Reference Checklists & Playbooks
This section turns the guide into an operational kit. Use these checklists before, during, and after the engagement so your physical testing stays repeatable, scoped, and useful even when the site, client, or objective changes.
Information
Pre-Engagement Checklist
authorization
- signed rules of engagement
- explicit allowed / prohibited personas
- after-hours and law-enforcement coordination language
- emergency stop procedure and 24/7 contacts
site preparation
- target address, tenant map, and parking strategy
- floor plans or public maps if available
- staff / vendor / executive names from OSINT
- communication plan and safe words for the team
technical prep
- charge all devices and validate time sync
- prepare evidence folder structure before the engagement
- confirm what level of proof is enough: photo, badge event, workstation access, implant, or full pathRapid Office Playbook
Phase 1: Observe
- • Count entrances, cameras, and reception lines of sight
- • Identify shift or lunch pressure points
- • Choose the most credible entry route
Phase 2: Enter
- • Use the approved persona or tailgating route
- • Record the first control that grants trust
- • Stay calm and keep the story short
Phase 3: Prove
- • Capture the agreed objective evidence
- • Avoid extra movement that does not improve the finding
- • Exit cleanly and write the route while it is still fresh
Offensive Track Decision Guide
| If You See | Go To | Reason |
|---|---|---|
| Legacy 125 kHz badges, exposed readers, weak credential habits | Section 04 | Likely credential attack path with strong remediation value |
| Rushed employees, loaded hands, or weak challenge culture | Section 08 | Human friction is likely the first control to fail |
| Maglocks, REX sensors, and accessible door gaps | Section 09 | Electronic door behavior may be easier to abuse than mechanical hardware |
| Accessible conference-room ports or unattended privileged workstations | Section 05 | Entry can turn directly into internal or endpoint compromise |
Reporting Scaffold
1. Engagement context
- dates, location, scope, authorization summary
2. Attack path summary
- route used, key transitions, detection points missed
3. Findings
- visitor / social weaknesses
- badge / door weaknesses
- surveillance / response weaknesses
- post-entry exposure
4. Impact and likelihood
- what the tester reached
- what a malicious operator could reasonably do next
5. Recommendations
- quick wins in 30 days
- design fixes in 90 days
- program changes in 180 days
6. Evidence appendix
- sanitized photos
- timeline
- standards referencesUse The Minimum Playbook That Fits The Site
The Observation Record
Every playbook above ends in the same artefact. One line per observation, and no line without these fields:
Site and zone: Building, floor, and the door, reader, or area observed, plus the zone class: public, staff, or restricted.
Date and time: Local time of the observation, and the authorised window it falls inside. Anything outside the window is context.
Control inspected: The specific control, named by location and model, not the policy that is supposed to govern it.
Photo reference: Filename or frame number, matched to the timeline entry so the appendix cannot drift from the narrative.
Access tested: Whether the control was tested, and by what method: walk-by, pretext, tailgate, credential, or hardware bypass.
Observer route: How the tester reached the observation point, including each transition where someone granted trust.
False Positives
- Entry logged without a control: Walked in is not a finding. Name the control that should have stopped the tester, and say what it did instead.
- Phase marked done without evidence: A playbook step ticked with nothing behind it is a gap in the record. Leave it unticked and say why.
- Control disabled for maintenance: A door held open during a service visit or a camera offline for repair is a known state, not a weakness found.
- Test outside the authorised window: Before the start or after the end of the agreed hours, the observation goes in the context section.
- Third-party access mistaken for yours: A cleaner or contractor holding a door is using their own access. Record it only if the point is that nobody challenged either of you.