An air gap lowers risk by removing the network route to a system, but it does not make the system safe. Data, updates, laptops and removable media still cross the gap, and many "air gapped" systems turn out to be connected somewhere. Test the gap, then keep the other controls.
Myth versus fact
| Myth | Fact |
|---|---|
| Air gapped means no network connection | Often a network connection exists that nobody remembers, such as a vendor modem or a second network card |
| Nothing can get in | Files, updates and people carry things across |
| No need to patch or harden | A malicious file or an insider can still reach unpatched flaws |
| No need to monitor | Without monitoring, a breach inside the gap is silent |
| The gap lasts forever | Projects add connections over time |
NIST's boundary protection guidance is useful here. It says the degree of isolation varies depending on the mechanisms chosen, ranging from physically separate networks and routers and firewalls to virtualization and encryption with distinct keys. "Isolated" is a spectrum, and a full air gap sits at one end of it.
How things cross a gap
- Removable media. USB drives and discs used to load data or updates.
- Maintenance laptops. A technician's laptop connected to the system and to the corporate network on another day.
- Update and file transfer processes. A staging machine that touches both sides.
- Hidden connections. Cellular modems, remote support devices, or wireless interfaces that were never switched off.
- People. Anyone with legitimate access.
Checks that show whether the gap is real
- Walk the cables and radios. Physical inspection for extra interfaces, modems and wireless.
- Scan from inside for reachable addresses. From a machine in the gap, try reaching the internet and the corporate network. It should fail.
- Review the data transfer process. Who carries what, using which devices, with what scanning?
- Review the maintenance process. Is the laptop dedicated? Is it cleaned or rebuilt before use?
- Check logs for odd traffic. Wireless or modem activity where none should exist.
Controls that still apply inside the gap
- Least functionality. NIST asks for only essential capabilities and prohibits or restricts unnecessary functions, ports, protocols, software and services. Turn off what the system does not need.
- Media control. A dedicated transfer machine, scanning of files, and a record of every transfer.
- Monitoring. Local logging that someone reviews, even if only monthly.
- Backups. Offline copies and restore tests.
- Physical access. Locks and access logs for the room or cabinet.
Write the real status in the exception
Instead of "air gapped", record "no network connectivity as verified on this date by these checks, with these transfer paths and these controls on them". That wording survives scrutiny and tells the next reviewer what to retest.
Quick check
Is a system air gapped if it is on a separate VLAN?
No. A VLAN is logical separation that depends on configuration. An air gap means no electronic connection at all. A VLAN can still be a strong control, but call it what it is.
Do air gapped systems need vulnerability scanning?
They benefit from knowing what versions run on them. You can inventory and assess offline, for instance by exporting software lists and checking them against advisories on a connected machine.
Sources
- NIST SP 800-53 Rev 5 control catalog (OSCAL JSON, NIST oscal-content repository) (SC-7(21) Isolation of System Components and CM-7 Least Functionality)
Last reviewed: 19 October 2026.
