Craig Lowenthal’s painful point of reference in the evolution of disaster recovery among U.S. businesses during the seven years since September 11, 2001, is seared in his memory.

He recalls instantly the explosions that rocked a clear, late-summer day in Lower Manhattan and the frantic scramble of IT colleagues at a former employer of his, running for their lives from a burning 7 World Trade Center—with backup tapes in their pockets.

Disaster recovery shot to the top of everyone’s consciousness after that day, says Lowenthal, now CIO of New York commercial insurer NYMAGIC Inc. Thousands of businesses were crippled or had to close in spite of their own desperate scramble to recover from the sudden, catastrophic attack.

And although disaster recovery technologies and strategies have grown, so have the questions about which strategy is best for individual companies. For instance, which is best: a “hot” site, a “cold” site or something in between? Some IT leaders say they prefer hot sites, where, at a minimum, they have hardware and software systems at a remote location to recover data and resume business if disaster strikes their primary data centers.

Cold sites, which may offer physical space only and perhaps some shared hardware, are less expensive but offer longer recovery times than hot sites. Demand for some type of remote disaster recovery site, says Michael Green, CIO of national law firm Nixon Peabody LLP, has forced most IT organizations to invest more to protect their data centers.

“It’s really become the cost of doing business,” Green says. “Our clients expect that their data is going to be available in a reasonable amount of time if there’s a problem.”

Nixon Peabody—with some 700 attorneys nationwide—houses its disaster recovery infrastructure in leased space at a LexisNexis data center in Ohio.