Plan the disconnected environment as a supply chain and recovery system, not merely an installer with networking turned off. Define the transfer authority and classification rules before moving the first bundle.
Build the bill of materials
List application images by digest, deployment charts or Compose files, database extensions, operating-system packages, map tiles, terrain data, geoid models, ML weights if enabled, licenses, trust roots, and verification tools. Include architectures and storage estimates.
Generate an SBOM and signed manifest for the bundle. Every file in the transfer set has a size and cryptographic hash. Record the application and schema version the bundle can install or upgrade.
Prepare the transfer path
Use a clean staging system, approved removable media or transfer gateway, malware scanning, and two-person verification where policy requires it. Verify signatures before import and again inside the disconnected boundary.
Quarantine unexpected files and mismatched hashes. Do not “repair” a signed bundle in place; issue a new versioned bundle.
Seed registry and runtime assets
Import images into the private registry without changing their digests. Load maps, terrain, models, and other private runtime assets into governed storage. Verify application references resolve only to internal endpoints.
Run the deployment preflight with outbound networking blocked. DNS delays and failed external calls should not hold startup open or disguise an unhealthy service.
Install and license offline
Validate configuration, initialize storage, migrate schema, and seed required reference data through explicit steps. Verify the signed offline license against the bundled trust key and record its scope and expiry behavior.
Test both valid and expired-license paths before acceptance. Expiry must be visible and predictable; it must not corrupt data or require vendor access to recover customer records.
Back up and restore
Back up the database and every private runtime asset to storage outside the running stack. Encrypt the archive and sign a manifest containing schema, application version, file hashes, and required restore order.
Restore into a staged isolated environment, run integrity checks, start the application, and complete a core operational journey. A copied archive is not a proven backup until this drill passes.
Update and roll back
Take and verify a governed backup, stage the new signed bundle, validate compatibility, run migrations, and perform smoke checks. Keep the prior images and a tested data-recovery path until acceptance.
Schema rollback may require restoring the pre-upgrade backup rather than downgrading in place. State that decision before the maintenance window and rehearse it on representative data.
Record what the air gap changes
Identify capabilities that depend on live DSS federation, hosted weather or airspace feeds, remote support, online identity providers, or other external systems. Replace them with approved local sources and procedures or mark them unavailable.
The acceptance pack lists those losses plainly, names the update cadence, assigns transfer responsibilities, and records how the site obtains urgent safety or security updates.