What Is Hardware Data Vault Isolation? (Air Gap Specs)
Hardware data vault isolation means keeping a system that stores sensitive data disconnected from untrusted networks and controlling every route by which data can enter or leave. An air gap is a cybersecurity boundary, not a room gap or ventilation space. There is no universal air-gap distance, clearance, temperature, or airflow specification.
Durability matters because isolation is not a one-time wiring choice. A forgotten network cable, replacement device with wireless radios, or untracked USB drive can weaken the boundary later. I approach the job as a system: define what is trusted, control the connections, keep the equipment within its operating limits, and inspect it again over time.
What hardware data vault isolation means
Hardware data vault isolation is a set of physical and operating controls that separates a data system from untrusted networks. In a strict air-gapped state, no active data connection reaches an untrusted device. Approved transfers still need controls, because removable media and shared peripherals can carry data and malware across the boundary.
“Air gap” describes a security boundary, not a required physical distance between machines. Moving a computer to another room, locking it in a cabinet, or hiding its Ethernet port does not prove isolation. The key question is whether any data path connects the vault to an untrusted system.
NIST Special Publication 800-53 Revision 5, control SC-7, covers boundary protection. It provides a framework for managing system boundaries, but it does not set a universal air-gap specification. The organization or owner must define the controls that fit the system and its threat model.
That distinction matters: power, cooling, and physical access must support reliable operation, while data connections must remain controlled. Treat them as related design concerns, not as substitutes for one another.
Plan the vault boundary and threat model
The boundary is the line around the devices and processes you intend to protect. A useful plan lists each device, interface, data flow, and approved exception. I start with that inventory before choosing a location or rack, because an unnoticed transfer path can defeat a carefully built enclosure.
Write down what the vault contains and which systems or people may interact with it. Include computers, network cards, wireless radios, removable drives, printers, KVM switches, and maintenance tools. A KVM switch lets one keyboard, video display, and mouse serve several computers; a shared switch can create an unwanted link if it also passes data between systems.
Then draw the boundary and mark each connection as prohibited or approved. Include data paths through:
- Ethernet and fiber
- USB devices, docks, and adapters
- Shared KVMs and peripheral switches
- Wi-Fi, Bluetooth, cellular, and other radios
- Removable storage and maintenance media
Record who may approve an exception, how the exception is logged, and how the system returns to its isolated state. If the threat model requires physical radio removal or blocking, include that in the plan and verify it in the hardware inventory. Software settings alone do not prove that a radio is physically absent.
The next step is to define the transfer process before anyone needs to move a file. This prevents improvised workarounds, such as plugging a vault computer into a nearby office network “just for a minute.”
Check hardware access, clearances, and environmental limits
Physical isolation must not compromise the equipment’s safe operation. Place the hardware where authorized staff can inspect ports and cabling, while preserving the inlet, outlet, service, and temperature conditions required by its manufacturer. There is no single rack clearance, temperature, or airflow number that applies to every vault.
Start with the equipment manuals and record each unit’s stated operating limits. Check the direction of airflow, the location of air inlets and exhausts, and the front and rear space needed for service. Do not block vents or substitute a generic airflow figure for the manufacturer’s instructions.
| Design item | What to check | What not to assume |
|---|---|---|
| Rack clearance | Manufacturer’s front, rear, and service-space guidance | One universal clearance value |
| Airflow | Inlet and exhaust direction; room and rack conditions | One universal CFM requirement |
| Temperature | Published operating range and measured site conditions | A generic target for all hardware |
| Power | Equipment load, circuit capacity, protection, and UPS needs | A fixed UPS runtime for every vault |
| Network ports | Inventory, configuration, and physical inspection | An unused or disabled port proves isolation |
| Wireless radios | Hardware inventory and configuration; removal or blocking if required | Software disablement proves physical absence |
Size the power supply, circuit protection, and uninterruptible power supply (UPS) to the equipment load and manufacturer requirements. A UPS can provide backup power, but it does not create an air gap. Likewise, a lockable enclosure can limit physical access, but it cannot replace data-path controls.
Apply the locally adopted electrical and building codes. NEC Article 645 is conditional; it is not a blanket rule for every server or data-vault installation. Confirm whether it applies to the specific space and equipment with the authority having jurisdiction or a qualified electrical professional.
Install and configure the isolation controls
Installation turns the boundary plan into a working setup. Connect only the power and peripherals the design allows, then disable, remove, or control unapproved interfaces. Label ports and approved media so that routine service does not quietly add a new path.
Use this sequence:
- Inventory before installation. Record device models, network interfaces, radios, ports, peripherals, and intended data flows. Note what is installed and what must be removed or disabled.
- Place and connect the equipment. Follow the manufacturer’s clearances and airflow direction. Connect only approved power and peripherals. Do not connect Ethernet, fiber, USB data bridges, or shared KVM links to untrusted systems during isolated operation.
- Control wireless interfaces. Inspect the hardware inventory and configuration for Wi-Fi, Bluetooth, cellular, and other radios. Disable them; physically remove or block them where the threat model requires it. Document the method.
- Mark the boundary. Label prohibited ports and approved transfer media. Keep an updated connection diagram with the equipment records.
- Restrict changes. Set a process for maintenance and replacement parts. Recheck interfaces and connections after hardware changes, repairs, or configuration updates.
“Disabled” and “removed” are not interchangeable. A setting can show that a radio is off in software, while the radio hardware remains present. Decide which evidence is required for your risk level, then record it in a way another person can check.
A physical enclosure may help control access, but do not use one to hide unsafe wiring or obstruct cooling. Security and serviceability must work together.
Verify isolation and control data transfers
Verification is a repeatable check that the planned boundary still matches the installed system. Inspect cables, ports, radios, peripherals, and configuration; compare them with the inventory and connection diagram. Record the result, the date, and any exception so that later changes can be found.
A practical inspection can follow these checks:
- Trace every cable from the vault hardware to its endpoint.
- Confirm there is no active Ethernet, fiber, USB data bridge, shared KVM, or other link to an untrusted system.
- Compare installed interfaces and radios with the hardware inventory and approved configuration.
- Check that labels, port controls, and the boundary diagram match what is installed.
- Review authorized transfer records and resolve any unlogged use.
- Repeat the inspection after service, equipment changes, or suspected unauthorized access, and on a schedule suited to the risk.
Removable media is a critical edge case. A vault may have no live network link and still receive infected files through a USB drive. A media workflow is a controlled boundary crossing, not proof that no data path exists.
For each approved transfer, define authorization, malware scanning, custody, and return or disposal steps. Use inventoried media, record who handled it and when, and specify which scanning system and process are approved. A scan reduces risk but cannot guarantee that every threat will be detected. Treat exceptions as exceptions, not informal routine.
Worked installation scenarios
These scenarios show how to apply the controls; they are examples, not reports of named installations. The right configuration depends on the equipment, threat model, and applicable codes. I use scenarios to test whether the boundary plan remains clear when normal work begins.
Offline records workstation. A homeowner keeps a computer for sensitive records and does not need routine network access. The design inventory identifies its Ethernet port, Wi-Fi, Bluetooth, USB ports, and printer connection. The owner removes or disables unneeded interfaces according to the threat model, keeps approved transfer media under custody, and records every transfer. The computer remains within its stated cooling and power limits.
Small workshop data vault. A tradesperson stores project files on a dedicated system in a rack. A shared office KVM would make daily use easier, but it could create a path to the office computers. The design instead uses dedicated peripherals or a documented, controlled process. The installer checks airflow and service clearances against each device manual rather than applying one rack-wide guess.
Maintenance after hardware replacement. A replacement motherboard or network adapter can add interfaces that were not present in the original inventory. Before returning the system to isolated operation, the responsible person checks the new hardware, updates the inventory and diagram, reviews radio settings, and inspects the cabling. The documented recheck helps catch configuration drift.
Across all three cases, useful metrics are counts and records rather than invented universal thresholds: number of inventoried interfaces, number of approved transfer routes, inspection date, and unresolved exceptions. Those measures help show whether the controls are in place without implying that a particular number guarantees security.
Conclusion
Hardware data vault isolation is maintained by controlling every data path, not by distance, a locked room, or an unused network port. Define the boundary, follow equipment and code requirements, control transfer media, and inspect the setup after changes. Documented checks make the isolation easier to maintain and verify.
FAQ
Is an air gap a physical space between two computers?
No. It is a cybersecurity boundary that prevents active data links to untrusted systems. Physical distance alone does not prove isolation.
Is there a standard air-gap distance?
No. NIST SP 800-53 Revision 5, SC-7, addresses boundary protection but does not prescribe a universal distance or air-gap specification.
Does a locked room prove a system is air-gapped?
No. A locked room can limit physical access, but the system may still have network cables, wireless radios, or other data paths.
Does disabling Wi-Fi in software prove physical isolation?
No. Software settings show configuration, not necessarily hardware absence. Inventory the radios and use physical removal or blocking when the threat model requires it.
Can I use USB drives with an air-gapped vault?
Only through an approved transfer process. Inventoried media, authorization, malware scanning, and custody records help control the risk. The transfer remains a boundary crossing.
Does a disconnected Ethernet cable make the system isolated?
Not by itself. Check every other interface and peripheral, including fiber, USB bridges, shared KVMs, and wireless radios. Verify the full boundary, not one cable.
What rack clearance or airflow does a data vault need?
Use the equipment manufacturer’s specifications. There is no universal clearance or CFM value that fits all hardware, and vents must remain unobstructed.
Does NEC Article 645 apply to every server or vault?
No. Its use is conditional, not automatic for every installation. Check locally adopted codes and confirm applicability with the authority having jurisdiction or a qualified professional.
How often should I verify isolation?
Set a schedule based on risk and operations, and recheck after maintenance, equipment replacement, or suspected unauthorized access. Record inspections and resolve any mismatch with the approved inventory.
(This article was written by one of our staff writers, Garrett Vance. Visit our Meet the Team page.)
