Traceable Privacy and Cybersecurity Compliance Control Baseline for Indonesian Academic Information Systems

Academic information systems process student identities, academic records, library transactions, authentication logs, learning analytics, and third-party service integrations. In Indonesia, privacy and cybersecurity compliance is difficult to operationalize because legal obligations are often separated from system risks, IT governance controls, ownership, and audit evidence. This study develops a traceable privacy and cybersecurity compliance control baseline for Indonesian academic information systems. The method applies structured literature-based conceptual synthesis and design science-inspired artifact development through source selection, concept coding, framework reconciliation, regulatory mapping, control mapping, and ex-ante conceptual evaluation. The evidence base consists of 55 academic, regulatory, framework, and design science sources. The results produce a five-layer governance model, framework reconciliation protocol, Indonesian regulatory mapping, privacy and cybersecurity risk-control-evidence matrices, an audit evidence schema, and an implementation roadmap. The contribution is an initial control-oriented governance baseline for aligning privacy obligations, cybersecurity safeguards, accountable ownership, and audit preparation. The model is conceptual and requires future expert validation and institutional case evaluation.