CISSP GLOSSARY · BUSINESS CONTINUITY

Cold site

Alternate facility providing only space, power, and environmental support; hardware and data arrive after the disaster, so activation takes weeks, at the lowest standing cost.

A cold site is an alternate facility that provides the shell only: floor space, power, HVAC, and basic connectivity. No servers are installed and no data is held. After a disaster, the organisation must procure and ship hardware, build out the environment, and restore everything from backups before operations resume, which puts activation time at weeks, sometimes longer. It is the cheapest recovery option to maintain, because almost nothing is being maintained.

The trap the exam sets is that “cheapest” refers only to the standing cost. Measured per hour of outage, a cold site can be the most expensive choice an organisation ever makes: weeks of downtime can blow through the MTD, the maximum tolerable downtime beyond which the organisation itself may not survive. A cold site is defensible only for functions whose loss the business can genuinely absorb for weeks, a fact established by impact analysis rather than by budget preference.

Exam relevance: if a scenario describes an empty facility with utilities but no equipment, or a recovery measured in weeks, the answer is cold site. If it asks which option is cheapest, cold site; which is fastest, hot site. The nearest confusable is the warm site, which already has hardware in place and waits only for data restoration; the cold site waits for the hardware too.