how good it is.
- After a major outage. Post-incident reviews often show the problem was visible long before anyone acted.
Questions to ask vendors
- What hours are staffed by engineers, and what happens after hours?
- Which systems will you monitor, and with whose tools?
- What are your targets for acknowledging and restoring each severity level?
- What are you authorized to do without asking us: restart devices, make changes, open carrier tickets, dispatch technicians?
- How do you learn our environment, and how are runbooks kept up to date?
- Do you own each incident until it is resolved, or only notify us?
- How and when will you notify us during an incident, and will the contract require a root-cause report for major incidents?
- Where is the NOC staffed, and how many engineers cover our account?
How it differs from a SOC
A NOC asks “is it up and performing?”; a security operations center (SOC) asks “is someone attacking it?” A NOC monitors availability, capacity and performance and, depending on scope, fixes faults; a SOC monitors logs and security events, investigates threats and coordinates incident response. Both watch the same firewalls and servers, and a single event, such as a sudden traffic spike, may matter to both, so it helps if the two can hand events to each other. Some providers offer combined NOC and SOC services; check that each function has the right specialists rather than one team stretched across both.
Problems this helps with
- Finding out about outages from users or customers
- Nobody watching the network overnight or on weekends
- Alerts firing constantly and nobody acting on them
- Carriers and vendors blaming each other during an outage
