--- title: "Physical vs Logical Air Gap: Which Actually | Firevault" description: "Physical air gap versus logical air gap explained: what each term actually means, why a virtual air gap is not physical isolation, and how to test a vendor's…" lang: en-GB json-ld: | [ { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "knowsAbout": [ "Offline Secure Storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Protect what matters with Offline Secure Storage and control what moves with Control by Firevault. Physically disconnected, always reachable by you.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/learn/physical-vs-logical-air-gap#webpage", "url": "https://fire-vault.com/learn/physical-vs-logical-air-gap", "name": "Physical vs Logical Air Gap: Which Actually", "description": "Physical air gap versus logical air gap explained: what each term actually means, why a virtual air gap is not physical isolation, and how to test a vendor's…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://fire-vault.com/images/og/og-base-learn.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/learn/physical-vs-logical-air-gap#breadcrumb" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/learn/physical-vs-logical-air-gap#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Home", "item": "https://fire-vault.com/" }, { "@type": "ListItem", "position": 3, "name": "Knowledge Vault", "item": "https://fire-vault.com/learn/knowledge" }, { "@type": "ListItem", "position": 4, "name": "Physical vs Logical Air Gap: What Is the Real Difference?", "item": "https://fire-vault.com/learn/physical-vs-logical-air-gap" } ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "Physical vs Logical Air Gap: Which Actually", "description": "Physical air gap versus logical air gap explained: what each term actually means, why a virtual air gap is not physical isolation, and how to test a vendor's…", "image": "https://fire-vault.com/images/og/og-base-learn.jpg", "author": { "@type": "Organization", "name": "Firevault" }, "publisher": { "@type": "Organization", "name": "Firevault", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png" } }, "datePublished": "2025-09-15", "dateModified": "2026-08-27", "mainEntityOfPage": "https://fire-vault.com/learn/physical-vs-logical-air-gap" }, { "@context": "https://schema.org", "@type": "TechArticle", "@id": "https://fire-vault.com/learn/physical-vs-logical-air-gap#article", "headline": "Physical vs Logical Air Gap: What Is the Real Difference?", "description": "Physical air gap versus logical air gap explained: what each term actually means, why a virtual air gap is not physical isolation, and how to test a vendor's claim.", "about": [ { "@type": "Thing", "name": "Air gap" }, { "@type": "Thing", "name": "Logical air gap" }, { "@type": "Thing", "name": "Physical air gap" }, { "@type": "Thing", "name": "Network isolation" }, { "@type": "Thing", "name": "Immutable storage" }, { "@type": "Thing", "name": "ISO/IEC 27040" } ], "keywords": "physical vs logical air gap, physical air gap, logical air gap, virtual air gap, what is a logical air gap, air gap definition, network isolation backup, immutable storage air gap, ISO/IEC 27040 air gap, layer 1 air gap", "articleSection": "Data protection architecture", "inLanguage": "en-GB", "isAccessibleForFree": true, "wordCount": 2400, "image": [ "https://fire-vault.com/assets/explainer-physical-vs-logical-air-gap-C8M05C75.jpg" ], "author": { "@type": "Person", "name": "Mark Fermor", "url": "https://fire-vault.com/about", "jobTitle": "Director and Co-Founder, Firevault" }, "publisher": { "@type": "Organization", "name": "Firevault", "url": "https://fire-vault.com" }, "datePublished": "2025-09-15", "dateModified": "2026-08-27", "url": "https://fire-vault.com/learn/physical-vs-logical-air-gap", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://fire-vault.com/learn/physical-vs-logical-air-gap" }, "citation": [ { "@type": "CreativeWork", "name": "ISO/IEC 27040:2024, Information security, cybersecurity and privacy protection, Storage security", "url": "https://www.iso.org/standard/79280.html" }, { "@type": "CreativeWork", "name": "NIST SP 800-207, Zero Trust Architecture", "url": "https://csrc.nist.gov/pubs/sp/800/207/final" }, { "@type": "CreativeWork", "name": "NIST SP 1800-11, Data Integrity: Recovering from Ransomware and Other Destructive Events", "url": "https://www.nccoe.nist.gov/data-integrity-recovering-ransomware-and-other-destructive-events" }, { "@type": "CreativeWork", "name": "NCSC UK, Offline Backups Guidance", "url": "https://www.ncsc.gov.uk/blog-post/protecting-backups-from-ransomware" }, { "@type": "CreativeWork", "name": "CISA, StopRansomware Guide", "url": "https://www.cisa.gov/stopransomware/ransomware-guide" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "What is the difference between a physical air gap and a logical air gap?", "acceptedAnswer": { "@type": "Answer", "text": "A physical air gap means there is no network connection to the data at all: no cable, no active interface, no IP address to reach. A logical air gap means the data remains on a connected network but access is restricted by software controls such as firewall rules, identity checks or immutability policy." } }, { "@type": "Question", "name": "Is a logical air gap a real air gap?", "acceptedAnswer": { "@type": "Answer", "text": "Not in the strict sense of the term. The phrase air gap originally described physical disconnection. A logical air gap is better described as strong network isolation, because the path still exists and is enforced by software that can be reconfigured, bypassed or exploited." } }, { "@type": "Question", "name": "What is a virtual air gap?", "acceptedAnswer": { "@type": "Answer", "text": "Virtual air gap is a marketing term used by some backup vendors to describe a combination of immutability, access restriction and replication delay on storage that remains network connected. It is a logical control, not a physical one, regardless of the name used to describe it." } }, { "@type": "Question", "name": "Can ransomware defeat a logical air gap?", "acceptedAnswer": { "@type": "Answer", "text": "Yes, if the attacker obtains sufficient privilege. Documented ransomware incidents have involved attackers reaching backup consoles, disabling immutability settings, deleting snapshots or altering retention policy before encrypting production systems. A logical air gap is only as strong as the identity and configuration controls protecting it." } }, { "@type": "Question", "name": "Does ISO/IEC 27040 define air gapping?", "acceptedAnswer": { "@type": "Answer", "text": "ISO/IEC 27040 addresses storage security controls including isolation and air gapping as part of a broader set of protections, and treats them as distinct from immutability and access control. It does not treat a logical isolation control as equivalent to physical disconnection." } }, { "@type": "Question", "name": "Why do vendors call logical isolation an air gap?", "acceptedAnswer": { "@type": "Answer", "text": "The term air gap carries strong assurance associations for buyers concerned about ransomware. Applying it to a logical, network connected control makes the product sound stronger than its technical mechanism actually is. Buyers should ask for the underlying mechanism rather than accepting the label." } }, { "@type": "Question", "name": "How do I test whether a vendor's air gap claim is physical?", "acceptedAnswer": { "@type": "Answer", "text": "Ask whether the storage has an active network interface at rest, whether it has an IP address that can be scanned or pinged while disconnected, and whether any software process on the connected estate can reconnect it without a separate, independently controlled action. If the answer to any of these is yes, the control is logical." } }, { "@type": "Question", "name": "Is immutable storage the same as an air gap?", "acceptedAnswer": { "@type": "Answer", "text": "No. Immutable storage prevents deletion or modification for a defined retention period while the storage remains reachable over the network. An air gap removes the network path itself. The two are complementary controls, not substitutes for each other." } }, { "@type": "Question", "name": "Where does a physical air gap matter most?", "acceptedAnswer": { "@type": "Answer", "text": "It matters most for the last, trusted recovery copy an organisation needs when the rest of its environment, including cloud and on-premises backup platforms, has been compromised by an attacker with administrative access. In that scenario, controls enforced by software on the connected estate cannot be trusted." } }, { "@type": "Question", "name": "Does a physical air gap replace immutable backup?", "acceptedAnswer": { "@type": "Answer", "text": "No. Most organisations should use both. Immutable, network connected backup supports fast day-to-day recovery from accidental deletion or small-scale incidents. A physical air gap protects the gold copy that must survive a scenario where the connected estate itself, including its identity systems, has been compromised." } }, { "@type": "Question", "name": "What questions should I ask a vendor claiming an air gap?", "acceptedAnswer": { "@type": "Answer", "text": "Ask what the mechanism actually is, whether the storage has a live network interface when supposedly gapped, who or what controls reconnection, whether reconnection can be triggered remotely by software, and how the claim is independently audited. A vendor unable to answer these plainly is likely describing a logical control." } }, { "@type": "Question", "name": "Can a VLAN or firewall rule be described as an air gap?", "acceptedAnswer": { "@type": "Answer", "text": "No. A VLAN and a firewall rule are both logical segmentation controls that operate on a network the data remains connected to. They can be reconfigured by a sufficiently privileged administrator or attacker. A physical air gap does not depend on any configuration remaining correct." } } ] } ] --- Recent Breaches Breaches [2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches)[2026 PowerSchool 62.4M records ](/learn/breaches)[2026 DISA Global Solutions 3.3M records ](/learn/breaches)[2026 Globe Life 850K records ](/learn/breaches)[2026 Lidl GB Customer contact data ](/learn/breaches)[2026 Asahi Group Production systems disrupted ](/learn/breaches)[2026 Kido International 8K records ](/learn/breaches)[2026 Collins Aerospace (RTX) Check-in and boarding disruptio... ](/learn/breaches)[2026 Jaguar Land Rover Production and IT systems disru... ](/learn/breaches)[2026 Peter Green Chilled Order and logistics data ](/learn/breaches)[2026 Adidas UK Customer contact details ](/learn/breaches) [View All →](/learn/breaches) [![Firevault - offline secure storage, physically disconnected from the internet](/assets/logo-color-DBVl0KCg.png)](/) Products Solutions [Why OSS](/why-oss) More [Help](/help)[Get started](/get-started) [Knowledge Vault](/learn/knowledge) Explainer Data protection architecture # Physical vs Logical Air Gap: What Is the Real Difference? Vendors describe network isolation, immutability and even a Recycle Bin as an air gap. This explainer sets out what a physical air gap actually is, what a logical air gap can and cannot do, and how to test a vendor's claim before you rely on it. ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) Mark Fermor Director & Co-Founder, Firevault 15 September 2025 16 min read Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Flearn%2Fphysical-vs-logical-air-gap)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Flearn%2Fphysical-vs-logical-air-gap&text=Physical%20vs%20Logical%20Air%20Gap%3A%20What%20Is%20the%20Real%20Difference%3F%0A%0AVendors%20describe%20network%20isolation%2C%20immutability%20and%20even%20a%20Recycle%20Bin%20as%20an%20air%20gap.%20This%20explainer%20sets%20out%20what%20a%20physical%20air%20gap%20actually%20is%2C%20what%20a%20logical%20air%20gap%20can%20and%20cannot%20do%2C%20and%20how%20to%20test%20a%20vendor's%20claim%20before%20you%20rely%20on%20it.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Flearn%2Fphysical-vs-logical-air-gap)[](mailto:?subject=Physical%20vs%20Logical%20Air%20Gap%3A%20What%20Is%20the%20Real%20Difference%3F&body=Vendors%20describe%20network%20isolation%2C%20immutability%20and%20even%20a%20Recycle%20Bin%20as%20an%20air%20gap.%20This%20explainer%20sets%20out%20what%20a%20physical%20air%20gap%20actually%20is%2C%20what%20a%20logical%20air%20gap%20can%20and%20cannot%20do%2C%20and%20how%20to%20test%20a%20vendor's%20claim%20before%20you%20rely%20on%20it.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Flearn%2Fphysical-vs-logical-air-gap) ![A physically disconnected storage enclosure next to a networked server rack, illustrating the difference between physical and logical isolation](/assets/explainer-physical-vs-logical-air-gap-C8M05C75.jpg) A physical air gap removes the network path entirely. A logical air gap restricts what that path can do while it remains connected. Written by Mark Fermor, Co-Founder, Firevault Technical review Firevault architecture team First published 15 September 2025 Last reviewed 27 August 2026 Review cycle At least annually, or following material changes to NIST, NCSC or ISO guidance. How we built this explainer: This explainer draws on ISO/IEC 27040 storage security guidance, NIST publications on network segmentation and zero trust architecture, NCSC UK guidance on secure connectivity, and publicly documented ransomware incidents involving backup platforms. It does not cite vendor marketing claims as evidence. Where a number could not be traced to a named, checkable source, it has been left out. **On this page**[What is an air gap?](#what-is-air-gap)[Physical air gap, defined](#physical-defined)[Logical air gap, defined](#logical-defined)[What is a 'virtual air gap'?](#virtual-air-gap)[Physical versus logical, side by side](#comparison)[Why the two get conflated](#why-conflated)[How ISO/IEC 27040 and NIST frame isolation](#standards)[Where the difference actually matters](#where-it-matters)[How a logical air gap fails](#failure-modes)[How to test a vendor's air gap claim](#testing-claim)[Decision criteria for choosing between them](#decision-criteria)[How Firevault applies these principles](#firevault)[The key takeaway](#takeaway) On this page 1. [What is an air gap?](#what-is-air-gap) 2. [Physical air gap, defined](#physical-defined) 3. [Logical air gap, defined](#logical-defined) 4. [What is a 'virtual air gap'?](#virtual-air-gap) 5. [Physical versus logical, side by side](#comparison) 6. [Why the two get conflated](#why-conflated) 7. [How ISO/IEC 27040 and NIST frame isolation](#standards) 8. [Where the difference actually matters](#where-it-matters) 9. [How a logical air gap fails](#failure-modes) 10. [How to test a vendor's air gap claim](#testing-claim) 11. [Decision criteria for choosing between them](#decision-criteria) 12. [How Firevault applies these principles](#firevault) 13. [The key takeaway](#takeaway) The phrase air gap has a precise origin: a physical break in a data path, with no cable, no wireless interface and no addressable connection across it. Over the past decade the phrase has been stretched to cover a wide range of software controls that make data harder to reach or harder to change while it stays on a connected network. Some of that stretching is reasonable shorthand. Some of it is a marketing choice that obscures a meaningful technical difference. This explainer sets out what physical and logical air gaps actually are, why the distinction is not pedantic, and how to evaluate a vendor's claim without needing to be a network engineer to do it. ## What is an air gap? An air gap is the absence of a network connection between a system and everything else. Historically the term described military and industrial systems kept entirely off any network, with data moved between them physically, by a person carrying media, rather than electronically. The defining property is that there is no path for a remote instruction, exploit or command to travel across, because no such path exists. That single property, the absence of a path, is what every other definition on this page should be judged against. If a path exists, even a tightly controlled one, the system is not air gapped in the original sense of the term. It may still be well protected, but it is protected by a different mechanism. ## Physical air gap, defined A physical air gap means the storage or system has no active network interface while it is meant to be isolated. There is no bound IP address, no listening service, and no cable or radio link carrying traffic to or from it. Reconnection, when it happens, is a distinct, separately controlled event rather than something a remote process on the connected network can trigger by itself. No network interface No NIC is active or bound while the system is in its isolated state. No address to reach There is no IP address or hostname a remote attacker could scan or target. No listening service No application or API is running that could accept a remote instruction. Independent reconnection Bringing the system back online is a separate, auditable action, not a software toggle. ## Logical air gap, defined A logical air gap describes a system that remains network connected but restricts what can reach it, or what can be done to it, through software controls. Common mechanisms include network segmentation such as VLANs and firewall rules, identity separation such as distinct credentials or a separate authentication domain for backup infrastructure, and immutability policies such as object lock, WORM flags or retention locks that prevent deletion or modification for a set period. Each of these is a legitimate and useful control. None of them removes the network path. All of them depend on the software enforcing them, and the identity system authorising access to them, remaining uncompromised. ### Common logical isolation mechanisms - Network segmentation: VLANs, subnets and firewall rules that limit what can reach a system - Separate credentials: distinct accounts or authentication domains for backup and recovery infrastructure - Immutability and retention locks: object lock, WORM flags and configuration that blocks deletion for a period - Delayed or one-way replication: copies that lag production, making some encryption events easier to recover from - Air gap scheduling: connections that open and close on a timer, while the interface itself remains capable of connecting ## What is a 'virtual air gap'? Virtual air gap is a term used by some backup and storage vendors to describe a bundle of the mechanisms above, usually immutability plus access restriction plus some form of scheduled or throttled replication. It is a logical air gap by another name. The term is not wrong to use as a product description, but it should not be read as a claim of physical disconnection. How to read the term: If a product description uses the word virtual, software defined, or logical anywhere near the word air gap, treat the claim as a logical isolation control and evaluate it on that basis. If the description cannot answer whether the storage has an active network interface at rest, assume that it does. ## Physical versus logical, side by side Physical air gap No network path exists - No active interface while isolated - Nothing to scan, exploit or authenticate to - Reconnection is a separate, audited event - Unaffected by compromised credentials elsewhere Logical air gap A network path exists, restricted by software - Active interface, reachable in principle - Enforced by identity and configuration - Reconnection is a software state, not a physical act - Fails if the enforcing account or software is compromised Physical and logical air gaps defend against different classes of attacker and fail in different ways. ## Why the two get conflated The conflation happens for three reasons that are worth naming plainly, because none of them are technical arguments. 1. The word sells. Air gap carries strong assurance associations after years of ransomware coverage. Applying it to a logical control makes the product sound stronger than the mechanism supports. 2. The controls genuinely help. Immutability and network segmentation are real, useful controls that reduce risk. It is easy to slide from a control being useful to a control being described as absolute. 3. Buyers rarely ask the follow-up question. Few procurement conversations ask whether the storage has an active interface at rest. Without that question, the label goes unchallenged. ## How ISO/IEC 27040 and NIST frame isolation [ISO/IEC 27040](https://www.iso.org/standard/79280.html), the international standard for storage security, treats isolation, air gapping and immutability as related but distinct controls within a broader storage security programme. It does not use the term air gap loosely, and it does not treat a logical isolation control as functionally equivalent to physical separation. NIST's zero trust architecture guidance, [SP 800-207](https://csrc.nist.gov/pubs/sp/800/207/final), is built on the premise that no network location or credential should be trusted by default, precisely because logical controls depend on identity and policy enforcement that can be compromised. NIST's practice guide on ransomware recovery, [SP 1800-11](https://www.nccoe.nist.gov/data-integrity-recovering-ransomware-and-other-destructive-events), discusses the need for a recovery source that has not been exposed to the same compromise as the production environment, which is the property a physical air gap is specifically designed to provide. [NCSC UK's guidance on protecting backups](https://www.ncsc.gov.uk/blog-post/protecting-backups-from-ransomware) distinguishes backup copies that are genuinely offline from copies that remain reachable, and recommends at least one copy that an attacker with network access cannot reach or alter. ## Where the difference actually matters The distinction is not academic. It matters most in the specific scenario that ransomware operators now routinely engineer for: an attacker who has obtained privileged, often domain administrator level, access to the connected estate before triggering encryption. In that scenario every logical control that depends on identity or software configuration is within the attacker's reach. Path connected Network Data - Immutability flags can be cleared by a privileged account - Retention windows can be shortened or disabled - Backup catalogues can be deleted or poisoned - Replication targets can be redirected or corrupted Path disconnected Network Data - No interface for the attacker's tools to reach - No credential exists that can traverse a path that is not there - Reconnection requires a separate, out of band action - Compromise of the connected estate has no route to the offline copy Once an attacker holds privileged credentials on the connected estate, every logical control on that estate is reachable. A physical air gap is not. Where the risk is accidental deletion, a misconfiguration, or a limited ransomware event that does not reach backup infrastructure, a logical air gap combined with immutability is often sufficient and considerably faster to recover from. Where the risk is a full-estate compromise with administrative access, only a genuinely physical air gap removes the attacker's path entirely. ## How a logical air gap fails Publicly documented ransomware incidents involving backup platforms show a consistent pattern: attackers target the backup console specifically, because defeating it removes the victim's recovery option and increases pressure to pay. The following are the recurring ways a logical control has failed in practice. Failure mode What happens Why physical isolation is unaffected Console or credential compromise An attacker with administrative access to the backup platform disables immutability or deletes retention policy. There is no console reachable on a system with no active network interface. Retention or clock manipulation Retention locks tied to system time or policy configuration are shortened, bypassed or expired early. A physical air gap does not depend on a policy setting remaining correct. Segmentation misconfiguration A VLAN, firewall rule or trunk port is misconfigured, exposing a supposedly isolated segment. There is no segment to misconfigure when the interface itself is inactive. Firmware or platform vulnerability A vulnerability in the storage controller, hypervisor or network stack gives an attacker a path around access controls. A vulnerability cannot be reached across a path that does not exist while the system is disconnected. Recurring failure modes for logical isolation and immutability controls. ## How to test a vendor's air gap claim The following questions separate a physical air gap claim from a logical one, and can be asked of any vendor without needing deep technical expertise to interpret the answers. Question 1 Does the storage have an active network interface while it is described as air gapped? If yes, the control is logical, whatever else it is called. Question 2 Can the storage be reached, scanned or pinged from the network during that state? A physical air gap has no address for this to succeed against. Question 3 Can any software process on the connected estate reconnect it without a separate action? If a remote command can bring it back online, the reconnection is a software state, not a physical event. Question 4 Who or what independently audits the isolation and reconnection events? A credible claim, physical or logical, should have a tamper evident record separate from the system it protects. A short line of questioning that reveals whether an air gap claim is physical or logical. ## Decision criteria for choosing between them Neither model is universally correct. The decision should be driven by which failure scenario the copy is meant to survive. - Choose a logical control (immutability, segmentation, separate credentials) for fast, day-to-day recovery from accidental deletion or limited incidents - Choose a physical air gap for the last, trusted copy that must survive a full-estate compromise, including compromised identity systems - Use both together where the 3-2-1-1-0 backup rule applies, so the offline copy is genuinely offline rather than merely restricted - Never accept the term air gap alone in a vendor conversation without asking whether the interface is active at rest - Document which category each backup copy falls into, so recovery planning does not assume protection that is not actually present ## How Firevault applies these principles Firevault's Offline Secure Storage® is built as a physical air gap rather than a logical one. Storage hardware has no active network interface while offline, so there is no address to scan and no listening service to authenticate to. Connection windows are scheduled and identity verified, controlled from a separate management plane rather than from within the customer's own connected estate, so a compromise of that estate has no path to the offline copy. Firevault Control extends the same physical governance to selected network paths where an organisation wants a genuinely offline decision point rather than a software policy alone. Firebreak® applies the same principle to isolate segments of an estate during an active incident. None of these products replace immutable, network connected backup, which remains the right tool for fast operational recovery. They exist to provide the gold copy that a full logical compromise cannot reach. Key takeaway ## An air gap is a claim about physics, not a claim about policy A physical air gap removes the network path itself, so the data cannot be reached regardless of who holds administrative credentials. A logical air gap, however well engineered, remains a network connected system defended by identity and configuration, both of which can fail. Neither is wrong to use. What matters is knowing which one you have, matching it to the risk it is meant to cover, and never accepting the label alone as proof of the mechanism. Questions ## Frequently Asked Questions Straight answers on how Offline Secure Storage® behaves in practice. ### What is the difference between a physical air gap and a logical air gap? ### Is a logical air gap a real air gap? ### What is a virtual air gap? ### Can ransomware defeat a logical air gap? ### Does ISO/IEC 27040 define air gapping? ### Why do vendors call logical isolation an air gap? ### How do I test whether a vendor's air gap claim is physical? ### Is immutable storage the same as an air gap? ### Where does a physical air gap matter most? ### Does a physical air gap replace immutable backup? ### What questions should I ask a vendor claiming an air gap? ### Can a VLAN or firewall rule be described as an air gap? ## Sources and further reading - [ISO/IEC 27040:2024, Information security, cybersecurity and privacy protection, Storage security](https://www.iso.org/standard/79280.html) International standard covering storage security controls, including air gapping, isolation and immutability as distinct concepts. - [NIST SP 800-207, Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final) Explains why identity and policy enforcement, the basis of every logical control, cannot be assumed trustworthy by default. - [NIST SP 1800-11, Data Integrity: Recovering from Ransomware and Other Destructive Events](https://www.nccoe.nist.gov/data-integrity-recovering-ransomware-and-other-destructive-events) Practice guide on rebuilding trusted, isolated recovery capability after an integrity attack. - [NCSC UK, Offline Backups Guidance](https://www.ncsc.gov.uk/blog-post/protecting-backups-from-ransomware) UK national guidance distinguishing genuinely offline backup copies from backups that remain network reachable. - [CISA, StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide) Federal guidance recommending offline, physically separate backup copies as part of ransomware resilience. Related Firevault guides [Air gap vs immutable backup](/learn/air-gap-vs-immutable-backup) [Physical air gap storage for ransomware protection](/learn/physical-air-gap-ransomware-protection) [What is Offline Secure Storage](/how-it-works/offline-secure-storage) About the author ![Mark Fermor](/assets/mark-fermor-aWtKNSv7.jpg) ### Mark Fermor [](https://www.linkedin.com/in/mfermor) Director & Co-Founder Co-founder of Firevault, focused on offline secure storage and protecting individuals and businesses from fraud, fines, loss and damage. Speaker, owner and advisor. Share this explainer Share [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Ffire-vault.com%2Flearn%2Fphysical-vs-logical-air-gap)[](https://twitter.com/intent/tweet?url=https%3A%2F%2Ffire-vault.com%2Flearn%2Fphysical-vs-logical-air-gap&text=Physical%20vs%20Logical%20Air%20Gap%3A%20What%20Is%20the%20Real%20Difference%3F%0A%0AVendors%20describe%20network%20isolation%2C%20immutability%20and%20even%20a%20Recycle%20Bin%20as%20an%20air%20gap.%20This%20explainer%20sets%20out%20what%20a%20physical%20air%20gap%20actually%20is%2C%20what%20a%20logical%20air%20gap%20can%20and%20cannot%20do%2C%20and%20how%20to%20test%20a%20vendor's%20claim%20before%20you%20rely%20on%20it.)[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Ffire-vault.com%2Flearn%2Fphysical-vs-logical-air-gap)[](mailto:?subject=Physical%20vs%20Logical%20Air%20Gap%3A%20What%20Is%20the%20Real%20Difference%3F&body=Vendors%20describe%20network%20isolation%2C%20immutability%20and%20even%20a%20Recycle%20Bin%20as%20an%20air%20gap.%20This%20explainer%20sets%20out%20what%20a%20physical%20air%20gap%20actually%20is%2C%20what%20a%20logical%20air%20gap%20can%20and%20cannot%20do%2C%20and%20how%20to%20test%20a%20vendor's%20claim%20before%20you%20rely%20on%20it.%0A%0Ahttps%3A%2F%2Ffire-vault.com%2Flearn%2Fphysical-vs-logical-air-gap) The Firevault view**Offline Secure Storage® keeps a clean copy beyond the reach of an attacker.**[Why #OSS →](/why-oss) Control systems and access**Cut the physical paths attackers and third parties depend on.**[Explore Control →](/solutions/control) Get started**Get started, or talk to a member of the team.**[Get started →](/get-started)