What does air-gapped mean?

An air gap is an interface between two systems at which they are not physically connected and any logical connection is not automated, so data crosses only by hand, under human control. That is the definition in the National Institute of Standards and Technology (NIST) glossary, taken from the 2022 glossary of the Committee on National Security Systems (CNSSI 4009-2022), which draws on Internet Engineering Task Force (IETF) Request for Comments (RFC) 4949. Two facts follow from public guidance. Data still crosses an air gap, carried by a person. And an air gap is not enough by itself: NIST's guide to operational technology security says that as those systems connect to information technology (IT) networks, relying on traditional measures such as air gaps is not enough to protect them.

The definition has two parts

The glossary sets two conditions. First, the two systems are not physically connected. Second, any logical connection is not automated: data moves through the interface "only manually, under human control." The definition does not say that nothing ever crosses. It says a person moves it.

The same glossary defines removable media, also from CNSSI 4009-2022, as a portable data storage medium that can be added to or removed from a computing device or network. The examples include optical discs, external hard drives and solid-state drives, magnetic and optical tapes, flash memory devices, and flash memory cards.

A joint guide published April 29, 2026 ties the two terms together. Because many operational technology (OT) systems are air-gapped or isolated, the guide calls removable media a significant adversarial attack vector. It says data moved into and out of OT systems must follow core practices: encryption, access controls, and auditing of removable media use.

Air-gapped, isolated, and disconnected

Public guidance uses the three words side by side. The Cybersecurity and Infrastructure Security Agency (CISA) Cross-Sector Cybersecurity Performance Goals, Version 2.0 (CPG 2.0), dated December 2025, refers to disconnected or air-gapped networks. The joint zero trust guide for OT, from CISA, the Department of War (DoW), the Department of Energy, the Federal Bureau of Investigation (FBI), and the Department of State, refers to isolated or air-gapped OT networks.

The joint guide treats isolation as the wider idea. The segmentation techniques it says legacy OT already has include physical air gaps, dedicated virtual local area networks (VLANs), and controlled access to sensitive zones. The tools it lists for segmenting include firewalls, secure gateways, and data diodes, which enforce one-way communication through hardware. A VLAN or a data diode is a physical connection, so under the glossary's first condition a network separated that way can be isolated without being air-gapped.

The guide uses disconnection as an action. An incident response plan should define when and where systems are disconnected and who is pre-authorized to do it. Read that way, disconnection is an event, while an air gap is a property of the interface the glossary defines.

What NIST uses air gaps for

NIST SP 800-82 Revision 3, published September 2023, uses air gaps for narrow purposes. In its discussion of information flow enforcement, it says information flow policy can combine logical and physical restrictions, helped by labeling or coloring physical connectors, and that devices with no business need to communicate should not be connected, which it calls air gapped. For incident response, it says response plans should be kept on paper or on an offline, air-gapped system that cannot be compromised during a cyber attack.

The same guide limits the claim. As OT systems are increasingly connected to IT networks, it says, relying on traditional measures such as air gaps is not enough, and security measures tailored to the OT system are required.

Where air gaps fail

Field results point the same way. In an October 5, 2023 advisory, the National Security Agency (NSA) and CISA report that their assessment teams have often gained access to OT networks despite prior assurance that the networks were fully air gapped. The teams got in through special purpose, forgotten, or even accidental network connections.

The manual path is the second weak point. CPG 2.0 warns that adversaries might infiltrate disconnected or air-gapped networks by copying malware to removable media such as Universal Serial Bus (USB) drives, and recommends limiting USB devices and securing physical ports. The Stuxnet advisory from the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), archived on CISA's site and last revised January 8, 2014, says USB drives appeared to be a primary infection mechanism, with network shares and databases as other routes.

Data can also leave without a cable. At the 2015 USENIX Security Symposium, researchers from Ben-Gurion University of the Negev presented GSMem, malware that, once on an air-gapped computer, sent data over cellular frequencies to a nearby phone. They reported 1 to 5.5 meters with a standard mobile phone and over 30 meters with a dedicated receiver.

The 2026 joint guide puts it in four words: "Air gaps can be bridged." It advises against buying components or systems that assume security through air-gapping or segmentation alone. It also notes that most endpoint detection and response products rely on a connection back to the vendor's servers, which is often prohibited or impractical in isolated or air-gapped OT networks.

What to check

• Does the system meet both parts of the definition: no physical connection, and any transfer manual and under human control?
• Has anyone searched for special purpose, forgotten, or accidental connections, the paths NSA and CISA teams found?
• What is the approved path for data in and out, and how are removable media and physical ports controlled?
• Does any installed software, including security tools, need a connection back to its vendor?
• When a document says "isolated" or "disconnected," what still connects the network: a VLAN, a gateway, or a data diode?
• Is the air gap the only control, which the 2026 joint guide advises against?

Azcuna's BABEL reads, translates, and searches foreign-language documents entirely on-device, with no cloud and no connection, and keeps every claim tied to the passage it came from.

Sources

1. 1air gap (glossary entry) · National Institute of Standards and Technology, from CNSSI 4009-2022
2. 2removable media (glossary entry) · National Institute of Standards and Technology, from CNSSI 4009-2022
3. 3NIST SP 800-82r3, Guide to Operational Technology (OT) Security · National Institute of Standards and Technology, September 2023
4. 4NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations (AA23-278A) · Cybersecurity and Infrastructure Security Agency and National Security Agency, October 5, 2023
5. 5Cross-Sector Cybersecurity Performance Goals, Version 2.0 · Cybersecurity and Infrastructure Security Agency, December 2025
6. 6Adapting Zero Trust Principles to Operational Technology · CISA, Department of War, Department of Energy, FBI, Department of State, April 29, 2026
7. 7Stuxnet Malware Mitigation (Update B), ICSA-10-238-01B · ICS-CERT, Cybersecurity and Infrastructure Security Agency (archived), last revised January 8, 2014
8. 8GSMem: Data Exfiltration from Air-Gapped Computers over GSM Frequencies · 24th USENIX Security Symposium, 2015

Where this shows up in our work

• ELLMENT, the offline LLM for E-2D crews answers a crew's question from the aircraft's own manuals and cites the page, with no network.
• BABEL, offline multilingual translation and search translates and searches foreign-language documents on-device, every fact tied to its source passage.
• TRACE, the offline S1000D and IETM viewer opens S1000D, MIL-STD-3001 and PDF technical manuals on a tablet with every marking intact.