“Air-gapped backup” is used to describe very different things. Understanding the types helps you choose the right protection for your most critical data.
Physical air gap
Media such as tape stored offline with no network connection. Very strong isolation, but slower recovery and more manual handling.
Logical air gap
Data remains on connected systems but is protected by separate credentials, network segmentation and immutability. Faster to recover, but relies on configuration being correct.
Operational air gap
A vault that is connected only during controlled replication windows and otherwise closed. It combines faster recovery with reduced exposure.
Choosing the right mix
- Use the strongest isolation for the data you cannot lose.
- Balance isolation against recovery-time objectives.
- Test recovery from every tier.
Questions to test your air gap
- Could an attacker with domain administrator rights reach this copy?
- Could they delete it, shorten its retention or encrypt it?
- How long would recovery take from this copy for your largest critical system?
- When did you last recover from it?
If the answer to the first two questions is “yes” or “not sure”, the copy is not truly isolated — whatever the product data sheet says.
Key takeaways
- Air gap is a spectrum, not a single feature.
- Operational air gaps balance isolation and speed.
- Match isolation strength to data criticality.
Want an independent view of your recoverability?
Book a Recovery Readiness Call and we’ll help you turn assumptions into evidence.
