APCAF
Run 45s QA
APCAF SPECIFICATION PHYSICAL RISK CONTEXT & TREATMENT

Physical Risk Needs Context

A physical control weakness does not have the same significance everywhere. APCAF evaluates findings against Asset Criticality, Physical Exposure, and Consequence, enabling deterministic risk scoring and defensible treatment decisions without rigid checklist mandates.

The 3-Axis Model

Evaluating Physical Exposure & Impact

Three independent, observable physical parameters derive the calculated risk priority.

Axis 01

Asset Criticality (AC)

The operational, financial, or data value of the protected zone.

AC-1
Low: General office space, break rooms, non-sensitive storage.
AC-2
Moderate: Staff-only areas, routine administrative workspaces.
AC-3
High: Sensitive business ops, HR records, executive suites.
AC-4
Critical: Server rooms, datacenters, payment enclaves (CDE), SCADA.
Axis 02

Physical Exposure (PE)

The accessibility and boundary layers surrounding the control.

PE-1
Controlled: Deep interior zone with 24/7 monitored access.
PE-2
Restricted: Secondary interior zone behind badge barrier.
PE-3
Accessible: Multi-tenant lobbies, elevator vestibules, corridors.
PE-4
Public: Exterior perimeter, public street entrances, fence lines.
Axis 03

Consequence (C)

The direct impact if the physical control is successfully defeated.

C-1
Negligible: Zero data loss or operational disruption.
C-2
Operational: Localized delay; minor non-confidential damage.
C-3
Security/Financial: Lateral access to sensitive records or funds.
C-4
Catastrophic: Core infrastructure outage or life-safety breach.
Interactive Engine

Deterministic Risk Scoring Calculator

Test combinations of Asset Criticality, Physical Exposure, Consequence, and Organizational Risk Appetite.

Deterministic Calculation Output:
32
HIGH RISK
EXCEEDS APPETITE
Formula: 4 (AC-4) × 2 (PE-2) × 4 (C-4) = 32 (Score Domain: 1..64)
Recommended Treatment:
REMEDIATE (Priority)

Calculated risk exceeds organizational appetite. Mandatory physical hardware correction required.

Defensible Benchmarks

Three Canonical Ground-Truth Scenarios

Identical physical hardware observation (5 mm frame gap on PHY-T1002) producing three distinct, defensible outcomes based on asset context.

Scenario A: Low Impact
Janitorial Mop Closet
AC-1 (Low) PE-3 (Accessible) C-1 (Negligible)
Observed: 5.2 mm strike clearance on outward door; latch bolt exposed; no astragal plate.

Calculation: 1 × 3 × 1 = 3 (LOW).
Appetite: Organization tolerates Medium. Exceeds appetite: false.
Defensible Decision
ACCEPT RISK
Routine replacement at standard lifecycle end.
Scenario B: Moderate Impact
HR Confidential Records
AC-3 (High) PE-2 (Restricted) C-3 (Security)
Observed: 4.8 mm clearance; architectural glass frame cannot receive external steel astragal.

Calculation: 3 × 2 × 3 = 18 (MEDIUM).
Appetite: Organization specifies Low. Exceeds appetite: true.
Defensible Decision
COMPENSATE
Deploy validated balanced magnetic switch (BMS) + optical beam sensor.
Scenario C: Critical Impact
Primary Datacenter Suite
AC-4 (Critical) PE-2 (Restricted) C-4 (Catastrophic)
Observed: 5.2 mm strike gap on double door; unshielded latch protecting production servers.

Calculation: 4 × 2 × 4 = 32 (HIGH).
Appetite: Organization specifies Low. Exceeds appetite: true.
Defensible Decision
REMEDIATE
Install full-height interlocking steel astragal. Issue warranty hold (WF-01).
Governance & Treatment

The 4 Risk Treatment Options

Formalized paths for risk disposition, accountability, and compensating control validation.

Option 01

REMEDIATE

Direct physical hardware correction to satisfy the APCAF mitigation specification (`PHY-MXXXX`).

  • Primary path for high/critical findings exceeding risk appetite.
  • Expected residual risk: LOW.
  • Integrates with APCAF-WF-01 vendor warranty punch lists.
Option 02

COMPENSATE

Deploy a validated secondary control when primary physical remediation is structurally impossible.

  • Anti-Checklist Rule: CCTV does not magically compensate for a latch gap.
  • Must provide direct, verified barrier or immediate tamper detection.
  • Requires documented effectiveness validation.
Option 03

ACCEPT

Designated business risk owner accepts the residual risk within documented organizational appetite.

  • APCAF records the decision; the organization owns the acceptance.
  • Mandatory named Risk Owner and technical rationale.
  • Mandatory annual review / expiration date (≤ 365 days).
Option 04

AVOID / REMOVE

Eliminate the physical threat surface entirely by decommissioning or re-architecting the asset.

  • Decommission unassigned network wall drops.
  • Relocate sensitive servers to higher-security enclaves.
  • Permanently wall off redundant external pedestrian portals.

Ready to run a field assessment with risk context?

The APCAF Field Workbench includes the live deterministic risk engine, telemetry logging, and YAML export.

Open Field Workbench → Read Full Documentation