A staffed network operations centre exists so that somebody is watching every client’s estate while the rest of the MSP is asleep or busy. That only works if every shift does the same things in the same order. This free NOC shift checklist gives NOC leads and shift engineers a routine for every shift, whether you run round the clock or extended hours. It starts with the previous shift’s log, open incidents and tonight’s maintenance windows, then sweeps the RMM alert queue, network and uptime monitoring, backup failures, provider status pages and certificate expiry. Alerts are acknowledged within your target, de-duplicated, ticketed in the PSA by priority and escalated by each client’s runbook. If a major incident is declared, a conditional phase runs the bridge and client updates, and every shift ends with a handover note and a closed log.
Many MSPs start with an on-call engineer who carries a phone overnight and gets woken by the alerts that matter. That model has its own routine, and the On-Call Handover Checklist covers it: one engineer passing the pager and the context to the next at the end of a rotation. A NOC is different. Someone is at a desk for the whole shift with the consoles open, so the job is not to be reachable. It is to look, all the time, and to act before a client notices.
So the checklist does a different job. A NOC shift has a start, a full sweep, continuous triage, hourly checks and a handover, often three times a day. It also sits between two other routines. The IT Help Desk Daily Checklist runs the user-facing ticket queue during business hours, and the MSP Daily Backup Monitoring Checklist owns the detailed morning review of every backup job. The NOC catches failures as they happen and tickets them, so neither routine is duplicated.
Where: at home, with a phone and a laptop.
Trigger: a page from monitoring or the service desk.
Handover: at the end of a rotation, usually weekly.
Risk: anything that does not page is not seen until morning.
Where: at a desk, with every console open for the whole shift.
Trigger: the shift itself, plus a sweep every hour.
Handover: at the end of every shift, from lead to lead.
Risk: alert fatigue, and a log nobody reads at the next shift.
Five phases run on every shift, in order. Phase 5 appears only when the shift lead records a major incident at the end of triage.
Done in the first fifteen minutes, before the outgoing shift leaves.
A full pass of every console, so triage starts from a known state.
Runs continuously through the shift. The last task is answered once the start-of-shift backlog is cleared, and it decides whether Phase 5 appears.
Shown only when a major incident is declared. The NOC runs communications and coordination; the fix belongs to the engineers on the bridge.
Agreeing the first move for each kind of alert means two engineers on different shifts handle the same alert the same way. The targets below are common practice, not a standard. Each client’s agreement and runbook take precedence.
| Alert | First move | Escalate when |
|---|---|---|
| Whole site offline | Check the ISP status page and the firewall, then raise one ticket for the site | The site is still down after the runbook’s wait time, or it is a 24/7 client |
| Server down or unresponsive | Check whether it is in a maintenance window, then try a remote check of the host | It is a production server outside a window, or it does not return after a restart |
| Disk space critical | Find what is growing and clear what is safe to clear | The volume holds a database or mail store and the growth will not stop |
| Backup job failed | Ticket it for the morning backup check, and retry if the window allows | The same job failed last night too, or the system has no other recent copy |
| Provider or cloud service incident | Confirm on the provider’s status page and note which clients use the service | Clients are affected and need a message before they start calling |
| Certificate expiring | Check for an existing renewal ticket and raise one if there is none | The certificate expires within days on a client-facing service |
| Monitoring silent for a site | Check the collector or probe and its network path | The site cannot be seen at all, so nothing else on it can alert |
Certificate expiry deserves its place in the sweep. Under CA/Browser Forum Ballot SC-081, the maximum life of a publicly trusted TLS certificate fell to 200 days on 15 March 2026, and it drops to 100 days in March 2027 and 47 days in March 2029. Annual renewals now come round several times a year, and each manual one is a chance to miss one.
The next shift, the service manager and sometimes a client will read it, so keep it factual and timestamped:
Microsoft partners can check the service health of a customer’s Microsoft 365 and Azure services from Partner Center, which links through to each tenant’s admin centre as delegated admin. For a NOC covering many tenants, that is a quicker first stop than signing in to each one.
A recurring schedule creates the checklist at the start of each shift and assigns it to the NOC group. The shift lead, on-call engineer and duty service manager are chosen on the first task, and every escalation names a real person.
One answer at the end of triage decides whether conditional logic adds the major incident phase. When it appears, the bridge, client updates and handover to incident management are tasks with owners.
Hourly sweeps, escalations and muted alerts are recorded against tasks with comments and attachments, with a time and a name on each. The service manager can see across every shift which alerts keep firing.
The MSP process management guide explains why monitoring tools automate the technical layer but not the human process around it. A NOC shift is that human layer, and CheckFlow for MSPs runs it alongside your service desk, backup and reporting routines.
A major incident that starts on a NOC shift continues in the Incident Management Checklist, which carries it through diagnosis, resolution and the post-incident review. The runbooks each escalation depends on are easier to keep current with the IT runbook template guide.
A network operations centre watches the infrastructure the MSP manages for its clients: servers, network devices, internet links, backups and cloud services. Engineers on shift work through monitoring alerts, open tickets for genuine problems, fix what the runbook allows them to fix and escalate the rest to the right engineer or client contact. The aim is to find and act on failures before a client’s users do.
A NOC looks after availability and performance: is the server up, is the link working, did the backup run. A security operations centre looks for threats: suspicious sign-ins, malware detections and signs of an attacker. Smaller MSPs often have the same people covering both. Where they are separate, agree which alerts go where and how a NOC engineer hands a suspected security incident to the SOC.
There is no single standard. Common practice is to acknowledge critical alerts within minutes and lower priorities within the hour, but the right target is whatever your agreements and runbooks commit to. Acknowledgement only means someone owns the alert, so set the target tight. The shift log should record the slowest acknowledgement each shift, because averages hide the alert that waited forty minutes.
Not always. A staffed NOC makes sense when enough clients have round-the-clock services or tight agreements that an on-call engineer would be woken every night. Many MSPs staff extended hours and use on-call cover overnight, or buy in an outsourced NOC. Either way, the checklist defines what any shift must do, whoever staffs it.
When the criteria written in your runbook are met, not when someone feels it is serious. Typical criteria include a whole client site or a critical service down, several clients affected by the same fault, or a security event with business impact. The NOC should be allowed to declare one without waiting for permission. Declaring early and standing down costs little; declaring late costs you the first client updates.
Start with the shift logs. Any alert that fires repeatedly without anyone needing to act should be tuned, re-thresholded or removed by the monitoring owner. Correlate alerts so one site outage produces one ticket. Use maintenance windows so planned work stays quiet, and review the noisiest alerts monthly.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
