A regional insurer's data center sits in a business park two miles from a river. One spring the river crests, the building takes on three feet of water, and the generator in the basement is the first thing to fail. The company signed a recovery site contract years ago, and that morning the IT director reads it closely for the first time: it's an empty room with power and network drops, and replacement servers will take ten days to arrive. The plan existed. It just didn't match how long the business could afford to be down.
On the CompTIA Security+ SY0-801 exam, recovery sites and platform diversity sit under objective 3.4, which expects you to explain why resilience and recovery matter in security architecture. This lesson covers hot, warm and cold sites and their cloud equivalents, the environmental factors that decide where a recovery site belongs, and how vendor, hardware and virtualization diversity keep one flaw from disabling every copy of a system.
A recovery site is where the business runs when the primary site can't
A recovery site, also called an alternate processing site or DR site, is a separate location where an organization can bring its systems back when the primary data center is lost or unusable. Fire, flooding, a long regional power outage and a building that police have closed off all qualify. So does a cyberattack that leaves the primary environment untrustworthy, although a recovery site only helps there if the attacker can't reach it too.
Every type of recovery site answers the same question: how much is already in place before the disaster? Anything not there in advance has to be bought, shipped, racked, installed, configured or restored afterward, and each of those steps takes time. Anything that is there in advance costs money every month, whether or not a disaster ever happens. Choosing a site means choosing a point on that trade-off.
The business, not IT, sets the point. The recovery time objective for each system says how long it can be down, and that target comes from the business impact analysis, which is covered in the risk management section. The metrics themselves get their own lesson at the end of this section.
Hot, warm, and cold sites trade standing cost against recovery time
A hot site is a working duplicate of production. Servers, storage, network gear and security tools are installed and running, and data is kept current by replication from the primary site. Switching users over takes minutes to a few hours. Many large organizations run two data centers that both carry live traffic, so either can absorb the other's work. The cost is a second data center: hardware, licenses, power, cooling, circuits and the staff who patch and maintain it all. That maintenance matters. A hot site that misses six months of configuration changes will fail in ways nobody predicted.
A cold site provides space, power, cooling and usually network connectivity, and nothing else. After a disaster the organization has to obtain hardware, install operating systems and applications, restore data from backups and test everything before users return. That takes days to weeks. It is the cheapest option, and it suits systems the business can live without for a week or more. One hidden risk: during a regional disaster, every affected company is ordering servers at the same time, so delivery estimates can stretch.
A warm site sits between them. Hardware and network connections are in place, and the systems may have operating systems installed, but data isn't current. Recovery means restoring the most recent backups, applying configuration and starting services, which usually takes hours to a few days.
| Site | Already in place | Data at the moment of disaster | Typical time to operate | Standing cost |
|---|---|---|---|---|
| Hot | Full hardware, software, network and security tools | Current, kept in sync by replication | Minutes to hours | Highest |
| Warm | Hardware and connectivity, partial configuration | Must be restored from recent backups | Hours to a few days | Medium |
| Cold | Space, power, cooling, network drops | None until restored | Days to weeks | Lowest |
These ranges are common descriptions, not a standard. Contracts and designs vary, and a well-tested warm site can outperform a neglected hot site.
A recovery site also needs the same security as production. Firewall rules, endpoint protection, logging, MFA and patch levels must match. A DR environment with weaker controls is an easy way in, and the moment you fail over to it is the moment your defenses are thinnest.