Public Governance of Cybersecurity in Higher Education Institutions: Legal and Institutional Foundations for Sustainable Digital Transformation in Ukraine
Keywords:
regulatory coordination, organisational accountability, resilience planning, sectoral policy integration, management responsibility, information protectionAbstract
Legal and organisational structures in higher education must reconcile the sector's security with its capacity to develop sustainably. This article asks how legal rules and institutional governance can support cybersecurity as a condition of sustainable digital transformation in Ukrainian universities. A qualitative documentary and comparative policy design was applied to a purposive corpus of 30 sources (19 peer-reviewed articles, 11 official legislative, strategic and policy documents), coded against five governance dimensions: legal mandate, distribution of institutional responsibility, inter-organisational coordination, university-level arrangements, and the embedding of security requirements in long-term digital development. Ukraine has a comparatively developed national framework for information protection, cybersecurity coordination, critical-infrastructure protection and organisational resilience, but it is not translated into sector-specific requirements for higher education. National roles and coordination are established, whereas it remains only partly defined how and to whom university leaders report, how incident reporting connects to handling, what competences are required, and how resilience is planned. Comparison with selected European instruments shows partial convergence on risk-based security, accountability, information protection and coordination, but weaker sectoral articulation of professional roles, management responsibility, assurance mechanisms and links to technology strategy. The principal conclusion is institutional fragmentation rather than regulatory absence: a sectoral coordination layer is needed to connect national regulation with autonomous university governance, setting minimum standards of organisational responsibility, management accountability, competence, incident coordination, supplier-risk control and continuity planning, without creating a parallel administrative system. The study is confined to documentary evidence and does not assess the effectiveness of practice in individual universities.
Downloads
References
Afolalu, O., & Tsoeu, M. S. (2025). Cybersecurity in higher education institutions: A systematic review of emerging trends, challenges and solutions. Future Internet, 17(12), Article 575. https://doi.org/10.3390/fi17120575
Bongiovanni, I. (2019). The least secure places in the universe? A systematic literature review on information security management in higher education. Computers & Security, 86, 350–357. https://doi.org/10.1016/j.cose.2019.07.003
Boutemeur, J., Lella, I., Bakatsis, I., Chatzichristos, G., Foley, K., Leskinen, J., Otcenasek, J., & Ziolek, D. (2025). ENISA threat landscape 2025. European Union Agency for Cybersecurity. https://doi.org/10.2824/1946374
Carmichael, L. (2026). Crafting a cybersecurity governance ecosystem: Two decades of learning in Estonia. European Policy Analysis, 12(2), Article e70017. https://doi.org/10.1002/epa2.70017
Castro Benavides, L. M., Tamayo Arias, J. A., Arango Serna, M. D., Branch Bedoya, J. W., & Burgos, D. (2020). Digital transformation in higher education institutions: A systematic literature review. Sensors, 20(11), Article 3291. https://doi.org/10.3390/s20113291
Chornomydz, A. V. (2025). Faculty information security in higher education institutions amidst martial law: Challenges and practical guidelines. Medical Education, (2), 67–71. https://doi.org/10.11603/m.2414-5998.2025.2.15490
Cotta, B., & Righettini, M. S. (2026). Governing cybersecurity in the digital age: Mapping comprehensive policy mixes with the Nodality-Authority-Treasure-Organization lens. Review of Policy Research, 43(4), Article e70113. https://doi.org/10.1111/ropr.70113
European Commission. (2020). Digital Education Action Plan 2021–2027: Resetting education and training for the digital age (COM(2020) 624 final). https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52020DC0624
European Parliament & Council of the European Union. (2016). Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Official Journal of the European Union, L 119, 1–88. https://eur-lex.europa.eu/eli/reg/2016/679/oj
European Parliament & Council of the European Union. (2019). Regulation (EU) 2019/881 of 17 April 2019 on ENISA and on information and communications technology cybersecurity certification and repealing Regulation (EU) No 526/2013 (Cybersecurity Act). Official Journal of the European Union, L 151, 15–69. https://eur-lex.europa.eu/eli/reg/2019/881/oj
European Parliament & Council of the European Union. (2022). Directive (EU) 2022/2555 of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive). Official Journal of the European Union, L 333, 80–152. https://eur-lex.europa.eu/eli/dir/2022/2555/oj
European Union Agency for Cybersecurity. (2022). European Cybersecurity Skills Framework (ECSF). https://doi.org/10.2824/859537
Farias-Gaytan, S., Aguaded, I., & Ramirez-Montoya, M.-S. (2023). Digital transformation and digital literacy in the context of complexity within higher education institutions: A systematic literature review. Humanities and Social Sciences Communications, 10, Article 386. https://doi.org/10.1057/s41599-023-01875-9
Fernández, A., Gómez, B., Binjaku, K., & Meçe, E. K. (2023). Digital transformation initiatives in higher education institutions: A multivocal literature review. Education and Information Technologies, 28(10), 12351–12382. https://doi.org/10.1007/s10639-022-11544-0
Gkrimpizi, T., Peristeras, V., & Magnisalis, I. (2023). Classification of barriers to digital transformation in higher education institutions: Systematic literature review. Education Sciences, 13(7), Article 746. https://doi.org/10.3390/educsci13070746
Imbaquingo-Esparza, D., Díaz, J., Ron Egas, M., Fuertes, W., & Molina, D. (2022). Information security at higher education institutions: A systematic literature review. In J. Herrera-Tapia, G. Rodriguez-Morales, E. R. Fonseca C., & S. Berrezueta-Guzman (Eds.), Information and communication technologies: 10th Ecuadorian Conference, TICEC 2022, Manta, Ecuador, October 12–14, 2022, proceedings (pp. 294–309). Springer. https://doi.org/10.1007/978-3-031-18272-3_20
Kobis, P., Kisiołek, A., Karyy, O., Pawliczek, A., & Chmielarz, G. (2024). Selected aspects of information security in e-marketing activities of higher education institutions in Poland, Ukraine and the Czech Republic. Procedia Computer Science, 246, 4617–4626. https://doi.org/10.1016/j.procs.2024.09.326
Kuerbis, B., & Badiei, F. (2017). Mapping the cybersecurity institutional landscape. Digital Policy, Regulation and Governance, 19(6), 466–492. https://doi.org/10.1108/DPRG-05-2017-0024
Merchan-Lima, J., Astudillo-Salinas, F., Tello-Oquendo, L., Sanchez, F., Lopez-Fonseca, G., & Quiroz, D. (2021). Information security management frameworks and strategies in higher education institutions: A systematic review. Annals of Telecommunications, 76(3–4), 255–270. https://doi.org/10.1007/s12243-020-00783-2
Nashynets-Naumova, A. Y., Buriachok, V. L., Korshun, N. V., Zhyltsov, O. B., Skladannyi, P. M., & Kuzmenko, L. V. (2020). Technology for information and cyber security in higher education institutions of Ukraine. Information Technologies and Learning Tools, 77(3), 337–354. https://doi.org/10.33407/itlt.v77i3.3424
Nuñez, M., Palmer, X.-L., Potter, L., Aliac, C. J., & Velasco, L. C. (2023). ICT security tools and techniques among higher education institutions: A critical review. International Journal of Emerging Technologies in Learning, 18(15), 4–22. https://doi.org/10.3991/ijet.v18i15.40673
Othman, Z. (2023). Sustainability of higher education institutions: Case study on cyber attacks. Global Business Management Review, 15(1), 24–38. https://doi.org/10.32890/gbmr2023.15.1.2
President of Ukraine. (2021, August 26). Decree No. 447/2021 on the decision of the National Security and Defense Council of Ukraine of 14 May 2021 "On the Cybersecurity Strategy of Ukraine". https://zakon.rada.gov.ua/laws/show/447/2021
Salam, M., Abu Bakar, K. A., Abdul Ghani, A. T., & Mohd Aman, A. H. (2026). Cybersecurity in higher education institutions digitalisation: Addressing threats and vulnerabilities. SAGE Open, 16(1). https://doi.org/10.1177/21582440251413473
Savaş, S., & Karataş, S. (2022). Cyber governance studies in ensuring cybersecurity: An overview of cybersecurity governance. International Cybersecurity Law Review, 3(1), 7–34. https://doi.org/10.1365/s43439-021-00045-4
Singun, A. (2025). Unveiling the barriers to digital transformation in higher education institutions: A systematic literature review. Discover Education, 4, Article 37. https://doi.org/10.1007/s44217-025-00430-9
Verkhovna Rada of Ukraine. (1994, July 5). Law of Ukraine No. 80/94-VR on protection of information in information and communication systems [as amended]. https://zakon.rada.gov.ua/laws/show/80/94-%D0%B2%D1%80
Verkhovna Rada of Ukraine. (2014, July 1). Law of Ukraine No. 1556-VII on higher education [as amended]. https://zakon.rada.gov.ua/laws/show/1556-18
Verkhovna Rada of Ukraine. (2017, October 5). Law of Ukraine No. 2163-VIII on the basic principles of cybersecurity in Ukraine [as amended]. https://zakon.rada.gov.ua/laws/show/2163-19
Verkhovna Rada of Ukraine. (2021, November 16). Law of Ukraine No. 1882-IX on critical infrastructure [as amended]. https://zakon.rada.gov.ua/laws/show/1882-20
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Herasym Dei (Author)
This work is licensed under a Creative Commons Attribution 4.0 International License.
All papers are published under the terms of the Creative Commons Attribution 4.0 International License (CC BY 4.0).
Authors retain copyright and grant ESS Press the right of first publication.
This license permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are properly credited.
