 These systems should be monitored constantly, all the time, not necessarily by people. There are tools that can help, but there should be people in charge of figuring out how to respond to instances of breaches or alerts of suspicious activity. So having somebody on staff is definitely a step forward, but if that's not possible,