In most organisations, the short answer is yes: comms rooms should be locked whenever authorised work is not taking place. That does not mean every door must be sealed against legitimate maintenance or emergency access. It means access should be controlled, purposeful and recorded according to risk—not left to convenience, habit or whoever happens to have a key.
A communications room is not simply a place where routers and cables live. It is part of your security boundary. Inside may be the switches carrying staff, guest, voice, building-management and operational technology traffic; patch panels connecting desks and devices; fibre links between floors; and equipment that provides a path around controls elsewhere. A person who can physically reach those systems may be able to create an outage, expose traffic or undermine logical security.
That is why comms room access control belongs in both facilities planning and cybersecurity. It also explains why the question is not just “Should the door be locked?” It is “Who needs access, how is that access managed, what can they do once inside, and what happens at 2am when something fails?”
Why physical access matters to cybersecurity
Network security is often discussed in terms of firewalls, endpoint detection platforms, identity controls and monitoring. Those controls are essential, but they cannot compensate for every weakness in the physical environment. If someone can connect an unauthorised device to a live switch port, move a patch lead or reset equipment, they may change what the network sees and how it behaves.
Depending on the equipment and configuration, physical access could let someone:
- Disconnect a link or power source, disrupting services. Connect an unauthorised device to an active network port. Move patch leads and unintentionally—or deliberately—bridge networks. Reset equipment, interfere with configuration or obstruct maintenance. Access exposed console connections, spare equipment or configuration media. Observe labels, diagrams or device details that help map the environment.
Not every person entering a comms room is a threat, of course. Most incidents are more ordinary: a contractor moves the wrong lead, a cleaner unplugs a power supply, or someone installs an unmanaged switch because they need “just one more port”. But the security impact can be much the same. A well-intentioned change can create an outage or open a path that nobody is monitoring.
Physical infrastructure is part of cybersecurity, not a separate concern that can be handed entirely to facilities. A good physical security policy defines access based on role and business need, and connects that access to change control, incident response and operational procedures.
What does “locked all the time” mean in practice?
For a dedicated comms room, the normal position should be a closed, locked door, with access limited to approved personnel. “All the time” should not mean making the room impossible to reach during a genuine fault. It means avoiding routine, uncontrolled access and ensuring there is a safe, accountable process for authorised work.
That process may involve electronic access control, a key register, visitor sign-in, an escort requirement or a combination of measures. The right choice depends on the site’s risk, operating hours and support model. A small office and a critical operational site will not necessarily need the same controls, but both should know who can enter and how access is reviewed.
A practical approach includes:
- Give access only to people whose responsibilities require it. Remove access promptly when people change roles or leave the organisation. Use visitor and contractor controls, including escorts where appropriate. Keep a record of access where the risk and available systems justify it. Define an emergency-access route for out-of-hours incidents. Review access lists and physical security policy on a regular schedule.
Access control is only useful if it works in real life. A door that is routinely wedged open, a shared key with no owner, or a badge reader that everyone bypasses is security theatre. Look at how staff actually work, then design a process that supports legitimate maintenance without making uncontrolled entry the easiest option.
Room access and cabinet access are different controls
A locked room is a strong first barrier, but it may not be enough. In shared buildings, multi-tenant sites or locations with frequent contractors, network cabinet locks provide an additional layer. Cabinet locks can restrict direct contact with switches, patch panels and power equipment, even when someone has a legitimate reason to enter the room.
Conversely, locking every cabinet does not solve poor room access. Cabinets may be left open for convenience, keys may be shared, or equipment may be mounted in an unsecured rack. Think in layers: control entry to the room, secure the equipment within it, and manage how changes to cables and ports are authorised.
Control What it helps protect Questions to ask Locked comms room Network equipment and cabling from casual or unauthorised entry Who can enter? How are keys or badges managed? Network cabinet locks Switch ports, patching and equipment from direct handling Are cabinets secured, labelled and included in maintenance procedures? Access records and visitor controls Accountability for access by staff, contractors and visitors Can an incident be traced to a time and person? Change control and documentation Unplanned changes that can cause outages or create security gaps Are patching and equipment changes recorded and checked?The physical layout matters too. If a rack is squeezed into a store cupboard, shares space with cleaning supplies or has no clear airflow, that is not just untidy. It can increase the chance of accidental damage, overheating or unauthorised handling. Treat the room as an operational environment, with suitable power, cooling, fire protection, housekeeping and access arrangements.
Physical layer faults create outages—and security blind spots
Physical layer problems are easy to underestimate because they often look like “the network is playing up”. A damaged cable, poorly seated fibre, failing power supply, overloaded switch or incorrectly patched port can cause intermittent symptoms that are hard to distinguish from a software or security issue.
That uncertainty creates a security blind spot. If monitoring shows devices dropping in and out, teams may miss suspicious behaviour in the noise. If a port is patched into the wrong network, traffic may bypass the intended segmentation. If an undocumented switch is inserted, the organisation may not know what is connected, where traffic can flow or which controls are in place.
In incident response, the state of the cabling and switching can be as important as logs from firewalls or endpoint detection platforms. A confusing patch panel, unlabelled cables and undocumented changes make it harder to establish what happened, preserve service and contain a problem. Mystery cables are a security smell: they make troubleshooting slower and ownership less clear.
Good physical practices are therefore operational controls as well as security controls:
https://www.cyberdaily.au/strategy/14271-why-physical-network-infrastructure-is-the-overlooked-foundation-of-your-cybersecurity-strategy
- Label both ends of cables and keep labels consistent with the network documentation. Maintain accurate rack elevations, port maps and patching records. Remove abandoned cabling and equipment through an approved process. Use appropriate cable management and keep airflow paths clear. Record changes to switches, uplinks, patching and power. Use supported, managed switching in production rather than consumer-grade or unmanaged devices.
Reliable documentation is not paperwork for its own sake. It helps an engineer identify the correct circuit, verify a change and restore service quickly. It also helps security teams understand whether a device or connection is expected.
Segmentation starts with capable switching
Network segmentation is often described as a configuration task: create VLANs, apply access rules and place systems in the right zones. In reality, segmentation depends on capable switching, sound design and disciplined implementation. If the underlying switching is unsuitable, poorly managed or incorrectly configured, the diagram may promise isolation that the live network does not deliver.
For example, staff devices, guests, voice systems, building controls and operational technology should not automatically share one broad broadcast domain simply because it is the easiest arrangement. The right boundaries depend on the organisation’s systems and risk. They should be supported by switches that can enforce the required design and by controls that govern communication between segments.
Vendors such as Cisco and MOXA provide switching products for different environments and requirements; selecting equipment is only one part of the job. Consider management capabilities, support lifecycle, configuration standards, resilience and compatibility with the intended architecture. For industrial environments, assess the operating conditions and operational requirements as well as the security features. A device being marketed for a particular setting does not make a network design secure by itself.
Garland is another company that may come up in conversations about network visibility and traffic access. Whatever products are chosen, the key is to understand how they fit into the architecture and operational model. Do not assume that adding a box or creating a VLAN automatically produces effective segmentation.
Correct design also needs physical support. Switches must be placed where they can be secured and maintained. Uplinks and patch panels need to be identifiable. Access to ports should be controlled in proportion to risk, and changes should be tested and documented. If the physical installation makes the logical design impossible to verify, segmentation is harder to trust.
How ACSC guidance fits in
ACSC guidance provides a useful Australian reference point for organisations developing their cybersecurity practices. Security measures work best as part of a coherent system: governance, access management, secure configuration, monitoring, incident response and the physical protection of supporting assets all matter. These measures rely on a network foundation that is understandable, maintained and appropriately segmented.
There is little value in deploying strong monitoring if the organisation cannot identify what is connected to its network. Similarly, a well-written access policy is difficult to enforce if contractors can enter a room using an untracked shared key or plug devices into unmonitored ports. ACSC-aligned security outcomes are not achieved through a single product or checklist; they depend on practical controls being implemented and maintained together.
Use current ACSC material relevant to your organisation and sector, and map its recommendations to your environment. The important point is not to claim that one particular lock or room arrangement is mandated for every site. It is to assess the risk, protect critical infrastructure appropriately and be able to explain how your controls work.
Build a policy that works during a real incident
A physical security policy should be specific enough to guide action but flexible enough to support emergency response. It should define who owns the room, who may enter, how contractor access is handled, how keys or credentials are issued and revoked, and what happens when access is needed outside normal hours.
It should also connect physical access to technical operations. For example, changes to patching or switching may require an approved change record, a second-person check for high-impact work, or an update to diagrams and port documentation. The level of control should match the potential impact; changing a spare office port is not the same as altering a core uplink or an OT network connection.
Questions for your next comms room review
- Is the room normally locked, and are exceptions understood? Can you identify every person or role with access? Are contractors escorted or otherwise controlled where needed? Are racks and network cabinet locks appropriate for the site’s risk? Can you map each critical cable and switch to current documentation? Are unmanaged switches and unauthorised devices prohibited and checked for? Does the switching support the segmentation the design requires? Can the on-call engineer gain authorised access at 2am? After a change or incident, are access and configuration records available?
Walk the room rather than relying only on drawings. Check the door, racks, labels, patch panels, power and cooling. Ask the people who support the site what actually happens during an outage. A neat diagram is reassuring; a neat diagram that matches the installed network is useful.
So, should the comms room be locked?
Yes—in most cases, it should be locked when authorised work is not taking place, with access granted only to people who need it and with a workable emergency process. Consider network cabinet locks as an additional layer where the room’s access conditions or system criticality justify them.
But a lock is only one control. Strong comms room access control is part of a wider physical security policy that covers people, equipment, cabling, documentation and change management. Secure rooms and capable switching help protect segmentation. Good labels and accurate records reduce both outage time and security blind spots. And a tested out-of-hours process answers the question that matters when something breaks: what happens at 2am?
When physical infrastructure is treated as part of cybersecurity, comms rooms become easier to operate, easier to investigate and harder to misuse. That is a much better outcome than relying on a locked door while the network behind it remains a mystery.