Separated from the Internet. Air-gapped computer systems contain highly sensitive data and are connected via private networks that are completely isolated from the Internet. A firewall between the network and the Internet does not make the network air gapped. It has to be physically isolated ("air in between").
To gain access and inject malware, an attacker would have to literally sit down at the air-gapped computer and start typing. A user on a computer without any wired or wireless network connection whatsoever is essentially working on an air-gapped computer. See Faraday cage
, computer security
and information security