What Air-Gapped Engineering Really Means for Defence PCB Design Teams

Key takeaways

• An air gap is a physical and logical separation from external networks. A local install or private server is not air-gapped if it can still call out, sync, update, or receive remote support.
• True isolation affects the whole engineering system: workstations, license services, libraries, backups, printers, test tools, removable media, support, and software updates.
• Air gaps reduce some remote attack paths, but they create new operating risks. Teams must manage transfer points, patch delay, duplicate data, and recovery by design.
• ITAR and CMMC do not make “air-gapped” a universal rule. The deployment choice should follow the data, contract clauses, system boundary, and written security requirements.

A defense PCB team can install EDA software on a desktop, turn off Wi-Fi, and still not have an air-gapped environment. The workstation may reach a license server. A component tool may refresh supplier data. An update agent may call home. Files may move through email, shared drives, USB devices, printers, or test systems.

That is why the word “air-gapped” needs care. It describes an architecture, not a product label or a temporary offline mode. The network boundary, data flows, support path, and operating process must all enforce the separation.

Air-Gapped Means Isolated by Architecture

An air-gapped engineering environment has no direct network path to the public internet, a corporate network, a vendor service, or another lower-trust system. The separation should be physical where the requirement calls for physical isolation, and it must be backed by controls that stop hidden or accidental connections.

The exact boundary can vary. One program may isolate a single lab. Another may isolate a full facility, including design workstations, servers, storage, build machines, test stations, and backup systems. What matters is that the approved boundary is clear and every data path across it is known and controlled.

The Four Tests of a Real Air Gap

A practical test starts with four questions. If the answer to any one is unclear, the environment may be isolated in parts but not truly air-gapped.

• Network isolation: Can any device inside the boundary route to the internet, a corporate service, a cloud tenant, remote management, or a vendor endpoint?
• No external callbacks: Can the EDA tool, operating system, license service, telemetry agent, component service, plug-in, or security tool send or request data outside the boundary?
• Controlled transfer: Does every file that crosses the boundary pass through an approved, logged, scanned, and authorized process?
• Dedicated infrastructure: Are identity, storage, backup, printing, build, test, licensing, and administration services available inside the isolated boundary?

One common problem inside an isolated environment is software licensing. Altium supports organizations that need Altium Designer installations to remain offline through its Private License Service. Instead of relying on the cloud-based Altium Licensing Service, licenses can be served locally over the organization’s network. Altium also supports roaming licenses, which allow an Altium Designer workstation to use an assigned license while isolated from the network. 

That solves the licensing part of the problem, not the whole air gap. A local license service does not control design-data transfers, removable media, operating-system updates, backups, test equipment, printers, or other routes across the security boundary. Those controls still belong to the organization’s wider security architecture.

What the Engineering Stack Must Contain

A useful air-gapped EDA environment is more than a group of disconnected PCs. PCB design depends on shared libraries, review records, manufacturing outputs, scripts, simulation models, and release data. If those services are missing, engineers will create side channels to keep work moving.

Air Gaps Move Risk to the Transfer Point

Isolation removes many direct remote paths, but it does not remove cyber risk. It concentrates risk at the places where people, media, and equipment cross the boundary. A single unmanaged USB drive can defeat a strong network design. A laptop used in two zones can become a bridge. A service engineer can bring in untested software. A printer or test instrument can hold copies of sensitive files.

This is why removable media needs more than an antivirus scan. The team needs an approved source, a named owner, malware checks, content review, write protection where suitable, a transfer record, and a clear rule for media reuse or destruction. The same care should apply to optical discs, portable drives, diagnostic laptops, and exported manufacturing packages.

A controlled engineering record can reduce another source of risk: uncertainty over which design revision is approved for use. Altium On-Prem Enterprise Server supports separate revisions rather than overwriting previously released data, lifecycle management and access to released manufacturing data. 

This helps maintain design and release control inside a locally managed environment. It does not remove the need for an approved transfer process when fabrication files, BOMs, models or other data cross an air-gapped boundary. The organization still needs to govern the transfer mechanism itself.

Altium controls engineering data; the security architecture controls how that data crosses the air gap.

ITAR and CMMC do not Equal Air-Gapped

ITAR controls the export and release of defense articles, services, and technical data. The eCFR text for 22 CFR Chapter I, Subchapter M defines the legal scope. It does not turn every controlled PCB project into an automatic air-gap mandate.

CMMC assesses how a defense contractor protects federal contract information and controlled unclassified information. The US Department of Defense CMMC program links assessment levels to contract requirements and the protection expected for the information in scope. Deployment is one part of the system design, not a substitute for access control, audit, incident response, media protection, or configuration management.

A contract, security classification guide, program policy, export plan, customer rule, or risk decision may still require isolation. The point is to trace that requirement to its source. “We handle ITAR data” and “this system must be physically isolated” are not the same statement.

A Practical Definition for Engineering Teams

Use this working definition: an air-gapped PCB engineering environment is a clearly bounded set of dedicated systems with no direct external network path, no required cloud callback, and a controlled process for every approved transfer across the boundary.

That definition is strict enough to guide architecture reviews. It also avoids a common mistake: calling a computer air-gapped because it happens to be offline today.

Questions to Answer Before Requesting Air-Gapped EDA

• What data, program, contract, or threat case drives the requirement?
• Where does the isolated boundary start and end?
• Which people may enter, administer, support, and approve transfers?
• How will licenses, updates, libraries, models, and security tools work without callbacks?
• How will fabrication and assembly data leave the boundary?
• How will supplier inputs, component data, and design changes enter?
• What evidence will prove that transfers, access, reviews, and releases were controlled?
• How long can the tool chain operate if updates or vendor support are delayed?
• How will backups be protected and restores tested?

Isolation Must Support the Work, not Just the Audit

A credible air gap must survive normal engineering pressure. Designers still need controlled components and models. Reviewers need current design data. Manufacturing needs the approved release. Licensing cannot unexpectedly demand an internet connection. If the isolated environment cannot support that everyday work, people will look for another way to get the job done.

Altium can address several parts of that operating model. Altium On-Prem Enterprise Server provides customer-managed engineering data and Workspace services, while the Private License Service supports Altium Designer installations that must remain offline. If a program permits regulated cloud collaboration rather than requiring an air gap, Altium 365 GovCloud provides a separate US-hosted option designed for supporting requirements including ITAR and EAR. 

The strongest design, therefore, begins with the program requirement and works back to the architecture. The question is not simply, “Can Altium Designer work offline?” It is, “Can the entire PCB engineering workflow operate within the approved security boundary without creating uncontrolled paths around it?”

Frequently Asked Questions

Is an offline desktop air-gapped?

Not by itself. It is air-gapped only when no direct external path exists and all data transfers are controlled within a defined system boundary.

Is an on-premises server air-gapped?

Not necessarily. On-premises describes location and ownership. The server may still connect to the internet, corporate services, remote support, or cloud systems.

Does ITAR require an air gap?

ITAR controls defense articles, services, and technical data. A specific contract or security decision may require isolation, but the label “ITAR” alone does not define the deployment architecture.

Can files enter or leave an air-gapped environment?

Yes, if the security plan allows it. The transfer must use an approved process with authorization, inspection, logging, and control of the media and recipient.

What is the biggest operational risk?

The transfer point is a major risk because it joins two trust zones. Patch delay, library drift, recovery gaps, and informal workarounds also need active control.