“Development of an Integrated Information Security Governance Maturity Assessment Framework for Higher Education Institutions Using COBIT 2019 and ISO/IEC 27001: A Design Science Research Approach”

Abstract

The adoption of digital technologies, online learning platforms, and electronic services has significantly changed the functioning of higher education institutions. Universities and colleges now rely extensively on digital platforms for teaching, learning, research, and administrative functions. As a result, these institutions manage large quantities of sensitive data, including student records, financial information, research findings, and other vital assets. In parallel, the rise in cybersecurity threats has underscored the necessity for enhanced information security governance to protect these resources and ensure secure and efficient technology use across campuses. Although established frameworks such as COBIT 2019 and ISO/IEC 27001 offer valuable guidance on governance and information security management, they are often implemented independently. This separation can cause gaps, overlaps, and inconsistencies in governance practices. To address this issue, this study developed an Integrated Information Security Governance Maturity Assessment Framework specifically for Higher Education Institutions by merging the governance principles of COBIT 2019 with the information security management demands of ISO/IEC 27001. The research employed a Design Science Research (DSR) methodology to develop a framework that is robust in theory and applicable to the higher education sector. This framework was built through a comprehensive analysis of COBIT 2019, ISO/IEC 27001:2022, relevant academic sources, and existing governance maturity models. The resulting framework encompasses five assessment dimensions: Governance and Leadership, Risk and Compliance Management, Security Operations and Control Management, Monitoring and Performance Evaluation, and Continuous Improvement and Governance Optimization. Additionally, a five-level maturity model was crafted to enable institutions to evaluate their current governance capability and identify areas needing further development. Findings indicate that integrating COBIT 2019 and ISO/IEC 27001 results in a more systematic and thorough approach to information security governance. The framework provides higher education institutions with a practical tool for assessing governance maturity, planning improvement efforts, and enhancing cybersecurity governance. It also lays the groundwork for further implementation, testing, and empirical validation in real university settings.