Photo by FlyD on Unsplash
The academic information system (SIAKAD) stores the most sensitive things on campus: student identities, grade history, study status, and payment data. When the system goes down during study plan enrollment, grades change without a trace, or student data leaks, the impact is felt immediately in services and reputation. That is why SIAKAD security deserves a place in the SPI's audit plan.
This article covers the relevant legal basis, main risks, example audit tests, and steps for preparing a security audit program for SIAKAD and student data. References were checked as of October 21, 2026.
What Rules Form the Basis for SIAKAD Security?
| Reference | Relevant provisions |
|---|---|
| Law 27/2022 on Personal Data Protection, Articles 35 to 39 | Personal data controllers must protect and ensure the security of the data they process, keep it confidential, oversee parties involved in processing, protect against unauthorized processing, and prevent unauthorized access with a reliable, secure, and accountable security system |
| Law 27/2022 Article 46 | If personal data protection fails, written notification no later than 3 x 24 hours to the data subject and the agency, stating the data disclosed, when and how it was disclosed, and the handling and recovery efforts |
| Law 27/2022 Article 57 | Violations of a number of obligations are subject to administrative sanctions in the form of a written warning, temporary suspension of processing, deletion or destruction of data, and/or an administrative fine |
| Government Regulation 71/2019 Articles 3, 4, and 24 | Every electronic system operator must run the system reliably and securely, protect the availability, integrity, authenticity, confidentiality, and accessibility of information, and have procedures and means of security against disruptions, failures, and losses |
| GIAS 2024 and IIA Topical Requirements | Topical Requirements must be met by auditors when the scope of an engagement covers a regulated topic. Cybersecurity has applied since February 5, 2026 and Third-Party since September 15, 2026. |
Law 27/2022 took effect when it was promulgated on October 17, 2022, and Article 74 gave an adjustment period of at most two years, so that period has passed. Personal data is divided into specific data and general data. Specific data includes health data, children's data, and personal financial data (Article 4). In campus practice, such data may be found in SIAKAD, health services, and payment data, depending on what is collected.
Article 53 of Law 27/2022 requires appointing a personal data protection officer or staff in certain cases, including processing for public service purposes. Whether your campus is covered and who is appointed should be determined based on the type and function of the university and legal advice. A general discussion of personal data protection compliance audits is in the article guide to auditing compliance with the Personal Data Protection Law.
What Are the Main Risks in SIAKAD and Student Data?
| Area | Example risk | Example audit test |
|---|---|---|
| Access management | Excessive access rights, accounts of staff who have moved still active, shared accounts | Compare the user list with personnel data, review access rights against segregation of duties, test inactive accounts |
| Integrity of grades and academic data | Grades or study status changed without authorization | Trace change logs, compare grades in the system with source files, test approval of grade changes |
| Audit trail | Logs not recorded, easily deleted, or not reviewed | Check the logging configuration, log protection, and evidence of regular review. The article audit trail discusses the basic concept. |
| Availability | System inaccessible during study plan enrollment or new student admission, backups cannot be restored | Review the recovery plan, recovery test results, and incident records |
| Personal data protection | Excessive data exports, data stored indefinitely, data shared without a basis | Map data flows, check the basis for processing, retention periods, and export restrictions |
| Third parties | Vendors or developers have broad access without oversight | Review agreements, vendor access rights, and oversight under Article 37 of Law 27/2022 |
| System changes | Updates installed without testing or approval | Check the change request, testing, and approval procedures before release |
| Payment | Payment and billing status do not match bank accounts, status can be changed manually | Reconcile SIAKAD billing data with cash receipts |
This table is an illustration. Details are adjusted to your campus's system architecture, whether built in-house, purchased, or cloud-based.
What Are the Steps to Prepare a SIAKAD Security Audit Program?
- Understand the system. Map the modules, databases, integrations with other systems, hosting, administrators, and vendors.
- Identify the data. List the types of data processed, including specific data, and who receives it.
- Set the criteria. Law 27/2022, Government Regulation 71/2019, the campus's information security policy, and any frameworks adopted.
- Assess risk and set the scope. Prioritize the grade module, finance, and administrator access.
- Involve the right expertise. For in-depth technical testing, use information technology auditors or experts. The articles Information Systems audit and audit IT discuss the general approach.
- Test the controls. Access, changes, logs, backups, encryption, and incident management.
- Review incident readiness. Make sure there are procedures that allow notification within 3 x 24 hours under Article 46, and the obligation to report serious disruptions to law enforcement and relevant ministries or agencies under Article 24 paragraph (3) of Government Regulation 71/2019.
- Report and monitor follow-up. Present findings by risk priority, then monitor improvements until complete.
How Does This Relate to IIA Topical Requirements?
The GIAS states that internal auditors must meet the relevant requirements when the scope of an engagement covers one of the established topics. The Cybersecurity Topical Requirement has applied since February 5, 2026, and Third-Party since September 15, 2026. A SIAKAD security audit engagement, including vendor management, may touch both. The list and dates can change, so check the IIA Topical Requirements page. A summary of applying the standards for campus SPIs is in the article GIAS 2024 for university SPIs.
What Are Common Mistakes in SIAKAD Audits?
- Only assessing policy documents. Controls are not tested on the running system.
- Ignoring third parties. Vendors and developers have broad access but are not in scope.
- Skipping logs. Grade changes cannot be traced because logs do not exist or are not reviewed.
- Not testing recovery. Backups exist but have never been tried for recovery.
- Exceeding competence. Auditors give technical conclusions without adequate expertise.
How Does Internal Audit Software Help?
Audithink is not a penetration testing tool, vulnerability scanner, or information security system. For the SPI, Audithink helps manage audits through six main features: risk assessment, audit planning based on risk assessment, work program templates for each engagement, deadline notifications, monitoring of recommendation follow-ups, and automated reports. Related software is discussed in the article information system audit application. Campus audit needs are discussed on the page Audithink for Educational Institutions.
FAQ About Security Audits of Academic Information Systems
Does the Personal Data Protection Law apply to universities?
Law 27/2022 regulates personal data controllers in general. A campus that processes the personal data of students, lecturers, and education staff acts as a data controller. The detailed application depends on the type and function of the campus, so it should be reviewed together with the legal unit.
What is the notification deadline if personal data is leaked?
Article 46 of Law 27/2022 requires written notification no later than 3 x 24 hours to the data subject and the agency, with the minimum content set out in that article.
What are the sanctions for violating personal data security obligations?
Article 57 provides administrative sanctions in the form of a written warning, temporary suspension of processing activities, deletion or destruction of personal data, and/or an administrative fine. The law also contains criminal provisions in a separate chapter.
Must the SPI have an information technology auditor?
There is no standard rule. For in-depth technical testing, the SPI can train its auditors, work with an information technology unit that is independent of the audited object, or use experts. The standards require adequate competence for the engagements accepted.
Which modules should be prioritized?
Generally the grade and study status module, the finance or billing module, and administrator access, because changes there have a large impact on students and campus finances. Decide based on the risk assessment at your campus.
Is the SIAKAD vendor within the audit scope?
Preferably yes, at least in terms of the agreement, access rights, and oversight. Article 37 of Law 27/2022 requires the data controller to oversee parties involved in processing personal data under its control.
Conclusion
SIAKAD security is not just the business of the information technology unit. The rules on personal data and electronic systems make it the campus's institutional responsibility, and the SPI's role is to make sure the controls actually work. Start with access, grade changes, audit trails, and third parties.
If the SPI at your campus wants to plan information system audits and monitor follow-up more neatly, schedule an Audithink demo.
