APCAF
Run 45s QA
APCAF BASE v0.1.0 NON-INVASIVE ASSESSMENT FRAMEWORK

Physical Security Control Assessment

A passive, standardised framework for assessing whether installed physical controls resist known bypass techniques.

Launch 45s Triage → Learn APCAF
45s Target Walk Budget
4 Objects Baseline Physical Scope
Passive Base Profile Scope
Direct Field Entry

What are you inspecting right now?

Select a physical asset to immediately open its defined inspection procedure in the field triage workbench.

DOOR PHY-T1002 / PHY-T1003
Latch, Frame & Portal Conditions
Measure frame strike clearance against the 3.2mm (1/8 in.) threshold and check for continuous protective steel astragals.
15s Feeler Gauge Check Inspect Door →
BADGE PHY-T1001
Credential Technology & Passive Exposure
Interrogate badge carrier frequency to establish whether credentials broadcast unencrypted static UIDs without crypto mutual auth.
5s Pocket Reader Check Inspect Badge →
PORT PHY-T1004
Physical Network-Interface Exposure
Plug a passive zero-packet LED tester into common area RJ-45 wall drops to check for administrative port shutdown or isolation.
10s Passive LED Check Inspect Port →
SENSOR PHY-T1003
REX Sensor Exposure & Activation
Inspect perimeter transom margins for optical line-of-sight to the interior Request-to-Exit sensor and verify directional deflector hoods.
15s Line-of-Sight Check Inspect Sensor →
Methodology

How APCAF Works: The 5-Step Model

A standardised evaluation chain linking threat goals to verified technical remediation.

Step 1
Tactic
What the adversarial intruder wants to achieve (e.g., Portal Ingress).
Step 2
Technique
How they may achieve it through physical hardware bypasses (e.g., Latch Slip).
Step 3
Observation
What the assessor can directly establish with non-invasive tools (e.g., 4.5mm strike gap).
Step 4
Classification
What APCAF determines from that observation (Hardened vs Deficient).
Step 5
Remediation
What hardware or configuration correction is required (e.g., Full-height astragal).
Baseline Scope

The 4 Core MVP Techniques

Defined non-invasive inspection procedures tested during physical site walks.

PHY-T1001 Credential
Unencrypted RFID Harvesting
Checks if credentials broadcast static unencrypted UIDs without cryptographic challenge-response authentication.
Test in Triage →
PHY-T1002 Portal Ingress
Mechanical Latch Slip
Checks if outward door operating clearance exceeds 3.2mm without continuous protective steel astragal shielding.
Test in Triage →
PHY-T1003 Portal Ingress
REX Sensor Blind Activation
Checks if the interior Request-to-Exit motion sensor optical field is unhooded and visible through door margins.
Test in Triage →
PHY-T1004 Interface
Exposed Active Network Drop
Checks if unmonitored common area Ethernet wall jacks broadcast an active Layer 1 carrier without port shutdown.
Test in Triage →
Schema Validation Fixture

Synthetic Demonstration Walkthrough

A simulated case fixture illustrating how field observations map to YAML records and CISO warranty punch lists.

Schema Fixture: APCAF-CASE-001
Simulated Datacenter Suite Inspection
SYNTHETIC: NO REAL FACILITY ASSESSED
45s Target Inspection Budget
3 Controls Simulated Scope
2 Deficient / 1 Hard Simulated Findings
YAML Case Schema Validation
Validation status: synthetic_fixture • Real field evidence will be catalogued during upcoming authorized audits. Load Synthetic Demo in Triage →
Explore the Standard

Choose Your Pathway

Everything you need to evaluate, learn, or contribute to physical security engineering.

1. Learn it • 15 Min
I'm new to APCAF
Master the 5-step evaluation chain (Tactic → Technique → Observation → Classification → Remediation) and run the interactive simulator.
Start Field Guide → 2. Use it • 45s Walk
I'm assessing a facility
Run the standardised 45-second physical triage workbench. Test credentials, tolerances, and port states to compile instant warranty notices.
Launch 45s Field Triage → 3. Browse it • Open Matrix
I want the technique catalog
Browse active techniques, observable telemetry thresholds, building code citations, and structured YAML case fixtures.
Browse Rule Repository → 4. Study it • Standards & Code
I want the specification
Explore technical taxonomy mappings, building and fire code citations (NFPA 80 / ANSI SDI / ISO 14443), and YAML specifications.
Read Technical Specification →
Cross-Walked to Selected Security & Building Standards
ISO 27001:2022 A.7 PCI DSS v4.0 Req 9 SOC 2 CC6.4 NIST SP 800-53 PE-3 NFPA 80 §6.3.1.7.1 ISO/IEC 14443-4