How does compliance scanning work in air-gapped environments?

More context

The design constraints are strict: no license phone-home, no cloud-hosted console, no telemetry, and no dependency on internet-delivered content updates during operation. Tools designed as SaaS with an "offline mode" typically fail one or more of these constraints; air-gapped operation has to be an architectural decision, not a feature flag.

CISGuard's per-deployment licensing fits this model because entitlement lives with the installation rather than a cloud account. Updates to the 22-benchmark catalog ship as signed media, and deployments are onboarded by CISGuard engineers who handle the transfer-process integration with the customer's security procedures.