One word, five different requirements
Someone on your customer's side has said the system has to run air-gapped, and the sentence landed in your backlog as though it were a firewall rule. It is not. Before anything is worth estimating, find out which of at least five distinct requirements that word stands in for — the cheapest and the most expensive are not the same project in engineering, schedule or staffing, and whoever said it often does not know which they meant.
In rough order of cost. One: no inbound from the public internet, outbound still allowed through a proxy — close to free. Two: default-deny egress with an allowlist; you enumerate what you call and get it approved. Three: no route off the enclave, but a real network inside it with a package mirror and registry you may publish into — the most common serious case. Four: no route and no mirror; everything arrives as files through a controlled transfer procedure with a human, an approval and a cadence measured in days. Five: a classified network, cleared personnel, escorted access, no personal electronics. That last is not a harder version of the same project. It is a different business.
A second question gets conflated with the first. An impact level is an accreditation category, not a network topology. DISA's Cloud Computing Security Requirements Guide defines the DoD Impact Levels — IL2 for publicly releasable and other unclassified information not designated CUI, IL4 for CUI on non-critical missions and non-national-security systems, IL5 for CUI needing more protection than IL4 affords and for unclassified national security system data, IL6 for information classified up to SECRET. A customer can say "IL5" and still have egress through an approved gateway, or be entirely unclassified and hand you a room with no network in it.
What "no egress" actually removes
No package index. No container registry. No model hub. No license server. No telemetry sink. No update channel. No remote shell. No revocation responder, no public time source, no third-party API, no font pulled from a CDN by your own console. Anything the system needs is already inside the boundary, or arrives through a procedure with a person and an approval attached.
The model is the cheap part
Teams brace for the wrong thing. Open weights are a file; you copy them in. Mature inference runtimes are built to run offline and do. Fine-tuning inside a closed environment is ordinary work. The cost sits in everything your product does around the model that quietly assumes a network — most of it owned by people who will never read the boundary diagram.
| What goes away | What replaces it | Where the cost lands |
|---|---|---|
| Hosted model API | Weights on local storage, served by an offline-capable runtime on hardware inside the boundary. | GPU capacity planning, and a model choice narrowed to weights whose license permits redistribution into someone else's environment. |
| Package index and registry | A complete dependency closure staged into an internal mirror, or shipped as one self-contained artifact. | Build engineering. Every release is packaged twice, and the offline one cannot be hot-fixed. |
| License server and metering | File-based or node-locked entitlement; consumption becomes self-reported or unobservable. | Contract language and pricing model — not code. A commercial change wearing an engineering costume. |
| Telemetry and crash reporting | Nothing, or an export bundle the customer reviews and releases at their discretion. | Roadmap instrumentation and triage speed. You stop learning how this deployment is used. |
| Auto-update channel | A media-transfer procedure with an approver and a cadence measured in days. | Security response time, and the patch commitments you can honestly put in a contract. |
| Remote support and shell | A diagnostic bundle produced on request, reviewed by a human, released the way files come in. | Support staffing, travel, and the quality of your own error messages. |
Cost one: the features you delete
List every outbound call in your product that is not the model: crash reporting, product analytics, feature flags, session replay, SSO pointed at a cloud identity provider, the geocoding or document-conversion service you call once per ingest, map tiles, fonts, the update checker. Each is deleted, replaced with something inside the boundary, or made to degrade in a defined way.
The engineering per item is small; the cost is organizational. Each has an owner, a dependent workflow and often a contract, and removing it is a roadmap decision made under time pressure by people who were not in the meeting where "air-gapped" was agreed to. This is where teams discover the deployed build and the hosted build have become two products sharing a name.
The failure that costs real money is subtler: a call nobody knew was there, three dependencies down, silently satisfied by a warm cache on every laptop it has run on. We wrote that enumeration up separately — which libraries reach where, and how to prove on a bench that yours do not.
Cost two: entitlement and the price you can charge
Usage-based pricing depends on observing usage. With no egress you cannot: no per-token meter, no verifiable seat count, no phone-home to check the term has not expired. The options are node-locked or file-based entitlement, a term license priced per node or appliance, or accepting self-reported consumption — commercial decisions needing legal and finance, not a sprint ticket.
This is solved, and it stays manual even at the largest scale. NVIDIA's License System documentation describes node-locked licensing, where a client with no network connection or on an air-gapped network obtains a license from a file installed locally, and an on-premises Delegated License Service instance that, being disconnected from the NVIDIA Licensing Portal, requires licenses to be downloaded and uploaded by hand. If the company shipping the GPUs keeps a human in that loop, so will you.
The other licensing cost is the model's own. Open weights are not public domain, and the terms travel with the file. Meta's Llama 3.3 Community License requires anyone distributing the materials or a derivative to include a copy of the agreement, carry specific attribution text in a "Notice" file, and display "Built with Llama" prominently, with a separate license required from Meta above 700 million monthly active users. Shipping weights into a customer-controlled boundary is redistribution — read the license that way.
Cost three: a second release train, permanently
The first offline package is a project. The second is the actual cost, and so is every one after it. You now maintain a build that resolves every dependency locally, pins versions rather than ranges, produces artifacts matching the target hardware rather than the build host, and carries its own provenance.
That last part is not optional, and the bar just moved. On 29 July 2026, CISA, NSA, the FBI and fifteen international partner agencies published 2026 Minimum Elements for a Software Bill of Materials (SBOM), updating and replacing the minimum elements NTIA published in 2021. It adds required data elements including component hash, component license, generation tool name and generation context, and states they apply to all software — open source, AI software and software-as-a-service included. The license inventory you kept in a spreadsheet now ships inside the artifact, machine-readable, for a reviewer you will never meet. More on SBOM and supply-chain evidence separately.
Cost four: support with no logs
Teams underestimate this one most, because it does not appear until the system is live. You cannot see anything: no error aggregation, no performance monitoring, no remote session, no reproducing it against their data. Every diagnostic is a round trip — describe a command to someone inside, have them run it, have the output reviewed by a human for anything that should not leave, and have it released the same way files come in. NIST SP 800-53 control MP-7 (Media Use) is why that review exists: organizations restrict or prohibit specified media types and prohibit portable storage with no identifiable owner.
So the build has to explain itself without you: a diagnostic collector inside the package, a version string answerable in one command, error messages naming the unavailable dependency rather than failing generically, and a short explicit timeout on every outbound call that survived the cull — because in a boundary that drops packets rather than refusing them, a forgotten call does not error, it hangs. Your time to resolution is bounded by the customer's review queue.
Cost five: the patch clock and the transfer window
Patch expectations are getting faster while transfer procedures are not. CISA published Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, on 10 June 2026; it supersedes BOD 22-01 and BOD 19-02, replaces static deadlines with risk-weighted ones, and sets its shortest remediation deadline at three days for the worst combination — a publicly exposed asset, an automatable exploit, total system control, known exploitation. It binds Federal Civilian Executive Branch agencies rather than DoD, which manages vulnerabilities under DoD Instruction 8531.01 through orders issued by USCYBERCOM. The scoping differs; the direction does not.
Getting a patch in requires the transfer procedure, its approver and its queue. If content must cross a security domain, that is not an engineering preference: DoD Instruction 8540.01 governs cross domain solutions, and a solution must appear on the cross domain baseline list maintained for DoD and Intelligence Community use before deployment. You do not write your own guard, and neither do we.
The change itself may cost paperwork. Under NIST SP 800-37 Revision 2, organizations define event-driven triggers for ongoing authorization and reauthorization, where a significant change is one likely to substantively affect the security or privacy posture of the system. Whether your dependency bump qualifies is the authorizing official's judgment, not yours — which is why "who decides, and how long" belongs in scoping rather than in your first incident.
Why a three-day expectation and a weekly window do not compose
Suppose — purely as arithmetic, with no claim these are typical figures — engineering produces a fix in one hour, the transfer window runs weekly, scanning and approval take three days, and the change board meets fortnightly. The engineering hour is invisible in the result: what the customer experiences is set by the slowest reviewer in the chain. Get real numbers for each step before writing a response-time commitment into a contract.
Cost six: who is allowed in the room
At the restrictive end the binding constraint stops being technical. Escorted access, badging lead times, no personal electronics, sometimes two-person rules, travel to a specific facility — the critical path becomes one named person's calendar. Plan the visit around what cannot be done any other way; do everything else on a bench first. Our own boundary, stated plainly because it is more useful than claiming breadth: we hold no facility clearance today and we do not perform classified work on classified networks. Where that is the requirement, we build and prove the artifact on unclassified infrastructure and produce the evidence and operating procedure, while enclave-side execution is done by cleared personnel the customer or a cleared partner provides.
What to establish before you quote a price
These are the answers that change the number. Get them in writing, from the people who own each one, before a date or a figure leaves your side.
- Which air gap — proxy, allowlist, no-route-with-mirror, or media-only. Moves the estimate more than anything else here.
- What already lives inside — package mirror, registry, artifact store, and who may publish into them. Inheriting infrastructure beats shipping a closure.
- The exact target — GPU model and count, driver version, container runtime, OS baseline and patch level. An optimized artifact is often bound to the machine that built it.
- The transfer procedure — who approves, what format, what gets scanned, realistic turnaround. Usually the true schedule driver.
- The patch path — which deadline regime applies, who declares a change significant, and the fastest real route for an emergency fix.
- The evidence recipient — the named person who accepts your verification and provenance artifacts, and the format they need.
Where our line is
Scope is more useful to a stranger than a list of adjectives, so here is ours.
We do not issue authorizations, and nothing arrives pre-accredited
An authorization to operate is granted by a government authorizing official against a specific system in a specific boundary. We build systems designed to be accreditable and produce the evidence an assessment needs — see our write-up on the ATO path for an AI component. Any vendor describing an impact level or an ATO as a product it sells, or a component as pre-accredited, is describing something that does not exist.
We are not a C3PAO and we do not assess ourselves
We cannot assess you for CMMC; that requires an authorized third-party assessment organization, which we are not. We also do not perform your independent assessment and then remediate our own findings. An independent look comes from someone with no stake in the build.
We do not do the facility side
Clearance sponsorship, secure-space accreditation, cross-domain engineering and media-transfer accreditation are separate disciplines with their own firms and approvals. We work to the procedure your organization already has. We do not stand one up, and we do not build guards.
We will not take a fixed install date before an isolated test has run
If the first time a stack runs disconnected is inside the facility, the install has become a debugging session with the wrong tools and an audience. If a schedule leaves no room for the bench test, we say so before the date is set, not after it slips.
We are not a training vendor, and we do not write proposals for other firms
We build and deliver systems. If what you need is a course, a certification track, or someone to author your submission, that is a different kind of company — and we will say so on the first call.
What is actually worth buying here
The work is not exotic. It is air-gapped model deployment done deliberately: open weights imported through the accredited transfer path, hash-verified and registered; runtimes chosen because they run fully offline; retrieval on self-hosted vector stores with classification labels at the chunk level, enforced before the model sees a document; fine-tuning whose logs never leave the enclave; self-hosted MLOps rather than a cloud experiment tracker; and the evidence package that lets somebody else check all of it. If the deliverable must run inside a boundary you do not control, the companion piece on headless deployment into a customer sandbox covers the interface contract.
The cost of an air gap is real, mostly not where teams look for it, and knowable up front by asking the right people the right questions. The expensive version of this project is not the one with the strictest boundary. It is the one where the boundary was discovered on site.
Frequently asked questions
No. An impact level is an accreditation category defined in DISA's Cloud Computing Security Requirements Guide — IL5 for CUI needing more protection than IL4 affords and for unclassified national security system data, IL6 for information classified up to SECRET. An air gap is a property of the network. A system can be authorized at a high impact level and still have approved egress, or be entirely unclassified and have none.
Rarely. Three things usually break at once: outbound calls in transitive dependencies that a warm cache has been hiding, entitlement checks that assume a server, and the support and telemetry loop your operations team depends on. The first is discoverable on a bench in an afternoon; the other two are commercial decisions that take longer than the engineering.
Usage-based pricing generally cannot be enforced or audited without egress, so offline deployments tend toward node-locked, per-appliance or term licensing. Price the second release train as a standing sustainment line rather than one-time packaging, and price support against the customer's review turnaround.
No. An authorizing official grants an authorization to operate against a specific system in a specific boundary. What a builder can do is design to the controls, produce the artifacts an assessment needs, and avoid choices that make authorization harder. Anyone selling the authorization itself is selling something else.