What are hot, warm and cold sites?

Hot, warm and cold sites are three kinds of alternate location for restoring operations when your main site or systems are lost. The difference is how much is already in place: a hot site is ready to run, a warm site is partly equipped, and a cold site is mostly space and power.

What it means in practice

NIST’s contingency planning guide gives the standard definitions, and they line up like this.

• A cold site has the electrical and physical basics but no computer equipment. You bring in hardware, set it up and restore from backups. It’s the cheapest to hold and the slowest to use.
• A warm site is a conditioned space partly equipped with systems and telecommunications. You still load current data and finish the setup. Middle cost, middle speed.
• A hot site is a fully operational offsite facility with hardware and software, ready to take over. It’s the fastest to switch to and the most expensive to keep running.

The choice follows from your recovery time objective and recovery point objective. The shorter they are, the hotter the arrangement needs to be. If the business can wait several days for a function, a cold site may be enough. If it can wait only hours, a cold site can’t get there, because nobody can order, ship and configure hardware that fast.

Many mid-size organizations no longer rent a second building. They use a second cloud region or a recovery service, and the old names have faded. AWS describes four patterns: backup and restore, pilot light, warm standby, and multi-site active/active. Moving down that list lowers recovery time and data loss and raises cost and complexity. Those patterns map roughly onto cold, warm and hot. A disaster recovery vendor’s guide makes the same cost point.

One caution. An alternate site protects against losing a location or hardware. It doesn’t protect against bad data. A hot site that mirrors your systems will mirror ransomware too, so clean backups still matter.

Where it shows up in an incident

The IT or disaster recovery lead owns the arrangement. Deciding to use it, often called declaring a disaster, is a leadership call written into the disaster recovery or continuity plan. Waiting to see whether the main site recovers is how recovery times slip.

The usual failures are a failover nobody has tried, so the first test is a live incident, and an alternate site that shares the primary’s weak point: the same cloud region, identity provider or internet provider. Others are capacity smaller than production, expired credentials or contracts that nobody checked, and staff who don’t know where to go or how to connect.

For a way to test this, see how to test a business continuity plan.

In a tabletop exercise

Sample inject: “The recovery runbook says to fail over to the warm site. IT admits nobody has logged in to it in over a year, the VPN certificates for it have expired, and the database copy there is a day old. Do you declare a disaster? Who approves the spend to bring it up to full size, and what do you tell customers in the meantime?”

Discussion question: “For each critical system, is our alternate arrangement hot, warm or cold, and does it match the recovery time we promised?”

Sources

• NIST glossary, “hot site” (source: NIST SP 800-34 Rev. 1)
• NIST glossary, “warm site” (source: NIST SP 800-34 Rev. 1)
• NIST glossary, “cold site” (source: NIST SP 800-34 Rev. 1)
• AWS, Disaster Recovery of Workloads on AWS, disaster recovery options in the cloud
• OTAVA (a disaster recovery vendor), difference between cold, warm and hot disaster recovery sites