Air gapped, yes. And on some of the systems only specific company machines are allowed at a network level to connect, which belong to my department.
Expense is, unfortunately, a parameter which is very much an issue for any business...and something over which I have no sway.
Hmm. Banner ads for "GAP" are now appearing on my device....