If you want to know why one classified environment costs several times what another one does, do not start with the hardware. Start with what it inherits.
What inheritance is, and what it is worth
Under the Risk Management Framework, a system does not have to assess every control itself. Controls provided by the environment it runs in can be inherited: the platform assessed them, the platform maintains them, and the system above accepts them by reference and documents the fact.
On a mature shared platform, this is most of the control set. Physical and environmental protection, much of the audit and accountability family, boundary protection, configuration management of the underlying stack, continuous monitoring instrumentation. A system landing on such a platform inherits a large share of its baseline and assesses only what it adds.
Inheritance is not a paperwork convenience. It is the single largest determinant of what authorization costs. Controls you inherit are controls you do not assess, do not evidence, do not re-assess annually, and do not carry findings against.
What an air-gapped on-premises estate inherits
Nothing.
Not for a bad reason. It follows directly from the topology. When you own the facility, the hardware, the hypervisor, the operating systems, the desktop images and the applications, and there is no external service underneath any of it, there is no one to inherit from. You are the platform owner and the system owner and the boundary owner. Every control in the baseline is yours to assess, evidence, and defend.
At the higher categorizations this is not a small baseline. A classified overlay applied on top of a high-high-high categorization runs to several hundred applicable controls. All of them land on the same team.
Now do it twice
Here is the part that surprises people.
If an organization runs two air-gapped enclaves, the second one inherits nothing from the first.
They are not connected. They are administratively separate by design, with independent boundaries, independent assessment schedules, and independent plans of action, and in most estates of this shape they answer to different authorizing officials as well. The fact that the two environments were built from the same design, by the same people, running the same software, buys you almost nothing in authorization terms, because inheritance is a property of the accepted boundary, not of architectural similarity.
If both enclaves happen to sit under one authorizing official, that helps less than you would expect. It makes reuse of assessment evidence easier to argue and it removes a negotiation, which is worth having. It does not create inheritance. Inheritance comes from a shared control provider underneath you, and two unconnected on-premises estates do not have one no matter who signs for them.
So: every control assessed twice. Every assessment cycle run twice. Every finding tracked twice. Every change assessed twice. Two continuous monitoring programs. Two sets of artifacts to keep current, on two sides of a gap that no one can cross with a file.
Two independent air-gapped boundaries with zero inheritance is the most expensive authorization topology available. There is no arrangement that costs more.
Almost nobody chose this
That is the thing worth saying plainly to whoever is being asked to defend the cost.
Estates like this are not the product of a bad decision. They accreted. A mission needed an isolated environment, so one was built. Later a second mission, or a second classification, or a second customer needed one that could not touch the first, so a second was built the same way. Each step was locally correct. The topology is what you get when a series of locally correct decisions runs for a decade without anyone pricing the aggregate.
Which also means the cost is not evidence that anyone is doing a bad job. It is a structural property of the shape, and it will not respond to working harder inside that shape.
What this tells you about the fix
If inheritance is where the money goes, then any modernization that does not change what you inherit is not a modernization. It is a refresh.
Replacing the hypervisor does not change what you inherit. Buying newer hardware does not change what you inherit. Moving to a different building does not change what you inherit. All three can be worth doing. None of them touches the thing that sets the bill.
Two moves change it: putting something underneath you that carries controls on your behalf, or reducing the number of boundaries that have to be authorized independently. The rest of this series is largely about those two, and about why the obvious alternatives fail.
Robert Burckner is the founder of Millabs Corporation. He has stood before authorizing officials to defend continued authorizations for legacy weapon systems, and served as Division Chief at the Space Warfighting Analysis Center (USSF/NRO).