@JukEboX One thing I can tell you about that is that our security department requires us to immediately disable both the http server and the http secure-server (HTTPS).

Also, a fully air-gapped network would require you to connect directly to the console port to configure. That would mean disabling all the VTY lines, and HTTP and HTTPS.