Hot sites and warm sites: Choosing the right option for your disaster recovery plan

Which is better for your company, a hot or warm DR site? This article explores both options and what to consider when choosing a DR site vendor.

Disaster recovery (DR) professionals often have a difficult time making a clear distinction between hot and warm disaster recovery sites. A hot site ensures critical business systems will remain available during an outage. Or at the very least, the hot site is capable of recovering critical systems within minutes of an outage. A hot site typically includes everything a company needs to quickly resume operations: computer hardware, key applications, telecommunications, peripherals, utilities and workspace for employees. A hot site is, in effect, a duplicate of your primary site.

More on disaster recovery services and outsourcing
Collocation data center tips for disaster recovery and business continuity professionals

Disaster recovery and business continuity articles and podcasts by DR expert Paul Kirvan

Disaster recovery planning and operations tutorial

Business continuity and disaster recovery outsourcing tutorial

Aside from hardware, vendors that provide hot site facilities typically offer other services as well. Those services might include provisioning or reconfiguring of software, electronic data vaulting of tapes, offsite data replication, network monitoring and management.

By contrast, warm sites may take 24 to 48 hours to recover data, making them better suited for backing up nonessential systems. Although usually partially equipped, a warm site may not provide all services. For example, users may be required to provision their applications or purchase additional servers when declaring a disaster.

Focus on data recovery needs

Although these distinctions are noteworthy, getting bogged down in buzzwords isn't helpful. The proper question to ask isn't whether you should use a hot site vs. a warm site, said Bill Hughes, director of consulting services for disaster recovery with SunGard Availability Services in Wayne, Pa.

"It's more important to know which data you need to focus on, how quickly you'll need to recover it and knowing what your options are," Hughes said. "The reality is you have to analyze this at the systems level."

Rarely is it an either/or decision. The best solution is a hybrid that involves turning some disaster recovery functions over to a handful of different vendors, while keeping other functions (i.e., high availability) in house, said Edward Brown III, president of Ketch Consulting in Scranton, Pa.

Companies may balk at having data spread across several locations, but "the huge advantage of a blended solution is that it allows you to change your short-term recovery economically," Brown said.

The science of disaster recovery budgets

Your DR spending will be influenced by how rapidly you need primary business data to be made available. For example, organizations that can't afford to lose data, even for a few minutes, tend to invest in a secondary hot site that is "dedicated" to disaster recovery, said Pat Corcoran, an executive with IBM Corp.'s Business Continuity and Resiliency Services in Sterling Forest, N.Y. Typical users include companies in the financial services, health care and pharmaceutical sectors.

Building a secondary data center designed solely for failover of key systems is the most extreme example of a dedicated architecture. However, a dedicated disaster recovery environment might be made up of additional servers, storage, tape libraries or high-speed telecommunications lines that you acquire from vendors.

"The degree to which your solution is dedicated to disaster recovery will affect your recovery point and recovery time objectives," Corcoran said.

A hot "standby" system of computers and other hardware enables your organization to secure applications that contain important data for e-commerce and other revenue-generating transactions, said Ed Tittel, an independent DR consultant in Austin, Texas.

Meanwhile, if your organization is smaller or its needs aren't as time-sensitive, there are cost advantages to shifting non-critical applications and processes to an outsourced warm site.

"The expense of the site you choose is determined in part by the capabilities and resources it has to deliver and in part by the amount of downtime you can tolerate," Tittel said.

Because of this, generalizing ballpark costs for hot and warm disaster recovery environments isn't helpful. Jim Olson, SunGard Availability's vice president of solutions engineering and training, said monthly pricing can range from a few hundred dollars to thousands of dollars, depending on your recovery schedules and any additional services needed.

Corcoran of IBM concurs. "I've seen basic warm sites for about $1,000 a month." These warm sites consist of small, dedicated tape-based systems with little to no networking. "And I've seen solutions that cost more than $1 million a month for a dedicated environment that includes hardware, servers and storage, networks plus monitoring."

What you need to know when choosing a hot or warm site vendor

IBM and SunGard are the dominant vendors in the disaster recovery site industry, but lots of smaller vendors, including collocation providers, are angling for a share of the DR market. Among them are Agility Recovery Solutions, ITS-Data Recovery Systems, Recovery Point Systems Inc. and Titan Networks, each of which offers varying remote facilities equipped for data storage and recovery. In order to make the right decision, before you choose a vendor for your hot or warm site, you need to first consider the following.

Distributed risk. Collocation providers tout hot site services among their offerings, but some may have only a single facility. Potential buyers should ask for a detailed explanation of protocol in case the vendor itself suffers an outage. In other words, does the backup provider have a backup? If not, your data could still be at risk.

"Single-facility companies should have a written partnership with other DR facilities to provide failover in case their own systems go dark," Brown said.

You can learn a lot from other people who have gone through what you're getting ready to do yourself.
Ed Tittel
Independent DR consultant

Reference accounts/recovery history. Be aggressive when inquiring about the vendor's practical ability to execute your disaster recovery plan. Don't be afraid to ask for reference accounts of other companies, and then arrange to interview them. Seek information on which services they've used, their experiences, service-level histories, how the vendor performed during actual emergencies and practice drills and tests.

"You can learn a lot from other people who have gone through what you're getting ready to do yourself," said Tittel.

If a bidding vendor is new to the industry and lacks a service history, that fact alone shouldn't eliminate it from contention. According to Brown, it's crucial to ask specific questions such as: "What assurances do I have that you'll be in business next month? How do I know you'll be able to recover my data?"

Competency and certification. Along the same lines, reputable hot site providers typically employ disaster recovery professionals who have earned recognized industry certifications: particularly, either the Certified Business Continuity Professional (offered by the Institute for Continuity Management) or the BCI Certification (offered by the Business Continuity Institute). "If their people don't have these certifications, it doesn't mean they're not qualified or can't do the job," Brown said. "But if they are certified, it's a good sign" that indicates demonstrated expertise.

Flexibility and depth. In some cases, you may face an obstacle such as extreme weather or other circumstances that prevent you from reaching the physical backup site. Determine if the vendor you prefer is willing to go the extra mile in such situations.

"Maybe you can't be there to read your tapes -- in that case, find out if the vendor has staff that can do the work for you -- and how much extra it will cost. Ask about the depth of services they offer. Those intangibles really can make a big difference in helping you mitigate risks," said Hughes of SunGard.

Whether you need a hot site, a warm site or some amalgamation thereof, experts say the pivotal issue is to base your decision on the urgency of data retrieval. Then, armed with solid information about vendors, you should be able to arrive at a thoughtful decision and avoid buyer's remorse.

About this author: Garry Kranz is a freelance technology writer in Richmond, VA. His work has appeared in,, and other TechTarget news portals.

Dig Deeper on Disaster recovery services - outsourcing