The helpdesk is where users call when they have problems. New SW should be tested for a few weeks before being installed on production systems. Changes should be carefully prepared and carried out such that production is not disturbed and such that if the changes have a negative effect, they can be removed. During hardware changes ensure that anti-static wrist straps are worn, that the correct tools are available and that the power is connected or removed according to the manufacturer's instructions. Only install updates if they are necessary.
Monitoring is often more effective if decentralised in very large organisations.
The restore policy should be regularly tested. The auditor should be independent of the administration and be objective. Even with a solid security policy, educated users and solid system administration, an emergency response team is useful. Decide in advance who will be in charge in the event of a security incident. Keep important names, telephone numbers, email addresses off-line.