An air gap is an interface between two systems where they are not physically connected and any logical connection is not automated, so data crosses only by manual action under human control. That definition is from CNSSI 4009 as listed by NIST. An air gap cuts remote attack paths, but every transfer becomes a path of its own.
What does the formal definition say?
NIST's glossary quotes the Committee on National Security Systems, which defines an air gap as an interface between two systems at which (a) they are not connected physically and (b) any logical connection is not automated, meaning data is transferred only manually, under human control.
Two points stand out. First, "not connected physically" means no cable, no wireless link and no shared network. Second, the phrase "under human control" matters: a gap is a process as much as a wall. A person decides what crosses, and that decision is where the control lives.
What does an air gap protect against?
It removes the easy attacks: someone on the internet probing an exposed port, a stolen password used over the network, or malware phoning home to a command server. It also limits how fast an intrusion spreads, because there is no route to follow.
That is why air gaps appear in settings where compromise is very costly, such as classified networks, industrial control systems, and backup copies meant to survive ransomware.
Where does an air gap leak?
Software has to get in and data often has to get out. A constructed example: an industrial plant keeps its control network isolated. Once a month, an engineer brings a laptop with vendor patches on a USB stick. The stick was last used on an office PC. Anything on that PC can now reach the plant.
The common leaks:
- Removable media. USB drives, discs and laptops are the main bridge.
- Updates and patches. Isolated systems still need fixes, so a transfer process has to exist.
- Maintenance access. Vendor laptops and diagnostic tools plugged into the isolated side.
- Hidden connections. A forgotten modem, a cellular router for remote support, or a wireless adapter left enabled.
- Insiders. Someone with legitimate access to both sides.
- Supply chain. Compromised software or firmware that arrives through the approved transfer route.
So treat an air gap as strong exposure reduction, not a guarantee.
How do you keep software current inside one?
You need a controlled path for updates:
- Fetch and verify packages on a connected staging machine: check signatures and hashes against the publisher's values.
- Scan the staged files, including for known vulnerabilities in dependencies.
- Move them on dedicated, labeled media that never goes anywhere else, or through a one-way transfer device.
- Scan again on the isolated side before installing.
- Keep a record of what crossed, when, who approved it and what the hashes were.
The same applies to vulnerability data: databases of known flaws need to be imported on a schedule, or your scans quietly go stale.
When is an air gap the right choice?
It fits systems where the cost of compromise is very high and the need for outside connectivity is low. It is a poor fit for systems that must receive frequent updates, exchange data in real time, or be managed by a small team without strict procedures, because the manual transfer path then becomes the weak point. If you cannot staff the process, a well segmented network with strict access controls may protect you better than an air gap that is quietly bridged by convenience.
How to check or apply this
- Map every connection to the isolated environment, including maintenance, power monitoring and wireless.
- Write the transfer procedure and require two people for each import.
- Dedicate media to one direction and scan it at both ends.
- Verify signatures and hashes on everything that crosses.
- Refresh vulnerability data and software on a fixed schedule, and log it.
- Test the gap: confirm there is no route, and audit the physical ports.
Quick check
Is a network with a strict firewall air gapped?
No. A firewall still allows an automated logical connection. An air gap requires that no automated connection exists.
Can malware cross an air gap?
Yes, if it rides on removable media, a maintenance laptop or an approved update. That is why transfer procedures matter.
Sources
Last reviewed: 18 October 2026.
