Why retrofitting fails
A product built with connectivity available accumulates small, reasonable dependencies on it: a licence check, a threat-intelligence feed, an update channel, a time source, a push notification service, a crash reporter, a documentation link that assumes a browser can reach the internet. Individually each is trivial. Together they mean the disconnected build is a different product with a different test surface, and it is always the one with fewer users and less testing.
Designing for the air gap first inverts that. Connectivity becomes an optional enhancement to a system that is complete without it, and the connected deployment is the one running the better-tested path.
The subsystems that decide it
- Licensing. Offline entitlement that cannot fail closed on a network with no route out. A gateway that stops brokering sessions because it could not validate a licence is an outage you created yourself.
- Updates. Signed, verifiable bundles that install from removable media, with a documented rollback. The integrity check has to work without a certificate revocation lookup.
- Time. Session records, expiries, and ledger entries all depend on time being right and consistent. On an isolated network that means local stratum sources, and it means detecting and reporting drift rather than assuming NTP works.
- Identity. Authentication and MFA that resolve against on-premises directories and hardware tokens, with no cached-token fallback that silently expires mid-incident.
- Notification. Approval requests and alerts that reach people through whatever the site actually has — internal mail, SMS gateway, on-premises messaging, a console indicator — instead of a cloud push service.
- Support and diagnostics. A local evidence bundle an operator can inspect and hand to their own security team, because nothing may leave the facility.
Three deployment postures, one product
In practice the same build runs in three postures, and the differences are configuration rather than code:
- Connected on-premises. Inside the agency boundary with controlled egress. Updates and time come from internal services that are themselves proxied.
- Sovereign or regional. Hosted in a defined jurisdiction with data residency and key custody constraints, often with no path to any vendor network.
- Fully air-gapped. No egress of any kind. Media-based updates, local time discipline, local notification, local evidence handling.
Keeping one code path across all three matters more than it sounds. It means the classified enclave is not running the neglected build, and that a fix verified in a connected deployment is the same fix that reaches the disconnected one.
What it costs
Honestly: velocity. Every feature has to be designed to work with no outbound call, which rules out a range of straightforward implementations and makes several subsystems harder than they need to be for the connected case. That is the trade — and on a network where the alternative is a permanent firewall exception argued at every assessment, it is not a close call.