Something else that's helpful ..
Jeff - also, I implimented a "network security breach / network outage" form. This is great, b/c you have a DOCUMENT TRAIL for all the times that the network goes down and/or when you have problems. These are good for a couple of reasons:
1) If it's a "what the hell?" problem, you can match up instances and reach some intelligent conclusion about what caused the outage, rather than just guessing.
2) If it's an intrusion, you can look back at these and match up forensic information.
... and, of course, 3) When you move on, you have DOCUMENTED PROOF that you were doing something and being proactive.
Of course, I work with a University ... with a crappy IT department, so we get outages quite a lot - and I can use these to leverage things for myself. :D
Just some more of my $.02.
~N~