When the primary site is unusable, the organisation still has to work somewhere. A recovery site is that somewhere: an alternate facility that carries processing while the primary is down. The options run from a hot site that is already operational to a cold site that is an empty room with power, with warm, mobile and cloud options in between. NIST SP 800-34 Rev. 1, the contingency planning guide that underpins most of this material, defines the same set.
The CISSP exam tests this constantly, and almost never by asking what a hot site is. It asks which site a scenario calls for, which is a different question with a different answer path.
Key Insight
The recovery site fits the RTO, not the other way around. The Business Impact Analysis produces the numbers first: how long each function can be unavailable, what the MTD is, and what RTO falls out of it. Only then is a site strategy chosen, and it is chosen because it can meet those numbers. If the MTD is four hours, a cold site is disqualified before anyone looks at the price.
Think Like a Manager
The cheapest option wins when IT decides alone. Manager thinking means running the BIA first, putting the recovery metrics in front of the board, and letting the business approve the cost that matches the exposure it has agreed to carry. A cold site chosen on price fails the first real incident, and the failure lands on whoever let a budget line stand in for a risk decision.
That is the same sequence the metrics themselves follow. RPO, RTO, WRT and MTD are derived from business impact before any recovery technology is named. The site is an answer, so it cannot be picked before the question has been asked.
Hot vs Warm vs Cold: Quick Comparison
| Recovery site type | What is already in place | Recovery time | Relative cost |
|---|---|---|---|
| Hot site | Full infrastructure, data replicated near real time | Minutes to a few hours | Highest |
| Warm site | Hardware and connectivity, data restored on activation | Hours to days | Moderate |
| Cold site | Space, power and network only | Days to weeks | Lowest |
Every difference between a hot, warm and cold site reduces to one variable: how much has been paid for in advance. A hot site is a second data centre kept current, so readiness is a permanent cost and recovery is fast. A cold site defers almost all of that spending until the disaster actually happens, which is why activation runs to weeks: equipment has to be procured, installed and loaded before anything runs. A warm site sits between them, with the hardware standing but the data stale, so recovery is a restore rather than a build.
Beyond Hot, Warm and Cold: Other Recovery Site Types
Hot, warm and cold are not the whole answer set, and scenario questions increasingly reach past them.
- Redundant site: active-active processing across two facilities, so there is no failover event and downtime is close to zero. NIST SP 800-34 Rev. 1 calls this a mirrored site, which is worth recognising if a question uses that wording.
- Mobile site: a self-contained facility transported to wherever it is needed, which suits a regional disaster that has taken out the area rather than the building.
- Cloud recovery: DRaaS, IaaS or BaaS, trading standing cost for consumption cost, with capacity provisioned on demand.
- Reciprocal agreement: a mutual arrangement to host each other’s processing. Cheap on paper, and weak in practice, because it depends on the other party having spare capacity at the moment you need it.
- Hybrid: critical systems recovered on premises, everything else recovered to cloud, which is where most real programmes settle.
How the CISSP Exam Tests Recovery Sites
The exam describes the requirement instead of naming the site. A scenario that mentions real-time replication to a standby facility has already said hot site. One that gives a recovery window of several days against a constrained budget has already said cold site. Read for the readiness being described, and treat cost as the distractor: it is the reason a wrong answer looks sensible, never the reason a right answer is right.
Recovery site scenarios are worth drilling until that mapping is automatic. Our CISSP practice tests put you in front of the wording the exam actually uses, where the site type is implied by the numbers and never stated.