{"page":"/blog/air-gapped-ad-tech","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Source","Type","What it requires","Air gap named?"],"rows":[["44 U.S.C. 3608 (FedRAMP Authorization Act)","US statute","Establishes FedRAMP in GSA as a government-wide approach to assessing cloud products (LII)","No"],["OMB Memorandum M-24-15 (25 July 2024)","US executive policy","Directs FedRAMP's modernisation and reuse of existing certifications (FedRAMP)","No"],["FedRAMP CR26 classes A to D (June 2026)","Programme rules for providers seeking certification","Class D covers most agency uses \"regardless of security objective\", excluding classified systems (FedRAMP, classes)","No"],["DFARS 252.239-7010","US regulation applied through a contract clause","CC SRG controls; government data kept in the US (eCFR)","No"],["DoD Cloud Computing SRG, IL5 and IL6","DoD guide, binding through the clause","IL5 physical separation from non-federal tenants; IL6 dedicated infrastructure (Microsoft Learn)","Not in the summary we read"],["10 CFR 73.54","US regulation (nuclear power plants)","A cyber security programme with \"defense-in-depth protective strategies\" (eCFR)","No"],["French \"cloud au centre\" doctrine, rule 9","Government policy for state administrations","SecNumCloud and immunity from third-country authorities for particularly sensitive data (numerique.gouv.fr)","No"],["SecNumCloud","Certification scheme run by ANSSI","Qualification of named services (ANSSI catalogue)","No"],["EU Data Act, Article 32","EU regulation","Cloud providers must take measures against unlawful third-country access to non-personal data (EUR-Lex)","No"],["Customer contracts and security schedules","Private contract","Whatever the parties agree","Sometimes; this is where we expect most air-gap demands to arise"]],"sourceUrls":[["https://www.law.cornell.edu/uscode/text/44/3608"],["https://www.fedramp.gov/2026-11-02-memo-to-milestone/"],["https://www.fedramp.gov/2026/providers/start/class/"],["https://www.ecfr.gov/current/title-48/chapter-2/subchapter-H/part-252/subpart-252.2/section-252.239-7010"],["https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-dod-il6"],["https://www.ecfr.gov/current/title-10/chapter-I/part-73/subpart-H/section-73.54"],["https://www.numerique.gouv.fr/offre-accompagnement/cloud-administrations/programme/"],["https://messervices.cyber.gouv.fr/visas/catalogue-produits-services-profils-de-protection-sites-certifies-qualifies-agrees-anssi.pdf"],["https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"],[]]}