APCAF
Run 45s QA
APCAF BASE v0.1.0 OPEN PHYSICAL SECURITY SPECIFICATION

Physical security deserves more than a checklist.

APCAF is an open specification for systematically assessing physical security controls against adversarial bypass techniques, using observable evidence, structured evaluations, and organization-defined risk appetite.

Explore Knowledge Base → Launch Field Workbench
6 Tactics Physical Attack Surface
3-Axis Deterministic Risk Engine
Non-Invasive Zero Operational Impact
Pillar 01

Open Specification

Public techniques, structured schemas, and taxonomy published under CC BY 4.0 and MIT.

Pillar 02

Evidence-Based

Structured physical observations, millimeters, and carrier signals instead of subjective checklist answers.

Pillar 03

Risk-Aware Decisions

Findings evaluated deterministically against Asset Criticality, Physical Exposure, and Consequence.

Pillar 04

Built for Facilities

Designed for CISOs, security engineers, auditors, facilities teams, and commissioning oversight.

Methodology Chain

From Physical Observation to Defensible Action

A rigorous 6-stage lifecycle linking adversary hypotheses to organizational risk treatment.

01
Technique
What can an adversary attempt? (e.g. Latch Slip).
02
Observation
What does the assessor directly measure? (e.g. 5.2mm gap).
03
Evidence
What objective data proves the condition? (e.g. photo/gauge).
04
Disposition
Hardened, Deficient, or Requires Validation.
05
Risk Context
Deterministic score: Asset Criticality × Exposure × Impact.
06
Treatment
Remediate, Compensate, Accept, or Avoid.
Knowledge Base

The 6 Physical Assessment Tactics

A comprehensive classification of the physical attack surface inspired by behavioral threat modeling.

TA01 Reconnaissance
Physical Reconnaissance
Camera blind spot mapping, guard patrol pattern observation, badge-reader identification, and facility layout discovery.
Status: Candidate Catalog
TA02 • PHY-T1002 Perimeter & Ingress
Perimeter & Portal Ingress
Door & Latch Protection (PHY-T1002), tailgating assessment, door gap feeler exploitation, and barrier bypass.
Assess in Triage (PHY-T1002) →
TA03 • PHY-T1001 Credential Bypass
Credential & Access Bypass
Credential Technology Assessment (PHY-T1001), low-frequency 125 kHz RFID harvesting, static CSN replay, reader wiring exposure.
Assess in Triage (PHY-T1001) →
TA04 • PHY-T1003 Interior Traversal
Interior Traversal & Evasion
REX Sensor Blind Activation (PHY-T1003), mantrap anti-passback bypass, CCTV blind spot transit, partition wall penetration.
Assess in Triage (PHY-T1003) →
TA05 • PHY-T1004 Physical-to-Cyber
Physical-to-Cyber Execution
Exposed Network Interfaces (PHY-T1004), unprotected USB/console access, rogue hardware drop implant opportunities.
Assess in Triage (PHY-T1004) →
TA06 Egress & Cleanup
Egress & Cleanup
Emergency egress hardware manipulation, departure access logging evasion, physical evidence and badge recovery weaknesses.
Status: Candidate Catalog
Risk Context Model

Same Hardware Weakness. Three Different Decisions.

How APCAF avoids rigid checklists by evaluating physical findings against asset criticality and consequence.

Scenario A • Mop Closet
Low-Value Storage
5.2mm latch gap. AC-1 × PE-3 × C-1 = Score 3 (LOW). Falls within organizational appetite.
Defensible Decision
ACCEPT RISK
Scenario B • HR Records
Restricted Office
4.8mm gap on glass portal. AC-3 × PE-2 × C-3 = Score 18 (MEDIUM). Exceeds Low appetite.
Defensible Decision
COMPENSATE (BMS Sensor)
Scenario C • Core Datacenter
Server Suite East
5.2mm gap on production door. AC-4 × PE-2 × C-4 = Score 32 (HIGH). Exceeds Low appetite.
Defensible Decision
REMEDIATE (Astragal)
Explore the Full Interactive Risk Engine →
Navigation

Choose Your Pathway

Everything you need to evaluate, learn, or build with the APCAF standard.

1. Explore it
Knowledge Base
Browse the searchable catalog of physical assessment techniques, tolerances, building codes, and mitigation specs.
Search Knowledge Base → 2. Run it
Field Workbench
Conduct standardized non-invasive assessments, capture evidence, calculate risk scores, and compile YAML records.
Launch 45s Workbench → 3. Score it
Risk Model
Test the deterministic scoring engine across Asset Criticality (AC), Exposure (PE), Consequence (C), and Appetite.
Open Risk Calculator → 4. Govern it
About & Governance
Learn why APCAF exists, how it aligns with MITRE ATT&CK, ISO 27001, and CIS Benchmarks, and how to propose RFCs.
Read Governance Model →
Cross-Walked to Selected Security & Building Standards
ISO 27001:2022 A.7 PCI DSS v4.0 Req 9 SOC 2 CC6.4 NIST SP 800-53 PE-3 NFPA 80 §6.3.1.7.1 ISO/IEC 14443-4