Air gapping is the separation of a recovery or data environment from direct exposure to the production network and external access paths. In cloud settings, it is often implemented logically rather than physically, creating isolation that limits an attacker’s ability to move from a compromised system into recovery assets.
Expanded Definition
Air gapping is a separation strategy, not a guarantee of security. Its core purpose is to remove direct network reachability between a production environment and a recovery, backup, or sensitive data environment so that routine compromise of one side does not automatically provide a live path into the other. In practice, the term is used across physical isolation and logical isolation models, with cloud deployments often relying on tightly segmented controls rather than literal disconnected hardware.
The boundary is important: an air gap is only meaningful if it is preserved across administration, identity, storage replication, and change workflows. A system can be “air gapped” in name while still exposed through shared credentials, management planes, or synchronisation jobs. Guidance is more consistent than consensus on one point: the stronger the dependency on shared control channels, the weaker the practical isolation. That is why NHI Management Group treats air gapping as a resilience and containment design, not a standalone assurance claim.
A useful way to distinguish it from ordinary segmentation is that segmentation narrows access, while air gapping aims to break direct attack paths altogether. The tradeoff is operational complexity, because the more tightly the boundary is protected, the more deliberate the mechanisms for updates, restores, and verification must become.
Examples and Use Cases
Air gapping appears in environments where preserving recovery integrity matters more than convenience. It is common in disaster recovery design, archival storage, regulated records handling, and high-assurance backup schemes.
- A backup vault is placed on a separate network and only reached through a controlled restore process, limiting ransomware spread from production systems.
- An offline copy of critical data is retained for incident recovery when online replicas might be encrypted, deleted, or tampered with during an intrusion.
- A sensitive research environment is isolated so that production users cannot directly browse or mount its storage, reducing exposure from routine endpoint compromise.
- A cloud recovery environment is logically separated with restricted routing, independent administrative access, and delayed synchronisation so compromise in one zone does not automatically propagate.
The tradeoff is that stronger isolation usually makes restores slower and operational testing more demanding. If the recovery path is too cumbersome, teams may drift toward convenience shortcuts that quietly reintroduce connectivity and weaken the boundary.
Security Implications
When air gapping is misunderstood, organisations often assume isolation exists because the environments are on different networks. In reality, the weakest point is frequently the control plane around the gap: admin access, backup orchestration, storage replication, patch staging, or remote maintenance. If those pathways are shared, the attacker may not need a direct route into the isolated environment at all.
That creates a failure mode where the “protected” system is still reachable through trusted operations, stale credentials, or automated synchronisation. The consequence is especially severe for backup and recovery assets, because those systems are intended to support restoration after an incident. If they are modified, encrypted, or destroyed, recovery options collapse and the organisation may lose both data availability and restoration trust.
Observable symptoms include backup jobs that run too frequently to be meaningfully isolated, management accounts that can touch both environments, and recovery systems that depend on the same identity provider or automation pipeline as production. In those cases, the air gap exists more in documentation than in attack resistance.
Domain and Governance Relevance
In cybersecurity governance, air gapping is relevant because it shifts the control objective from detection to containment and recovery assurance. It matters most where organisations need a credible fallback after compromise, especially for backup vaults, archival stores, and critical recovery services. The design question is not whether separation exists in theory, but whether it survives the realities of administration and restore operations.
For identity and access governance, the material point is that shared access can defeat the purpose of isolation. If the same human or non-human identities can administer both sides, then the boundary depends on privilege discipline as much as network design. That is why recovery environments need separate ownership, constrained access paths, and explicit review of any automation that can bridge the gap.
From NHIMG’s perspective, the practical insight is simple: air gapping is only as strong as the trust links that remain. When machine access, secret reuse, or automated replication spans the boundary, the environment is not truly isolated in the way practitioners usually intend.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 — Access Permissions and Remote Access | Air gapping depends on restricting administrative paths across the boundary. |
| PR.DS-1 — Data-at-Rest Protection | Isolated backup and recovery data must remain protected while offline or staged. | |
| RC.RP-1 — Recovery Plan Execution | Air gapping is used to support credible recovery during incidents. | |
| Recommendation — Separate privileged access paths so recovery assets are not reachable through shared admin channels. Protect offline recovery data so isolation is preserved even when media is mounted or restored. Test restore procedures against the isolated environment to confirm recovery still works under incident conditions. | ||
| CIS Controls v8 | 6 — Access Control Management | Air-gapped value is reduced when access is shared across production and recovery zones. |
| 12 — Network Infrastructure Management | Logical air gaps rely on strict network separation and routing discipline. | |
| Recommendation — Remove shared administrative access that can bridge production and isolated recovery systems. Enforce segmentation and routing controls that prevent unintended connectivity into isolated environments. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Shared secrets can silently defeat an air gap by enabling cross-environment access. |
| Recommendation — Rotate and isolate credentials so automation cannot reuse the same secret across both sides of the gap. | ||
