A cold site is a backup facility that supplies the basics for recovery, meaning power, cooling, floor space, and network connectivity, but no pre-installed servers, software, or current data. Bringing operations up at a cold site means shipping in hardware, building systems, and restoring from backups, a job that realistically takes days to weeks.
The appeal is cost. A cold site is the cheapest recovery option because you are essentially renting an empty, conditioned room until you need it. The price you pay is speed, which is why cold sites suit systems that can tolerate a long outage. They sit at one end of a spectrum: warm sites keep some hardware staged and configured, and hot sites run a live mirror ready in minutes. The right pick is not the fanciest one; it is the one that matches each system’s Recovery Time Objective and its budget.
How is a cold site tested on the CISSP?
Cold sites appear under business continuity and disaster recovery in Domain 7: Security Operations. Candidates should weigh the cold, warm, and hot options against Recovery Time Objectives set during the Business Impact Analysis.
Related terms: Disaster Recovery, Recovery Time Objective