Governance, access control, and risk: a conceptual framework for data integrity in Malaysian educational systems

This study proposes a standards-based framework that links governance, access control, and risk to data integrity in Malaysian education. Governance maturity strengthens access-control effects, while risk management acts independently on integrity. Constructs map to ISO/IEC 27001:2022, ISO 31073:2022, and NIST CSF 2.0 (Govern). We specify a small indicator set—MFA coverage, standing-privilege hours, orphan-account rate, hash-mismatch rate, and detect-to-correct time—and a prioritised roadmap for MOE. Validation will use pre-post or difference-in-differences pilots; moderation will be tested with SEM or multilevel models.