Disaster recovery site options: Hot, warm and cold sites

Learn about the pros and cons of three disaster recovery site options: hot, warm and cold sites.

Disaster recovery (DR) terminology can be confusing -- terms like hot site, warm site and cold site are common in DR parlance. Each option is a reliable disaster recovery site, but which one should you choose for your company? Here's a look at the differences in hot site vs. warm and cold sites in disaster recovery and the pros and cons of each.

More on disaster recovery services
Collocation data center tips for disaster recovery and business continuity professionals

Disaster recovery planning and operations tutorial

Disaster recovery and business continuity tutorials

Hot sites

If the acceptable recovery time objective (RTO) for your company is a few hours instead of minutes, then a hot site is likely appropriate. The biggest difference between a hosted site and a hot site is the use of shared equipment for infrastructure components like servers and peripherals. Storage is dedicated and real-time data replication is used to get data from the production site to the disaster recovery site.

Because equipment in the DR site is shared by multiple customers, hot sites are significantly less expensive than hosted sites. "Hot sites and warm sites can be implemented less expensively through outsourcing than doing them in-house because of shared equipment," said George Ferguson, worldwide service segment manager for Hewlett-Packard (HP) Co.'s business continuity and recovery services. "DR services providers rely on the fact that not all customers have a disaster at the same time."

On the downside, the use of shared equipment makes hot sites less flexible because customers are limited by the equipment the disaster recovery service provider offers. While some service providers may have a limited selection of equipment, others are more flexible. "About 90% of the time we're able to use shared equipment, and the rest of the time we work with the customer to make it work," said Marc Langer, president at Recovery Point Systems, a provider of backup, storage and disaster recovery services. Larger service providers may be less flexible, so the nature of the shared equipment is likely to be a determining factor when selecting a hot or warm site provider.

Another consequence of using a site with shared equipment is the time limit on how long customers can use the shared gear in the event of a disaster. The limit varies among service providers, but typically ranges between 30 days and 90 days. "Customers can use the shared equipment for 60 days before they need to get out or before they get migrated to a cold site," said Langer. Service providers with a larger number of data centers, like IBM Corp., can be more flexible. "We're pretty open-ended because we can shift workloads to other data centers," said John Sing, senior consultant, business continuity strategy and planning at IBM's Systems and Technology Group. To avoid unpleasant surprises, a clear understanding of the terms, conditions and limitations of managed disaster recovery services is required prior to committing to an agreement that may span several years.

Warm sites

In contrast to a hot site, a warm site relies on backups for recovery. As a result, it doesn't require dedicated storage but instead can take advantage of less-expensive shared storage. In other words, all components of a warm site, including storage, are shared among multiple customers. Therefore, most of the considerations of hot sites also apply for warm sites.

In the past, there was a huge difference between hot sites and warm sites because backups were limited to tape. As a result, warm site recoveries were typically measured in days. Warm sites that rely on tape-based backups for recovery are clearly at the lower end of the DR services spectrum.

Disk-based backups have narrowed the gap between warm sites and hot sites, and almost all disaster recovery service providers now offer an electronic vaulting option, which is essentially disk-based backup of production data over the network. RTOs and recovery point objectives (RPOs) of warm sites with electronic vaulting are typically less than a day, which is very close to the recovery times offered by hot sites but at a fraction of the cost. "There has been about a 10 times price difference between a replicated DR infrastructure and a shared infrastructure with electronic vaulting," explained HP's Ferguson. "Electronic vaulting is closing the gap between tape-based recovery and a replicated DR infrastructure, and customers need to look at it because of its price and reliability benefits."

Cold sites

A cold site is rented space with power, cooling and connectivity that's ready to accept equipment. With recovery times of a week or more, a cold site is only an option for business processes that can be down for an extended period. Cold sites are also used to complement hot sites and warm sites in case of disasters that last a long time. "Some of our customers sign up for a cold site as contingency to migrate equipment from the shared infrastructure to the cold site in case a disaster lasts more than six weeks," said Recovery Point Systems' Langer.

It's the customer's responsibility to provide equipment for the cold site during a disaster. A disaster recovery plan that relies on a cold site must clearly define the process of procuring and delivering equipment to the cold site when a disaster strikes. It's a risky strategy to rely on purchasing the equipment on the open market when it's needed as it may not be possible to get the equipment in a timely fashion. A better option is to consider subscribing to a quick-ship service available from companies like Agility Recovery Solutions. "You can rent equipment for as little as $50a month with an option to buy it if needed," said Recovery Point Systems' Langer.

This article originally appeared in Storage magazine.

About this author: Jacob Gsoedl is a frequent contributor to "Storage" magazine.

Dig Deeper on Disaster recovery planning and management

Data Backup
Storage
Security
CIO
Close