10th WorldS4 2026

Authors - Rodrigo Del Pozo Durango, Moises Toapanta T., Antonio Orizaga T., Rocio Maciel A., Victor Larios Rosillo, Jeanette Elizabeth Jordan Buenano, María Cristina Espin Melendez, Santiago Vayas Castro, Pamela Toapanta Pavon, Andres Hermann-Acosta
Abstract - Cybersecurity governance in Higher Education Institutions (HEIs) in Ecuador faces persistent challenges: Information and Communication Technologies are regarded merely as operational tools, without adequate integration of international standards or a legal foundation within institutional processes. This situation generates high vulnerability to threats such as phishing, ransomware, and data breaches. The objective of this research is to define an integrated model for cybersecurity governance, public administration, and legal foundations for an HEI in Ecuador. A deductive method with a mixed quantitative–qualitative approach was employed, structured into four phases: systematic literature review indicator design, model construction, and scenario simulation. The main result is an integrated model structured into three hierarchical and interrelated levels: the Technical Level, comprising incident management, security infrastructure, and technological maturity, aligned with NIST CSF 2.0 and EGSI v3.0; the Administrative Level, focused on ICT strategic planning, organizational governance, and continuous improvement, based on COBIT 2019; and the Legal Foundation Level, grounded in the 2024 Constitution, the 2026 Organic Law on Cybersecurity, the 2021 Organic Law on Personal Data Protection, and the 2025 Comprehensive Organic Criminal Code. The model incorporates 15 weighted indicators and was validated through simulation across four scenarios, using an optimality threshold of ≥ 75 points. It is concluded that three-dimensional integration technical, administrative, and legal is a necessary condition for Ecuadorian HEIs to achieve ICT strategic alignment, resource optimization, and digital resilience, thereby positioning them as key actors in national cybersecurity public policy.