What is a cold site?
A cold site is an alternate processing location that provides the building basics and little else: floor or rack space, electrical power, cooling, physical security and usually network connectivity. There are no servers ready to run and no current data. After a disaster, the organization has to obtain hardware, install operating systems and applications, restore data from backups and test everything before users can return. That typically takes days to weeks. In exchange, a cold site is the cheapest kind of recovery site to keep, because almost nothing sits idle waiting for a disaster.
What recovery at a cold site involves
- Declare the disaster and activate the site contract.
- Obtain servers, storage and network equipment from a vendor, a recovery provider's stock or a pre-arranged shipment.
- Rack, cable and power the equipment, then bring up network connectivity and firewalls.
- Install or image operating systems and applications, ideally from documented builds or infrastructure-as-code.
- Restore data from offsite backups, starting with identity and core services.
- Test, harden and validate with business users before declaring service restored.
The slowest step is often the hardware. During a regional disaster, every affected company may be ordering servers at the same time, so delivery estimates can stretch well beyond normal lead times.
When a cold site makes sense
A cold site fits systems the business can live without for a week or more, such as an archive, an internal training portal or a reporting system that can catch up later. It can also serve as a longer-term home after an initial recovery elsewhere. It is a poor fit for anything customer-facing or revenue-critical. The cloud equivalent is a backup-and-restore design: data and machine images sit in cloud storage, and the environment is built only after the event. That can be faster than a physical cold site, because compute is launched on demand rather than shipped, as long as the account's quotas allow a large launch.
Example: matching systems to the right site
A manufacturer keeps a single cold site contract for every system to save money. Its business impact analysis gives the order-entry system a recovery time objective of 48 hours. A recovery test shows that replacement servers would take seven business days to arrive and three more days to configure, so the cold site cannot come close to the 48-hour target. The company moves order entry to a warm standby in the cloud and keeps the cold site for its archive and reporting systems, whose recovery targets are two weeks. Each system now has a site whose realistic recovery time fits its target.
Cold site vs. warm site vs. hot site
| Site | Ready before a disaster | Typical time to operate | Standing cost |
|---|---|---|---|
| Cold | Space, power, cooling, connectivity | Days to weeks | Lowest |
| Warm | Hardware and connectivity; data restored from backups | Hours to days | Medium |
| Hot | Full running copy with replicated data | Minutes to hours | Highest |
These ranges are common descriptions, not a standard. A site's real recovery time depends on contracts, staff, documentation and how recently it was tested.
Cold site on the CompTIA Security+ exam
Recovery sites fall under SY0-801 objective 3.4, which covers why systems must be designed to survive failures and recover from them. Wording such as "lowest cost", "least expensive option", "can tolerate a week or more of downtime" or "space and power only" points to a cold site. If the question gives a long tolerance and asks for the most cost-effective choice, a cold site beats a warm or hot site even though those would also meet the time. It is the wrong answer when the scenario needs recovery within hours or a day. Also check the location: a cold site in the same flood plain or hurricane zone as the primary fails in the same event, whatever its type.