Role-based administration

You will have separate installations of Sophos Enterprise Console on the two networks, so you won't be able to monitor both networks from one Sophos Enterprise Console. You could break your air-gapped network into sub-estates, if it's big enough. As with any network, you'd probably want to define at least one extra role to monitor the network when the administrator is busy.