Home > Glossary > Certified Information Systems Security Professional > Cold Site

📖 What is Cold Site?

A Cold Site is a backup facility that provides physical space, power, and cooling, but no pre-installed hardware or current data. It requires the most time to become operational, as equipment must be shipped in and software installed.

🥋 Sensei Says:

"This is the cheapest recovery option but has the longest RTO. It is suitable for non-critical systems."

📚 Certification: Certified Information Systems Security Professional (CISSP)

🔑 What are the Key Concepts of Cold Site?

▸ Highest Recovery Time Objective (RTO) among site types, as the organization must procure, ship, and configure all necessary hardware and software.
▸ Lowest ongoing operational cost because the organization avoids paying for idle hardware, software licenses, and continuous data replication services.
▸ Provides basic infrastructure including physical space, power, and cooling, but lacks pre-installed servers, storage, and current system data.
▸ Most appropriate for non-critical business functions where the organization can tolerate significant downtime without catastrophic impact to the enterprise.

🎯 How does Cold Site appear on the CISSP Exam?

You may be asked to select the most cost-effective recovery strategy for a business unit with a high RTO tolerance and a minimal budget for standby infrastructure, requiring you to prioritize cost over recovery speed.

A scenario might describe a disaster recovery plan for non-essential services where the primary objective is to minimize monthly maintenance costs while still ensuring a physical location is available for recovery.

Expect questions comparing recovery site types where you must distinguish a Cold Site from a Warm Site based on whether hardware is pre-installed or must be shipped and configured after a disaster.

❓ Frequently Asked Questions

How does a Cold Site differ from a Warm Site regarding data and hardware?

A Cold Site provides only the shell (power and cooling), requiring all hardware and data to be brought in. A Warm Site has some hardware pre-installed and receives periodic data updates.

Is a Cold Site considered a viable option for mission-critical applications?

No, because the RTO is too high. Mission-critical systems require Hot Sites or mirrored sites to ensure near-instantaneous failover and minimal data loss to meet strict recovery objectives.

Related Terms from Certified Information Systems Security Professional

Cross-Site Scripting (XSS) Clark-Wilson Model Risk Transference Vulnerability Assessment Rainbow Table Dynamic Application Security Testing (DAST)

📝 Related Study Guides

Study Guide 10 min read

How to Pass the CISSP Exam: A Realistic 2026 Study Plan

To pass the CISSP, you must transition from a technical mindset to a managerial one, focusing on risk management and policy over implementation. Success requires a 3-6 month study plan covering all eight domains, using adaptive practice exams to identify gaps and mastering the "mile wide, inch deep" breadth of the CBK.

Career Guide 10 min read

CISSP Experience Requirements: How to Get Your Waiver in 2026

To earn the CISSP, you need five years of cumulative, paid work experience in two or more of the eight CISSP domains. You can obtain a one-year waiver through a four-year college degree or approved professional certifications. Those lacking full experience can become an Associate of ISC2 after passing the exam.

Deep Dive 8 min read

Kerberos Authentication Explained for the CISSP Exam

Kerberos is a ticket-based authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography. It utilizes a trusted third party called the Key Distribution Center (KDC) to issue tickets, enabling Single Sign-On (SSO) and preventing replay attacks through the use of synchronized timestamps.