What type of alternate site is simply a facility under the organization's control but lacks pre-established information system capability?

A cold site is indeed characterized by being a facility that an organization controls but does not have pre-established information system capabilities. This means that while the location is available and can be utilized in the case of a disaster or business continuity plan activation, it requires significant setup and configuration to become operational. Typically, a cold site might have basic infrastructure such as power, heating, ventilation, and possibly storage for equipment, but it lacks the necessary technology, data, and systems configured and installed to immediately take over operations.

In a disaster recovery scenario, an organization would use a cold site to slowly restore services by transporting and installing the necessary hardware and software. This contrasts with hot and warm sites, which have varying degrees of system capability and can allow for more immediate continuity of operations. A mobile site, while capable of providing flexibility, does not fit the description of lacking pre-established capabilities as it typically involves a fully functional solution that can be moved to different locations.