An air-gapped device is a computer or system kept physically and logically isolated from other networks, especially the internet. It exchanges data only through controlled manual transfer, such as removable media or directly connected maintenance tools, which reduces remote attack paths but also limits routine monitoring and updates.
Why Air-Gapped Devices Matter
An air-gapped device reduces remote attack surface by removing routine network connectivity, but it does not make a system inherently trustworthy. Security still depends on who can access it physically, what media can be introduced, and how carefully those transfer paths are controlled.
This isolation model is most valuable where compromise impact is high, such as backup repositories, recovery hosts, industrial systems, or sensitive research systems. The trade-off is operational friction: updates, telemetry, and administration become slower and easier to mishandle.
How Air-Gapped Devices Exchange Data
Because an air-gapped device cannot rely on normal network delivery, every data transfer becomes an explicit security event. That usually means removable media, one-way transfer workflows, or directly connected maintenance tools that are only used under controlled conditions.
The security value of the air gap comes from shrinking the number of paths an attacker can use, not from eliminating all paths. If transfer procedures are informal, the isolation can be undermined by contaminated media, unverified files, or maintenance laptops that themselves have weak security.
Operational Limits and Security Trade-offs
Air-gapped devices are often chosen to protect high-value systems from remote intrusion, but isolation also limits patching, inventory visibility, log collection, and central monitoring. Those gaps can leave a device protected from the internet while still exposed to delayed detection or stale configuration risk.
For that reason, air-gapping works best as one layer in a broader control set. Strong physical access control, strict media handling, integrity checks, and well-practised update procedures matter as much as the absence of a network connection.
Backup and recovery designs often use this pattern, and NHIMG’s Backup Security and Immutable Backup Guide explains how isolation, immutability, and restore testing fit together in resilient recovery architecture.
When Air-Gapped Devices Are Used
Air-gapped devices are common in environments where confidentiality, integrity, or continuity outweigh convenience. Examples include offline recovery vaults, classified or regulated systems, and equipment that must remain operational even if external networks are compromised.
They are especially useful when the main concern is preventing remote ransomware spread or limiting the blast radius of a wider compromise. NHIMG’s Ransomware Response and Recovery Guide and Cyber Recovery Vault Guide both show why isolation is valuable, but also why recovery testing and controlled access still matter.
Risk and Threat Considerations
An air-gapped device lowers remote exposure, but it creates a different risk profile: the main failure modes shift to physical compromise, infected removable media, maintenance abuse, and weak recovery discipline. In practice, attackers often need only one trusted transfer path to reintroduce malware or tamper with data.
Failure mechanism: Compromise usually occurs when a supposedly controlled transfer channel is abused, such as through infected media, an exposed maintenance laptop, or an operator process that bypasses verification and imports malicious content.
Impact: The device can be infected, altered, or denied service without ever being reachable from the internet, and the isolation can delay detection because standard network monitoring is absent.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-11 — Data Recovery | Air-gapped recovery depends on tested backup and restore capability. |
| Recommendation — Test isolated recovery copies regularly and validate that restores work after compromise. | ||
| NIST SP 800-53 Rev 5 | CP-9 — System Backup | Air-gapped devices are often used to protect backup and recovery data from network compromise. |
| CP-10 — System Recovery and Reconstitution | Isolation only helps if the system can be restored cleanly after an incident. | |
| Recommendation — Maintain protected backup copies that can survive network-borne attacks. Prepare and rehearse clean recovery procedures for offline or isolated systems. | ||
| ISO/IEC 27001:2022 | A.8.13 — Information backup | Air-gapped designs are commonly used to create protected backup copies under controlled recovery conditions. |
| Recommendation — Keep protected backup copies in an isolated recovery design and verify restore capability. | ||
| NIST CSF 2.0 | PR.DS-11 — Data Retention and Disposal | Isolated systems rely on controlled storage, retention and disposal of offline media and copies. |
| Recommendation — Control retention and disposal of offline media and recovery copies to prevent exposure. | ||
Practitioner Guidance
Why practitioners should care: Treat the air gap as a control boundary, not a guarantee. The device is only as safe as its physical access rules, media controls, and restore procedures.
What to watch for: Watch for shared removable media, ad hoc maintenance practices, undocumented exceptions, and any transfer workflow that skips verification or integrity checking. Those are the points where isolation is most likely to fail.
Practitioner takeaway: If the air gap is protecting something critical, the transfer process deserves the same level of governance as the system itself.