Air-gapped vs connected security: account for every crossing
An air gap removes a direct network connection; it does not remove the need to maintain the system or control what enters it. A connected design permits specified network paths and needs controls around those paths. The procurement decision should account for both: how the operation will run without a connection, and how updates, support and information transfers will work in practice. Neither label establishes that a system is secure.
Draw the boundary before naming it
Ask for a diagram showing every permitted network path and every transfer procedure. Include maintenance equipment, removable media and temporary support access. A firewall-controlled connection is not an air gap, and a network normally disconnected but opened for servicing needs its servicing state assessed too. We would ask bidders to describe the design in these concrete terms before accepting a claim of isolation. The diagram should match operating procedures, not just the installation-day configuration.
Specify how the isolated system will be maintained
An isolated installation still needs a method for assessing and introducing updates, reviewing security information and recovering after a fault. Ask who performs that work on site and how incoming material is checked. Define which records must leave the protected environment and how their transfer is authorised. For OT, test the procedure against operating and safety requirements. NIST's OT guidance supplies a framework for assessing those requirements, but the buyer must still establish whether the proposed procedure is practical at the actual site.
For a connected design, justify each permitted path
Do not accept a general request for remote access where a specific maintenance task would do. Require the bidder to identify the users, destinations, permissions and records needed for each connection, including temporary support. Then examine what happens when the link fails or access is withdrawn. A distributed operation may have sound reasons to connect its sites. Those reasons should appear in the requirement, with the security and operational responsibilities attached, rather than emerging after the equipment has been purchased.
Next action
Review a network-and-transfer diagram covering normal operation, maintenance and loss of connectivity.
