APCAF
Run 45s QA
APCAF Base Specification / Draft v0.1.0 / Technical Documentation
Quick Index
Overview Boundaries 5 Layers 6 Tactics PHY-T1001 PHY-T1002 Risk Model Schema
Architecture Overview

APCAF Specification & Philosophy

The Adversarial Physical Control Assessment Framework (APCAF) provides a standardized method for assessing observable physical conditions associated with known adversarial bypass techniques through defined, repeatable, and non-destructive inspection procedures.

Traditional compliance audits verify nominal control presence on paper (verifying that a badge reader or door lock exists). APCAF complements audits by testing whether the physical installation withstands known bypass conditions: "What physical condition would permit bypass, and does the installed hardware prevent that condition?"

Framework Governance

Operational Boundaries

To preserve scientific integrity and prevent misinterpretation, APCAF strictly bounds its operational scope:

What APCAF Does:

• Maps known adversary bypass techniques to observable physical hardware conditions.
• Establishes repeatable, non-invasive inspection procedures and benchmark budgets.
• Documents observable hardware deficiencies against engineering specifications and building codes.
• Derives deterministic risk context based on Asset Criticality, Physical Exposure, and Consequence.
• Supports facility commissioning, vendor warranty verification, and quality assurance.

What APCAF Does NOT Do:

• Does NOT perform destructive penetration testing, lockpicking, or forced entry.
• Does NOT prove successful exploitation or claim a demonstrated physical breach.
• Does NOT certify regulatory compliance (PCI DSS, ISO 27001, SOC 2 belong to formal audits).
• Does NOT determine contractual or legal liability automatically.

Separation of Concerns

The 5 Disciplinary Layers of APCAF

APCAF decouples threat intelligence from physical inspection, asset context, and executive treatment decisions:

01. Technique
What can an adversary potentially do? Catalogued across Tactics PHY-TAC-01 through PHY-TAC-06 in canonical YAML specifications.
02. Procedure
What can we safely observe to test the condition? Standardized non-invasive inspection methods, tools, and read times.
03. Finding
What did we actually observe? Empirical evidence, measurements, photos, and technical disposition (Hardened, Deficient, Condition Requires Validation).
04. Risk Context
What does that mean in this specific asset environment? Deterministic calculation: Asset Criticality × Physical Exposure × Consequence.
05. Treatment
What does the organization decide to do? Defensible action: Remediate, Compensate, Accept, or Avoid.
Operational Authorization

Assessment Authorization Language

APCAF inspections require zero destructive tools and zero life-safety interference. Organizations may incorporate this standard clause into Statements of Work (SOW), master service agreements, or audit charters: 

"Client explicitly authorizes the assessment team to perform non-invasive physical security
control evaluations, passive radio frequency (RF) credential reads, and non-intrusive physical
network port link detection during the inspection to verify vendor hardware installation specifications."

Notice: This is an operational template, not legal advice. Organizations should adapt it with qualified legal counsel.

Attack Surface Matrix

The 6 Physical Security Tactics

Physical security controls protect facility spatial boundaries across six defined tactical objectives:

Tactic ID Tactic Name Tactical Objective
PHY-TAC-01 Physical Reconnaissance Gathering spatial, optical, or RF intelligence prior to physical approach.
PHY-TAC-02 Perimeter & Ingress Breaching or bypassing external site boundaries, vehicle gates, or exterior pedestrian portals.
PHY-TAC-03 Credential & Access Bypass Circumventing electronic access-control authenticators, RFID readers, or key management.
PHY-TAC-04 Interior Traversal & Evasion Traversing interior secure zones and evading detection within facilities.
PHY-TAC-05 Physical-to-Cyber Execution Gaining unauthorized logical or data access via exposed physical hardware interfaces.
PHY-TAC-06 Egress & Cleanup Exiting the facility and concealing physical evidence of unauthorized presence.
Field Methodology

Fast-Path Benchmark Budgets

The APCAF Fast-Path Profile defines targeted time budgets for baseline checks during physical walks:

5 Seconds
PHY-T1001 (RF Credential): Contactless interrogation tool to verify cryptographic handshake vs unencrypted static UID.
15 Seconds
PHY-T1002 (Door & Latch): Feeler gauge check for frame strike clearances and continuous astragal guard coverage.
15 Seconds
PHY-T1003 (REX Sensor): Optical line-of-sight check for interior REX PIR sensor detection body and deflector hood.
10 Seconds
PHY-T1004 (Network Port): Passive LED link-state test to verify administrative port shutdown or isolation.
PHY-TAC-03: Credential & Access Bypass

PHY-T1001: Credential Technology Assessment

Base Coverage
Assessment Hypothesis

Physical credentials broadcasting static, unauthenticated identifiers may permit harvest, replay, or cloning where the access-control architecture does not enforce cryptographic challenge-response mutual authentication.

Evaluation Dimension Assessment Criteria
Technology Identified Interrogate carrier frequency (125 kHz Low Frequency vs 13.56 MHz High Frequency) and chip protocol standard.
Authentication Mechanism Determine whether credential broadcasts a static identifier (UID/CSN) without requiring a cryptographic handshake.
Behavioral Assessment Distinguish static unauthenticated broadcast from dynamic session-based cryptographic challenge-response transactions.
Verification Boundary Record whether reader-side cryptographic key enforcement (SAM configuration, AES mutual auth) requires administrative configuration audit.
Canonical Technique Specification (YAML)
id: "PHY-T1001"
name: "Credential Technology Assessment"
tactic_id: "PHY-TAC-03"
target_object: "BADGE"
target_time_seconds: 5
hypothesis: "Physical credentials broadcasting static, unauthenticated identifiers may permit harvest, replay, or cloning where the access-control architecture does not enforce cryptographic challenge-response mutual authentication."
assessment_procedure:
  method: "passive_rf_interrogation"
  tools_required: ["Pocket dual-frequency RFID/NFC interrogation tool"]
result_model:
  hardened_criteria: "Credential architecture implements mutual cryptographic challenge-response authentication with verified reader-side key enforcement."
  deficient_criteria: "Credential relies on unencrypted static identifier broadcast (125 kHz Prox, EM4100, or unauthenticated 13.56 MHz CSN) susceptible to passive harvest and replay."
  condition_requires_validation_criteria: "High-frequency smartcard observed; reader-side cryptographic challenge-response, SAM configuration, and anti-downgrade policies require administrative verification."
mitigation_id: "PHY-M1001"
technical_references:
  - standard: "ISO/IEC 14443-4"
    section: "Transmission Protocol"
  - standard: "NIST SP 800-116 Rev 1"
    section: "Section 4.1"
PHY-TAC-02: Perimeter & Ingress

PHY-T1002: Door & Latch Protection Assessment

Base Coverage
Assessment Hypothesis

Door and frame geometry may permit mechanical manipulation of the latch bolt assembly where protective physical shielding is absent and strike clearances exceed engineering tolerances.

Canonical Technique Specification (YAML)
id: "PHY-T1002"
name: "Door & Latch Protection Assessment"
tactic_id: "PHY-TAC-02"
target_object: "DOOR"
target_time_seconds: 15
hypothesis: "Door and frame geometry may permit mechanical manipulation of the latch bolt assembly where protective physical shielding is absent and strike clearances exceed engineering tolerances."
assessment_procedure:
  method: "visual_and_feeler_gauge"
  tools_required: ["Feeler gap gauge / caliper", "Flashlight"]
result_model:
  hardened_criteria: "Outward door fitted with continuous full-height steel astragal overlapping jamb; latch bolt fully shielded from direct mechanical access."
  deficient_criteria: "Exposed latch bolt with perimeter strike clearance exceeding the applicable assembly tolerance and zero exterior protective astragal plate."
mitigation_id: "PHY-M1002"
technical_references:
  - standard: "NFPA 80"
    section: "Section 6.3.1.7.1"
  - standard: "ANSI/SDI A250.8"
    section: "Section 2.1.8"
PHY-TAC-02: Perimeter & Ingress

PHY-T1003: REX Sensor Placement Assessment

Base Coverage
Assessment Hypothesis

Unshielded Request-to-Exit (REX) passive infrared sensors placed with direct line-of-sight to external portal margins may be triggered from the unsecure exterior side.

Canonical Technique Specification (YAML)
id: "PHY-T1003"
name: "REX Sensor Placement Assessment"
tactic_id: "PHY-TAC-02"
target_object: "SENSOR"
target_time_seconds: 15
result_model:
  hardened_criteria: "Directional deflector hood installed; PIR field-of-view restricted strictly to interior floor."
  deficient_criteria: "Unshielded wide-angle PIR lens with direct optical line-of-sight through portal margins."
mitigation_id: "PHY-M1003"
technical_references:
  - standard: "NFPA 101"
    section: "Section 7.2.1.6.2"
  - standard: "UL 294"
    section: "Access Control System Units"
PHY-TAC-05: Physical-to-Cyber Execution

PHY-T1004: Exposed Physical Network Interface Assessment

Base Coverage
Assessment Hypothesis

Physical network ports located in unmonitored or public areas may permit unauthorized network attachment where ports are active and lack 802.1X port-security enforcement.

Canonical Technique Specification (YAML)
id: "PHY-T1004"
name: "Exposed Physical Network Interface Assessment"
tactic_id: "PHY-TAC-05"
target_object: "PORT"
target_time_seconds: 10
result_model:
  hardened_criteria: "Unassigned wall drop administratively shut down; active ports enforce IEEE 802.1X."
  deficient_criteria: "Unmonitored wall drop broadcasts active Layer 1 carrier signaling without 802.1X isolation."
mitigation_id: "PHY-M1004"
technical_references:
  - standard: "IEEE 802.1X-2020"
  - standard: "NIST SP 800-53 Rev 5"
    section: "PE-3, AC-17, CA-3"
Mathematical Specification

Deterministic Risk Scoring Engine

APCAF strictly rejects rigid universal checklist mandates. Risk is derived deterministically from three orthogonal physical parameters:

Risk Score = Asset Criticality (AC: 1..4) × Physical Exposure (PE: 1..4) × Consequence (C: 1..4)
Score Range Calculated Risk Level Governance Action & Eligibility
1 - 8 LOW Eligible for standard operational risk acceptance with documented rationale.
9 - 23 MEDIUM Requires formal review. Eligible for validated compensating controls or scheduled remediation.
24 - 47 HIGH Mandates prioritized remediation or high-assurance compensating detection with SLA.
48 - 64 CRITICAL Immediate executive escalation, active physical guard post, and remediation hold.
Decision Governance

The 4 Risk Treatment Options

1. REMEDIATE

Direct physical hardware modification satisfying the canonical mitigation specification (`PHY-MXXXX`).

2. COMPENSATE

Deploy a secondary physical barrier or immediate tamper sensor when primary remediation is structurally constrained.

3. ACCEPT

Named business risk owner accepts residual risk within documented organizational appetite with an annual expiration date.

4. AVOID / REMOVE

Eliminate the physical threat surface entirely by decommissioning unneeded ports or walling off redundant openings.

Ground-Truth Proof

Three Canonical Reference Cases

Demonstrating how identical physical observations yield three distinct, defensible outcomes based on context:

Scenario Observation 3-Axis Calculation Appetite Defensible Decision
A. Mop Closet 5.2 mm gap, latch exposed, zero astragal AC-1 × PE-3 × C-1 = 3 (LOW) MEDIUM (Pass) ACCEPT RISK
B. HR Records 4.8 mm gap, historic glass frame AC-3 × PE-2 × C-3 = 18 (MEDIUM) LOW (Breach) COMPENSATE (BMS + Beam)
C. Core Datacenter 5.2 mm gap, server suite double door AC-4 × PE-2 × C-4 = 32 (HIGH) LOW (Breach) REMEDIATE (WF-01 Warranty Hold)
Data Architecture

Case Record Schema (JSON / YAML)

Field triage results and risk calculations are compiled into machine-readable case records matching schemas/case.schema.json:

schema_version: "0.1.0"
case_id: "APCAF-CASE-2026-001"
target:
  facility_name: "Apex Tower HQ"
  zone: "Floor 04 - Core Server Suite"
findings:
  - technique_id: "PHY-T1002"
    disposition: "Deficient"
    evidence:
      strike_clearance_mm: 5.2
      astragal_present: false
    risk_context:
      asset_criticality: 4
      physical_exposure: 2
      consequence: 4
      calculated_risk_score: 32
      calculated_risk_level: "HIGH"
    risk_appetite:
      organizational_appetite: "LOW"
      exceeds_appetite: true
    risk_treatment:
      decision: "REMEDIATE"
      rationale: "Immediate heavy-gauge stainless steel astragal plate installation mandated."
Interoperability

Standards & Framework Cross-Walk

APCAF Technique Technical Benchmark Building & Physical Standards Enterprise Cyber Controls
PHY-T1001 Mutual Cryptographic Smartcard ISO/IEC 14443-4, NIST SP 800-116 ISO 27001 A.7.2, PCI DSS Req 9.2.1
PHY-T1002 Operating Clearances & Astragal Shield NFPA 80 Section 6.3.1.7.1, ANSI/SDI A250.8 ISO 27001 A.7.1, PCI DSS Req 9.1.1
PHY-T1003 Directional Deflector Shroud NFPA 101 Section 7.2.1.6.2, UL 294 ISO 27001 A.7.1, SOC 2 CC6.4
PHY-T1004 Port Administrative Shutdown / 802.1X IEEE 802.1X-2020, NIST SP 800-53 PE-3 ISO 27001 A.8.20, PCI DSS Req 9.1.2
Open Specification

Governance & Contribution Process

APCAF is governed by the APCAF Maintainers under an open Request for Comments (RFC) model. Community proposals for new tactics, techniques, or schema profiles must satisfy three mandatory criteria:

1. Strictly Non-Invasive: Must define repeatable non-destructive observation procedures.
2. Zero Life-Safety Interference: Must never manipulate emergency egress, panic hardware, or fire alarms.
3. Defensible Citations: Grounded in authoritative architectural, fire, or electrical engineering standards.

Read Contribution Guidelines on GitHub →