Air-gap isn't enough considering the existence of hardware trojans with built-in covert radio. Energy-gap, with brine water (like a submarine) is a must.