APCAF STANDARDS BODY OPEN SPECIFICATION & GOVERNANCE

About the Framework

APCAF (Adversarial Physical Control Assessment Framework) is an open specification for systematically assessing physical security controls against known adversarial bypass techniques, using observable evidence, structured evaluations, and organization-defined risk appetite.

Ecosystem Positioning

How APCAF Relates to Existing Standards

APCAF does not replace existing cyber or compliance frameworks. It provides the missing physical-layer behavioral assessment standard.

Cyber Threat Intelligence

MITRE ATT&CK®

Catalogues observable adversary tactics and techniques in enterprise computing environments.

APCAF Parallel: Applies the same de-abstracted behavioral taxonomy principles to physical barriers, credential authenticators, sensors, and hardware ports.

Information Security Governance

ISO/IEC 27001

Provides an Information Security Management System (ISMS) governing organizational policies and controls (Clause A.7).

APCAF Parallel: Provides the empirical technical assessment procedures to verify whether nominal physical perimeters (A.7.1) and entry controls (A.7.2) withstand bypass.

Hardware & System Hardening

CIS Benchmarks™

Provides prescriptive, consensus-based hardening guidance for operating systems and network devices.

APCAF Parallel: Defines non-invasive physical hardware tolerances, sensor shielding standards, and credential cryptography baselines.

Foundational Purpose

Why Physical Security Deserves More Than a Checklist

Traditional audits confirm nominal presence. APCAF assesses hardware-layer resilience against known bypass mechanisms.

Who APCAF Is For

Security Executives & CISOs: To establish verifiable physical defense baselines and link physical vulnerabilities to organizational risk appetite.
Physical Security Assessors & Red Teams: To conduct fast, 45-second standardized non-invasive audits with structured telemetry and photo evidence.
Facilities & Commissioning Teams: To validate vendor installations against engineering tolerances (e.g. NFPA 80 gap limits) before signing off on milestone invoices.
Compliance Auditors (PCI, SOC 2, ISO): To replace subjective checklist answers with reproducible technical evidence.

What APCAF Base Explicitly Does NOT Do

No Destructive Testing: APCAF never forces door assemblies, picks lock cylinders, or damages physical hardware.
No Network Packet Injection: Layer 1 network port testing is strictly passive LED detection; zero packet sniffing or network probing.
No Life-Safety Manipulation: Zero interference with emergency crash bars, fire alarm release relays, or emergency egress pathways.
No Legal / Certification Guarantee: APCAF produces technical quality assurance findings, not regulatory certifications or legal indemnity.

Open Governance

Specification Governance & Contribution Process

APCAF is an open specification maintained through public research, technical review, and community Request for Comments (RFC).

Governance Pillar 01

Technical Review Committee

Community maintainers and physical security engineers who review proposed techniques, schemas, and mitigation standards.

Governance Pillar 02

RFC Technique Proposal

New physical bypass techniques undergo public Request for Comments (RFC) before inclusion in APCAF Base.

Governance Pillar 03

Strict Semantic Versioning

APCAF adheres to SemVer 2.0 (MAJOR.MINOR.PATCH). Technique identifiers, result models, and schema contracts remain immutable per major release.

Governance Pillar 04

Open Licensing

The APCAF specification and taxonomy are licensed under Creative Commons Attribution 4.0 (CC BY 4.0); tooling and schemas are under MIT.

Contribute to the APCAF Specification

Review our contribution guidelines, propose new techniques, or integrate the open JSON dataset into your tooling.

Contribution Guide → GitHub Repository