We found that a user who is an NCM Admin is unable to manage Firmware Upgrades. Apparently this is by design, and that in order to manage Firmware Upgrades, a user must be both an NCM Admin and Administrator.
Surely this is a design oversight and should be changed. In a smaller environment, likely the system Admin is also a Network engineer and perhaps would have both these access levels. But not in a large organization such as ours, where monitoring tools are owned and managed by a dedicated Tools Team. For us, we delegate NCM Admin to a select group of Network engineers and we expected as NCM Admins, they would be able to change all NCM Settings, including Firmware Upgrades. We'd like to see this requirement to be optional, so that our NCM Admins do not also have to be Administrators for this function.