There are various types of disasters and no one can expect when they will occur. IT disaster recovery plan (ITDRP) became one of the most important contingency plans for organizations in the event of disasters. Organizations started realizing the importance of having IT Disaster recovery plan but many hesitate to apply this plan before a disaster occurs. However, even when the importance of ITDRP is acknowledged in the IS field, most scholarly work has focused on the process and strategies while briefly looking at the challenges and benefits of the DRP. This paper aims to investigate the most common challenges associated with having an effective ITDRP and the opportunities associated with this plan. A qualitative study was conducted which consists 6 interviews within several organizations which have developed an ITDRP. The results show that top management support, staff issues, maintenance, and disaster recovery sites are the main challenges organizations face during DRP. While the benefits were data protection, reducing the interruption for business functions, enhancing the reliability for staff and IT services and speeding up the decision-making process.

This research has public technological higher education institutes as a case study, which proposes an IT risk management model to guarantee the continuity of the service in its main processes, where 3 public institutes were analyzed to determine the current state of the processes of those institutes, obtaining as results that the IT areas have not identified the risks to which the institutions are exposed and they do not have a strategic IT plan, which generates that within the institutes there is no improvement in their organizational processes. The model is based on the harmonization of standards or frameworks that refer to risk management, which were analyzed in a general way to determine the impact on IT risk management to guarantee the service continuity in the organizational processes, of which only 3 were selected from a list of 6. The model was validated through expert judgment, which was based on the indicators of sufficiency, clarity, coherence and relevance to give the validity and acceptance of the proposed model. Finally, the model was applied in an institute which allowed it to improve IT risk management and guarantee the continuity of the service of its organizational processes, through compliance with the CBC licensing requirements.