Are comms rooms supposed to be locked all the time?

In most organisations, yes: a communications room should be secured whenever authorised work is not taking place. That does not mean nobody can ever enter, or that the door should be locked in a way that prevents safe access during an emergency. It means access is controlled, deliberate and recorded where appropriate—not left to convenience, habit or whoever happens to have a key.

Comms rooms house the infrastructure that carries business traffic: switches, routers, patch panels, firewalls, wireless controllers, power equipment and, in some environments, operational technology (OT). Someone who can reach that equipment may be able to disconnect services, introduce an unauthorised device, access sensitive traffic or interfere with the controls that keep networks separated.

That makes comms room access control part of cybersecurity, not a facilities issue to be considered separately. Physical security policy, network design and operational procedures all need to work together. A locked door is not a complete security programme, but an unlocked door can undermine a very good one.

Why physical access matters to cyber security

It is easy to focus on firewalls, endpoint detection platforms and user accounts because they are visible parts of a security architecture. But those controls ultimately depend on the physical infrastructure beneath them. If someone can plug into a switch, move a cable or reset a device, they may be able to change the conditions those digital controls rely on.

Depending on the equipment and configuration, physical access can make it possible to:

Connect an unauthorised laptop, mini-computer or wireless access point to the network.
Disconnect, move or loop patch leads, causing an outage or creating an unexpected path between systems.
Reset, replace or tamper with a network device.
Gain access to unencrypted network traffic or management interfaces.
Bypass intended network segmentation by connecting equipment to the wrong port or network.
Obstruct monitoring by unplugging sensors, taps or uplinks that security teams depend on.

Not every comms room contains the same equipment, and not every person entering is a threat. The practical point is that physical access can change the network itself. A strong firewall policy cannot compensate for a cable that has been moved onto the wrong switch port, or a rogue device connected on the trusted side of a control.

Locked all the time does not mean inaccessible

“Locked all the time” is a useful default, but it needs a workable access process. The room should be locked when unoccupied, and access should be limited to people who have a genuine operational or support need. Staff should not prop the door open for convenience, lend keys informally or assume that a contractor is authorised simply because they are wearing a company logo.

A sensible approach distinguishes between access being available and access being uncontrolled. For example, a network engineer may have approved access during a planned change, while a facilities contractor may need an escort to work near equipment. In a site with critical OT, access may require an additional approval or a documented work window.

Consider the following questions when setting the rules:

Who is authorised to enter, and who approves that authorisation?
How are keys, access cards or PINs issued, reviewed and removed when people change roles?
Are visitors and contractors escorted, and is their work recorded?
Does the access log show who entered and when, and is it reviewed after an incident?
Can the door be opened safely during a power failure or emergency?
What happens at 2am when this fails—who can get in, and how will responders know what has changed?

The final question matters. A room that is technically secure but impossible for the on-call engineer to access during an outage can turn a manageable fault into a prolonged incident. Conversely, an emergency process should not become a standing excuse for broad, unreviewed access. Define the exception, make it usable and record when it is used.

Network cabinet locks: useful, but not a substitute for room security

Network cabinet locks can provide an extra layer of protection, particularly where equipment is located in shared areas, open offices, warehouses or public-facing spaces. They can help deter casual interference and restrict access to patching and device controls. They are not a substitute for securing the room, and they should not create a false sense of assurance.

Cabinets are only as effective as their installation and key management. A cabinet with a universal key left in a desk drawer is not meaningful access control. Nor is a lock much help if patch cables can be reached from outside the cabinet, the cabinet is left open during work, or the equipment is mounted in an area accessible to the public.

Use cabinet locks where they address a real exposure, and make sure they fit the environment. In some sites, protecting the entire room is more practical. In others, a locked cabinet provides an important additional boundary—for example, where facilities staff need access to the room but do not need access to the network devices.

Physical faults create outages and security blind spots

Physical infrastructure is often treated as stable once installed. In reality, comms rooms change constantly: ports are repatched, equipment is replaced, temporary links are added, and contractors complete work across different projects. Without good records and disciplined practices, those changes accumulate into a web of undocumented dependencies.

A loose power lead or damaged patch cable can cause an outage. A badly labelled panel can delay diagnosis. An undocumented switch added during a fit-out can create a network segment that nobody monitors. These are not just availability problems. Physical layer faults can create security blind spots by taking monitoring equipment offline, changing traffic paths or making it unclear which device is connected to which network.

This is why I count mystery cables as a security smell. Every unknown lead is a question about ownership, purpose and destination. Labels on patch panels and equipment, accurate diagrams, change records and regular inspections are basic operational controls—not cosmetic extras. A label maker belongs in the kit for a reason.

Good room practice should include:

Clear labels at both ends of cables and on patch panels, using an agreed naming scheme.
Current rack elevations and network diagrams that match what is actually installed.
Documented changes, including temporary connections and contractor work.
Routine checks for unsecured cabinets, unexplained devices, loose cables and blocked ventilation.
Appropriate protection for power, cooling and environmental conditions.

Segmentation depends on capable switching and correct design

Network segmentation is often described as a matter of configuring VLANs or writing firewall rules. Those controls matter, but segmentation depends on the whole chain: suitable switching, a correct design, consistent configuration, physical connectivity and ongoing verification. If the switching layer is poorly managed, the boundaries drawn on a diagram may not reflect the network in practice.

Managed switches from vendors such as Cisco are commonly used to support features such as VLANs, access controls and centralised administration. In industrial environments, equipment such as MOXA switches may be selected for operational requirements. The right product depends on the site, but the principle is the same: switches must be capable of the required controls and configured to match the security design.

Unmanaged switches in production are a recurring problem. They can make it difficult to see which devices are connected, enforce port-level controls or diagnose unexpected traffic paths. They may be appropriate in limited, low-risk situations, but they should not quietly appear in a production network as a shortcut. If a team cannot identify a switch, confirm its purpose and understand what it connects, it is hard to claim the segment is under control.

Physical security supports segmentation by preventing unauthorised changes to the links and equipment that enforce it. It does not replace logical controls. A locked room will not fix an overly permissive VLAN, and a well-configured firewall will not stop someone from inserting an unmanaged switch into an exposed port. Both layers need attention.

Monitoring needs a sound physical foundation

Security monitoring tools see only the traffic and events available to them. Firewalls can enforce network boundaries and record relevant connections. Endpoint detection platforms can help identify suspicious behaviour on managed endpoints. Network visibility tools may provide additional insight into traffic that endpoint tools cannot inspect directly.

For example, Garland Technology provides network TAPs and packet-broker products used in some network visibility designs. Such equipment can help deliver traffic to monitoring tools, but it still depends on correct placement, reliable links, power and careful configuration. If someone disconnects a monitoring path—or a cabling change sends traffic somewhere unexpected—the monitoring picture may become incomplete without an obvious alarm.

That is another reason to include comms rooms in incident response and change procedures. When a security alert arrives, responders should be able to establish whether physical work has occurred, which devices are connected and whether monitoring paths are healthy. cyberdaily.au Records and access logs can help distinguish an authorised change from unexplained tampering.

How this fits with ACSC guidance

Australian organisations often look to the Australian Cyber Security Centre (ACSC) for guidance on protecting networks and systems. That guidance is not a substitute for a site-specific design, and no single physical control will satisfy every requirement. However, cyber security recommendations necessarily assume that the underlying network is understood, managed and operated securely.

In practice, that means an organisation cannot rely on security policies and monitoring alone while overlooking the rooms, cabinets and cabling that make the network work. Access control, asset management, change management, secure configuration and incident response all depend on sound foundations. Physical infrastructure is part of those foundations.

Use ACSC material alongside your organisation’s risk assessment, regulatory obligations and operational needs. For OT environments in particular, coordinate security measures with safety and availability requirements. A change that is sensible in a corporate office may need a different approval path in a production plant.

What a practical physical security policy should say

A useful physical security policy is specific enough that people can follow it during routine work and an outage. It should cover more than “keep the door locked”. At minimum, define:

Which rooms and cabinets are in scope, and how they are classified by risk.
Who may enter, how access is approved and how access rights are reviewed.
When escorting is required for visitors and contractors.
How planned work, emergency access and after-hours entry are recorded.
Requirements for locking doors and cabinets, managing keys and reporting lost credentials.
Expectations for labelling, patching, equipment installation and change records.
How suspected tampering, unexplained equipment or damaged cabling is reported and investigated.

The policy should be supported by practical procedures. If the only way to perform an approved change is to bypass the rules, staff will eventually do that. Make the secure process the easy process: keep access arrangements current, provide clear change steps and make sure on-call staff know how to reach the right person.

A simple way to assess your comms rooms

Walk the site with someone who understands both the building and the network. Do not rely solely on old diagrams. Compare the documentation with the actual racks, labels, devices and cable routes. Where allowed, check access records and confirm that the people listed as authorised still need that access.

Check Good practice Warning sign Room access Door secured; authorised access is clear and reviewed Door routinely propped open or shared keys untracked Cabinets Equipment protected where risk warrants it Open racks in accessible areas or ineffective locks Cabling Labels and records match the installed connections Unlabelled patching, mystery cables or undocumented links Switching Devices are managed, approved and included in the design Unknown or unmanaged switches in production Monitoring Security and network teams can identify monitoring dependencies Traffic visibility relies on undocumented links or equipment

The short answer

Comms rooms should normally be locked whenever they are unoccupied, with access limited to people who need it and a clear process for contractors, planned work and emergencies. Network cabinet locks can add protection, but they do not replace room controls, good records or secure network design.

Most importantly, treat the physical layer as part of your cyber security architecture. Physical faults can interrupt services and hide activity. Segmentation depends on capable switching and correct implementation. Firewalls, endpoint detection platforms and network visibility tools all work better when the infrastructure beneath them is understood and protected.

Lock the door, label the cables, document the changes and know who can respond after hours. That is not just good housekeeping. It is part of keeping the network secure and available.