An Integrated University Digital Transformation Model Combining IT Governance, Interoperability, Cloud Security Assessment and Data Analytics: The UTMACH Case in Ecuador

Abstract

Digital transformation in higher education requires integrated designs connecting strategy, governance, infrastructure, interoperability, applications, cybersecurity, accessibility, analytics, and continuous improvement. This study analyzes the Integrated University Digital Transformation Model implemented at Universidad Técnica de Machala, Ecuador, between 2023 and April 2026. A qualitative embedded case study with a design-science orientation examined institutional documents, technical records, governance evidence, cloud migration reports, interoperability mechanisms, system descriptions, analytics outputs, and cloud security assessment records through thematic analysis, process tracing, and artifact evaluation. Findings showed alignment between the Strategic Information Technology Plan and institutional planning; formal IT governance and information security structures; an API- and microservices-based architecture; a staged migration of 52 institutional servers in four operational lots, with documented post-migration monitoring indicating 99.85% average server uptime and no critical incidents attributable to the migration during the monitored period; an automated and traceable admission allocation process within a broader portfolio of integrated academic–administrative systems; and dashboards supporting evidence-informed decisions. MMGSI-Cloud complemented the architecture by assessing governance capabilities, identifying improvement priorities, and linking findings to an institutional roadmap. The case indicates that university digital transformation is strengthened when technological implementation is integrated with formal governance, systematic assessment, evidence-based planning, and institutional accountability.

1. Introduction

Digital transformation has become a central institutional-design challenge in higher education because universities operate simultaneously as knowledge organizations, public service providers, data-intensive systems and socially accountable communities. This challenge cannot be reduced to acquiring technological platforms or converting administrative forms into digital formats.

It requires the reconfiguration of governance structures, academic and administrative processes, organizational culture, infrastructure, and decision-making practices. Digital transformation is therefore understood as an organizational change process through which digital technologies modify institutional capabilities, value creation and stakeholder relationships rather than as a limited episode of technological substitution [1,2].

Public universities face particular difficulties in advancing this transformation. Fragmented systems, duplicated records, manual or partially automated procedures, limited interoperability, resource constraints, regulatory requirements and unequal digital capabilities can restrict the sustainability of technological modernization.

These conditions are especially relevant in Latin American higher education, where institutional transformation must reconcile technological innovation with accountability, inclusion, public-service responsibilities and organizational capacity. Accordingly, this study approached digital transformation as a sociotechnical problem requiring the coordinated integration of strategic alignment, IT governance, technological architecture, data management, cybersecurity and human-centered design [3,4].

The object of study was Universidad Técnica de Machala (UTMACH), a public higher education institution located in Machala, Ecuador. During 2025, the university offered 34 undergraduate degree programs, enrolled 16,295 students, comprised five faculties, and operated across three campuses [5]. These characteristics created a complex academic–administrative environment in which digital integration, service continuity, information traceability, and institutional interoperability became strategic requirements rather than exclusively technical concerns.

The territorial and public character of UTMACH made the case relevant for applied system innovation. The university was examined not as a generic organization, but as a public institution whose digital ecosystem had to support academic services, administrative transparency, regulatory compliance, external evaluation, accessibility and regional development. From this perspective, digital transformation needed to be assessed not only through technological implementation, but also through its contribution to public value, institutional capacity, procedural transparency and service continuity [6].

The objective of this study was to analyze and systematize the Integrated University Digital Transformation Model implemented at UTMACH, with emphasis on strategic IT alignment, institutional governance, interoperability, cloud infrastructure, digital services, information security, accessibility and data analytics.

The study also examined how the subsequent application of a cloud security governance maturity model complemented the institutional transformation by supporting structured assessment, gap identification, evidence consolidation, monitoring, and evidence-based improvement planning. Several foundational cloud, governance, security, and continuity capabilities had already been established before the baseline assessment; however, they were unevenly formalized, incompletely evidenced, inconsistently measured, and not yet integrated into a systematic continuous improvement cycle. The development process, assessment instrument, scoring structure, maturity levels, and initial validation of the maturity model remained outside the scope of this article and are reported in a separate manuscript in preparation.

Accordingly, MITD-UTMACH constitutes the primary research artifact and analytical object of this study. MMGSI-Cloud is not examined as a co-equal model or independently validated artifact in this article; rather, it is analyzed exclusively as an embedded assessment mechanism that complemented the implemented digital transformation architecture by introducing a structured feedback loop between evidence collection, gap identification, improvement planning, monitoring, and strategic review.

The originality of the study lay in connecting strategic IT governance and operational digital transformation with a structured mechanism for continuous cloud security governance assessment. Previous research has frequently examined university digital transformation, cloud adoption, cybersecurity, interoperability or data analytics as separate domains.

Fewer studies have explained how these capabilities can be integrated within a single institutional architecture and complemented by maturity-based evaluation. In the UTMACH case, strategic planning, governance structures, cybersecurity responsibilities, interoperable architecture, process automation, institutional analytics and cloud security assessment were treated as interdependent components of an applied system innovation. This integrated logic was consistent with enterprise governance principles emphasizing strategic alignment, value delivery, accountability and risk optimization [7,8].

The theoretical contribution of MITD-UTMACH therefore does not reside in proposing each architectural layer as an individually novel construct. Rather, it lies in the design relationships established among them. Three mechanisms distinguish the proposed architecture. First, vertical alignment connects institutional strategy and governance decisions with technological architecture, applications, and data-driven management. Second, governance-bound interoperability links technical integration with formal authorization, accountability, security, and data-protection requirements. Third, an evidence-based feedback mechanism connects implemented capabilities with maturity assessment, gap identification, improvement planning, monitoring, and strategic review. Together, these mechanisms transform a set of established digital-transformation capabilities into a closed-loop institutional architecture for implementation and continuous improvement.

From this perspective, the institutional problem involved several interdependent capabilities: reliable and governed information, scalable cloud-enabled infrastructure, interoperable applications, cybersecurity and data protection, human-centered and accessibility-oriented digital services, institutional analytics, and organizational learning. These dimensions are developed in the theoretical framework and were analyzed in the case as mutually reinforcing components of the wider transformation architecture rather than as independent technological initiatives.

Within this institutional transformation, cloud security governance was treated as a cross-cutting capability and MMGSI-Cloud was used exclusively as the embedded assessment and continuous-improvement mechanism described above.

The study was aligned with the interdisciplinary orientation of applied system innovation because it connected higher education administration, information systems, cloud computing, software architecture, cybersecurity, interoperability, data analytics, accessibility and human–computer interaction.

The scientific problem was therefore not limited to determining which technologies had been implemented but involved explaining how heterogeneous organizational and technological components had been designed, governed, integrated, evaluated and improved as part of a coherent institutional system [9,10].

The study combined case-study logic with design-science reasoning. The case-study approach supported the examination of the transformation within its real institutional context, whereas design science enabled the implemented model to be analyzed as an artifact intended to address practical organizational problems and generate transferable design knowledge.

This methodological combination was appropriate because the study reconstructed not only institutional events, but also the architecture, governance mechanisms, implementation decisions, evaluation processes and improvement logic of a deliberately designed system [9,11,12,13]. The study was guided by the following research questions:

• RQ1. How was MITD-UTMACH structured through strategic alignment, institutional governance, technological architecture, institutional applications and data-driven management?
• RQ2. What documented organizational and technological outcomes were associated with the implementation of MITD-UTMACH in terms of continuity, interoperability, automation, traceability, security, accessibility-oriented design and evidence-informed decision-making?
• RQ3. How did the application of MMGSI-Cloud contribute to identifying institutional gaps and supporting continuous improvement within the broader digital transformation architecture?
• RQ4. Which design principles, enabling conditions and limitations of MITD-UTMACH may inform comparable public higher education institutions?

These questions connected contextual description, theoretical interpretation, artifact-oriented analysis and the generation of transferable design knowledge [14,15]. The scientific contribution of the study was not to present UTMACH as a fully mature or exemplary digital university, but to provide a rigorous account of how a public higher education institution designed, implemented, evaluated and progressively improved an integrated digital transformation architecture.

Digital transformation was interpreted as an evolving institutional capability supported by strategic governance, cloud-enabled infrastructure, interoperability, cybersecurity, evidence-informed management and continuous assessment. In this context, the application of a cloud security governance maturity assessment complemented the implemented architecture by supporting evidence-based improvement without constituting the principal object of the article [1,16]. This paper is organized into six sections.

• Following this introduction, Section 2 presents the theoretical framework underlying digital transformation, IT governance, interoperability, cloud infrastructure, data analytics, accessibility, cybersecurity and cloud security governance maturity.
• Section 3 describes the qualitative embedded case-study design, the design-science orientation, the documentary corpus and the analytical procedures.
• Section 4 presents the institutional transformation architecture, its documented outputs and the role of maturity assessment in continuous improvement.
• Section 5 discusses the findings in relation to applied system innovation, institutional governance, public value and transferability.
• Section 6 presents the conclusions and directions for future research.

2. Theoretical Framework and Research Model

Digital transformation in higher education is understood as an institutional change process in which digital technologies interact with strategy, governance, organizational culture, infrastructure, data, and decision-making. It extends beyond digitization and process automation because it modifies institutional capabilities, service models, responsibilities and relationships with stakeholders [1,2]. Its outcomes therefore depend not only on technology adoption, but also on complementary capabilities such as leadership, strategic alignment, architecture, data quality, organizational learning, and risk governance [16,17].

This study approached university digital transformation as a sociotechnical and applied system innovation problem. Institutional platforms, cloud services, databases, APIs, dashboards, governance bodies, policies and user practices were analyzed as interdependent components rather than isolated resources.

This perspective supported the interpretation of the Integrated University Digital Transformation Model (Modelo Integrado de Transformación Digital de la UTMACH; MITD-UTMACH) as a deliberately designed institutional artifact whose value depended on the coherence among organizational arrangements, technological architecture and public-service objectives [9,10,18,19].

2.1. IT Governance, Strategic Alignment and Public Value

IT governance refers to the institutional arrangements through which decision rights, accountability mechanisms, priorities and control processes guide the current and future use of information technology. It differs from IT management because governance evaluates, directs and monitors value and risk, whereas management plans and executes services, projects and operations [8,20]. This distinction was central to MITD-UTMACH because the transformation required technology to move from a predominantly operational function toward an institutionally governed capability.

Strategic alignment connected institutional planning, IT strategy, administrative and academic processes and technological infrastructure. In the university context, this alignment was necessary to reconcile competing demands related to teaching, research, student services, accreditation, regulatory compliance and administrative efficiency. The Strategic Information Technology Plan therefore functioned as the mechanism through which institutional objectives were translated into priorities, portfolios, responsibilities and measurable technological initiatives [3,21].

COBIT and related governance approaches provided concepts such as value delivery, risk optimization, accountability, resource optimization and process capability [7,22]. In a public university, however, governance also had to be interpreted through public value. Technology investments were expected to contribute not only to efficiency, but also to transparency, continuity, inclusion, fairness and institutional accountability [6,23].

2.2. Interoperability, Cloud Computing and Service Architecture

Interoperability refers to the capacity of systems, organizations, and data structures to exchange information meaningfully, securely and consistently. In fragmented university environments, it helps address duplicated records, manual validation and inconsistencies across academic, administrative and governmental databases. Its implementation requires not only technical standards, APIs, semantic agreements and access controls, but also legal authorization, data governance and clearly defined institutional responsibilities [24,25].

REST-based services, APIs and microservices provide architectural mechanisms for modularity, integration, scalability and incremental evolution. These approaches are especially relevant in universities because critical systems must change without unnecessarily disrupting academic and administrative services. In MITD-UTMACH, they were interpreted as institutional integration mechanisms rather than as isolated software-development patterns [26,27,28].

Cloud computing complemented this architecture by providing shared resources, elasticity, scalability and service availability. Nevertheless, cloud migration also introduced governance requirements related to security, continuity, cost, vendor dependency, privacy and regulatory compliance. Cloud infrastructure therefore generated institutional value only when it was integrated with risk assessment, monitoring, service management and continuity planning [29,30,31,32].

2.3. Data Analytics, AI-Assisted Processes and Decision Support

Data analytics refers to the transformation of institutional data into descriptive, diagnostic, predictive or prescriptive information that can support monitoring, planning, resource allocation, program evaluation, student services and accreditation. Its institutional value depends on data quality, interoperability, governance, interpretation and responsible use. Dashboards and analytics were therefore considered decision-support infrastructures rather than neutral visualization tools or substitutes for academic and managerial judgment [33,34,35,36].

AI-assisted processes can extend institutional analytics through classification, preliminary validation, pattern detection and information organization. However, their use in higher education introduces risks related to opacity, automation bias, privacy, unequal impact and excessive datafication. Accordingly, AI-assisted functionality was theoretically positioned within human oversight, transparency, proportionality, ethical governance and clearly defined institutional purposes [37,38,39,40].

2.4. Human-Centered Design, Accessibility, Cybersecurity and Trust

Human-centered design requires digital systems to be usable, understandable, inclusive and aligned with users’ tasks and capabilities. In universities, usability and accessibility are not merely interface considerations because barriers in navigation, interaction or content can become barriers to academic and administrative participation. UX/UI and accessibility-oriented practices were therefore interpreted as components of institutional service quality and digital inclusion [41,42,43,44].

Cybersecurity and data protection are equally necessary because university systems process personal, academic, employment, research and administrative information. ISO/IEC 27001, the NIST Cybersecurity Framework and data-protection principles emphasize governance, risk management, protection, detection, response, recovery, accountability and continuous improvement [24,45,46]. Security was consequently treated as an enabling condition for digital transformation and institutional trust rather than as a peripheral technical control.

The framework connected digital transformation, IT governance, interoperability, cloud architecture, analytics, human-centered design and cybersecurity as mutually dependent components. This integrated perspective explained how heterogeneous institutional and technological capabilities could be organized within MITD-UTMACH as an applied system innovation [1,9,12].

2.5. Cloud Security Governance Maturity and Continuous Improvement

Cloud security governance maturity refers to the extent to which an organization has institutionalized documented, repeatable, monitored, evidence-based and continuously improved practices for governing cloud-related security risks. Cloud adoption alone does not demonstrate maturity because infrastructure and security tools do not necessarily imply formal accountability, consistent controls, regulatory alignment, continuity planning or systematic monitoring [7,22,45,46].

In university environments, cloud security governance is a cross-cutting capability spanning strategy, governance, technological architecture, institutional applications and data management. Weaknesses in decision rights, risk assessment, technical controls, compliance, evidence management or continuity can affect the reliability and legitimacy of the wider digital ecosystem [20,22,45].

MMGSI-Cloud was used in the UTMACH context as a structured assessment mechanism for identifying institutional capabilities, gaps and improvement priorities. In this article, the digital transformation model represented the institutional architecture and implementation process, whereas MMGSI-Cloud functioned as an embedded evaluation mechanism. Their integration established a feedback cycle connecting implementation, assessment, gap identification, improvement planning, monitoring and strategic review [7,9,12] (see Table 1).

Table 1. Conceptual variables supporting the MITD-UTMACH model.

Variable	Theoretical Emphasis	Institutional Expression
Digital transformation	Organizational redesign through digital technologies.	Shift from fragmented systems to integrated ecosystem.
IT governance	Decision rights, accountability, value, risk.	IT Committee, Information Security Committee, Information Security Officer and Data Protection Delegate.
Interoperability	Secure exchange of meaningful data.	APIs, microservices, public data interoperability.
Data analytics and AI-assisted processes	Evidence-informed and responsible decision support.	Institutional dashboards and selected AI-assisted support for organizing, preliminarily validating, and visualizing academic-production information.
UX and accessibility	Human-centered, usable and inclusive digital services.	UX/UI improvements and accessibility-oriented design criteria.
Cybersecurity and digital trust	Risk-based protection, accountability, privacy, response and continuity.	Security governance, risk management, data-protection roles and security controls.
Cloud security governance maturity	Institutionalization, evidence, monitoring, gap identification and continuous improvement.	Application of MMGSI-Cloud as an assessment and improvement mechanism.

The existence of cloud infrastructure, governance bodies, security roles, or technical controls was not interpreted as equivalent to advanced maturity. In the MMGSI-Cloud assessment, maturity depended on whether practices were consistently formalized, evidenced, measured, periodically reviewed, and connected to continuous improvement. This distinction was essential for understanding how previously established institutional capabilities could coexist with a moderate baseline maturity level and subsequently support faster improvement.

3. Materials and Methods

The study used a qualitative, embedded case-study design with a design-science orientation. This methodological decision was appropriate because the research examined a contemporary institutional transformation within its real-life context and reconstructed the digital transformation model as a designed artifact that addressed practical problems. The case-study component supported contextual understanding, while design science supported the analysis of the model’s architecture, utility and transferability. The study therefore combined interpretive depth with artifact-oriented explanation [9,11].

UTMACH was purposively selected as an information-rich and theoretically relevant single case with revelatory characteristics rather than as a statistically representative or typical university. Its analytical value derived from the opportunity to examine, through longitudinal documentary and technical evidence, the coordinated implementation of strategic IT governance, cloud migration, interoperability, institutional applications, information security, analytics, and continuous assessment within the same public higher education institution. The case also provided access to evidence generated across several stages of an implemented transformation process, allowing relationships among governance decisions, technological changes, organizational capabilities, and subsequent assessment activities to be reconstructed over time. UTMACH comprised five faculties, 34 undergraduate degree programs, 16,295 enrolled students in 2025, and three campuses, providing sufficient organizational and technological complexity for examining the phenomenon. Case selection was therefore based on theoretical relevance, evidence richness, longitudinal accessibility, and explanatory potential rather than statistical representativeness [11,13,47].

The primary unit of analysis was the Integrated University Digital Transformation Model implemented at UTMACH, hereafter MITD-UTMACH. The embedded units included strategic planning, IT governance structures, cloud infrastructure, interoperability architecture, institutional applications, information security, user experience, accessibility, data analytics and continuous governance evaluation.

The application of MMGSI-Cloud was analyzed as an embedded assessment mechanism within the broader institutional transformation rather than as the primary research artifact of this article. This embedded case structure enabled the study to examine how the organizational, technological, security and evaluative components interacted within the wider transformation process [11,47]. The temporal scope of the case extended from 2023 to April 2026. The principal governance, infrastructure, interoperability, application, cybersecurity, and data-analytics initiatives were progressively planned and implemented from 2023 onward. The MMGSI-Cloud baseline diagnosis and roadmap definition were conducted in June and July 2025, followed by the implementation and improvement follow-up from August 2025 to April 2026. The subsequent final reassessment falls outside the temporal boundary of this case reconstruction and is reported in the separate MMGSI-Cloud manuscript. This temporal distinction separates the earlier development of enabling institutional capabilities from the subsequent maturity-assessment and improvement process.

The research adopted a reconstruction strategy. The institutional transformation had already been implemented through a sustained period of technological management and the study retrospectively analyzed the documents, decisions, outputs and evidence generated during that process. This approach was suitable because the objective was not to test a preexisting experimental intervention but to systematize an implemented model, identify its layers and interpret its institutional effects. Retrospective case reconstruction required careful triangulation to reduce selective memory and promotional bias [48,49].

3.1. Data Sources, Documentary Corpus and Inclusion Criteria

The final analytical corpus comprised 72 institutional documentary and technical records produced primarily between 2023 and April 2026. The documentary-selection process initially identified 98 records. After removing 14 duplicated or superseded records and excluding 12 additional materials that did not meet the predefined analytical inclusion criteria, 72 records were retained in the final corpus. The retained records were subsequently organized into 14 evidence categories (E01–E14), covering strategic planning; governance and information security; infrastructure and interoperability; institutional applications and processes; analytics and selected AI-assisted functionality; accessibility; and maturity assessment and improvement planning. Supplementary Table S1 reports the composition, temporal coverage, and selection outcome of the records associated with each evidence category.

Documents and technical records were included when they met at least one of the following criteria: they formally defined an institutional governance structure or role; documented a technological implementation; provided evidence of cloud migration, interoperability, automation, cybersecurity, accessibility or analytics; recorded an institutional decision or approval; or supported the reconstruction of a documented outcome. Duplicated, superseded, purely promotional or technically unverifiable materials were excluded from the analytical corpus.

Selection was conducted at the level of individual documentary or technical records rather than at the level of evidence categories. A record was retained when it originated from an identifiable institutional or external source, was directly relevant to at least one research question or MITD-UTMACH layer, and contained sufficient temporal and contextual information to support analytical interpretation. When multiple versions of the same record existed, only the most complete or institutionally valid version was retained. Records were excluded when they were duplicates, superseded versions, purely promotional materials, outside the analytical scope, insufficiently verifiable, or did not provide additional analytical evidence.

The documentary corpus was organized through a traceability matrix identifying the evidence type, institutional origin, time period, MITD-UTMACH layer, analytical purpose and contribution to the study. Confidential records were described through evidence codes and documentary categories rather than reproduced when disclosure could expose restricted operational, security, governance or personal information (see Table 2).

Table 2. Documentary and technical evidence used in the reconstruction of the MITD-UTMACH model.

Evidence ID	Documentary or Technical Evidence	Institutional Origin	Time Period	MITD- UTMACH Layer	Analytical Purpose	Main Contribution to the Study
E01	Strategic Information Technology Plan (PETI)	Strategic Planning and Information Technology Directorate	July 2024	Strategic Alignment	Assess PETI–institutional alignment.	Linked IT priorities to institutional objectives.
E02	Institutional Development Plan (PEDI) and related planning documents	Rectorate/Institutional Planning Office	2023	Strategic Alignment	Verify institutional planning coherence.	Confirmed digital transformation within institutional planning.
E03	IT Committee documentation (resolutions, minutes and governance records)	IT Committee	2023–April 2026	Governance and management	Assess decision rights and accountability.	Documented formal IT-governance arrangements.
E04	Information Security Committee records and security governance documentation	Information Security Committee	April 2024	Governance and management	Assess security governance and responsibilities.	Documented formal security-governance mechanisms.
E05	Information Security Scheme (EGSI) documentation, policies and procedures	Information Technology Directorate	April 2025	Governance and Management	Assess institutional security controls.	Documented governance-oriented cybersecurity practices.
E06	Cloud migration and infrastructure deployment records, including staged-migration, continuity, rollback, and post-migration monitoring evidence	Infrastructure and Technology Unit	2 September–10 October 2024	Technological Architecture	Assess migration, continuity, rollback, and monitoring.	Documented the four-lot migration of 52 servers, continuity safeguards, 99.85% server uptime, and no critical migration-attributable incidents.
E07	API Gateway endpoint inventory, interoperability documentation, microservices specifications, and integration-security and logging records	Software Development and Systems Integration Unit	2023–2025	Technological Architecture	Assess interoperability architecture and controls.	Documented 61 API endpoints, six integration modules, eight service domains, and security/logging controls.
E08	Institutional systems documentation, including SIUTMACH, SIGEDA, EVEA, Help Desk, Research System, Admission System, Scholarship System, Faculty Evaluation System and Employment Services; admission-system user manual, functional records and process documentation	Information Technology Directorate	2023–April 2026	Institutional Applications	Assess applications and automated admission.	Documented integrated applications and a traceable rule-based admission workflow.
E09	Dashboards, institutional analytics reports and decision-support reports	Institutional Planning and Information Technology Directorate	2024–April 2026	Data-driven Management	Assess analytics for institutional management.	Documented evidence-informed decision support.
E10	Documentation of selected AI-assisted institutional knowledge-management processes, particularly the organization, preliminary validation, and visualization of academic-production records	Information Technology Directorate	2024–April 2026	Data-driven Management	Assess bounded AI-assisted processing and human oversight.	Documented AI-assisted processing without autonomous institutional decisions.
E11	Accessibility guidelines, UX/UI redesign documentation and usability improvement records	Information Technology Directorate	2023–April 2026	Cross-cutting Capability	Assess accessibility-oriented and user-centered design.	Documented UX/accessibility-oriented improvements.
E12	MMGSI-Cloud institutional assessment evidence, maturity reports and improvement roadmap	Research Project/Information Technology Directorate	June 2025–April 2026	Continuous Assessment and Improvement	Assess maturity-based continuous improvement.	Documented gap identification and evidence-based improvement planning.
E13	DINARP authorization for UTMACH access to public interoperability services	Dirección Nacional de Registros Públicos (DINARP)	December 2024	Technological Architecture	Assess the governance basis of public interoperability.	Documented authorized purpose, scope, responsibilities, and security/data-protection conditions.
E14	Prosecutor’s Office review of the automated admission allocation process conducted within an investigation	Fiscalía General del Estado (Ecuador)	January 2026	Institutional Applications	Assess external reviewability of admission allocation.	Documented external review with no observations within the reviewed scope.

Table 2 summarizes the principal documentary and technical sources used to reconstruct the MITD-UTMACH model. Rather than functioning as isolated records, the sources were analyzed collectively to identify relationships among institutional governance, technological architecture, interoperability, cloud infrastructure, information security, applications, data analytics and continuous improvement.

The matrix strengthened methodological transparency by explicitly linking each evidence source with its institutional origin, analytical purpose, architectural layer and contribution to the reconstruction of the case. The data sources also included evidence of core digital systems such as the institutional academic platform, virtual learning environment, documentary management system, Help Desk, scholarship modules, employment services, faculty evaluation tools, research information system and admission automation.

These systems were treated as empirical manifestations of the application layer of the model. The analysis examined how they contributed to traceability, transparency, automation, accessibility and institutional decision-making rather than merely listing them as technological products [50,51].

Evidence E08 documented the implementation and institutional operation of the automated admission allocation system, whereas E14 corresponded to a distinct external documentary source generated through a review conducted by the Prosecutor’s Office within an investigation. According to the reviewed document, no observations were recorded regarding the automated allocation process within the scope examined. This distinction prevented the institution’s own system documentation from being treated as equivalent to external documentary review evidence.

Evidence E06 included technical records describing the scope, sequencing, continuity safeguards, rollback mechanisms, and post-migration monitoring associated with the migration of 52 institutional servers. The migration was organized into four operational lots according to service type, dependency, and criticality. The evidence covered institutional applications, web and content-management services, databases, e-learning platforms, authentication and directory services, repositories, support services, and infrastructure/monitoring components.

The analysis examined the use of planned maintenance windows, gradual traffic redirection, pre-migration snapshots and backups, service verification, and post-migration monitoring. Monitoring records included network and service availability, web responses, database connectivity, authentication, resource utilization, latency, system/application logs, and reported incidents. A de-identified summary of the migration sequence and operational controls is provided in Supplementary Table S3. Server names, network identifiers, detailed configurations, and resource allocations are not reported because they constitute operationally sensitive information. Claims regarding post-migration availability and migration-attributable incidents were restricted to the institutional monitoring and operational records represented by E06 and were not interpreted as evidence from an independent availability audit.

Interoperability evidence was analyzed through two distinct documentary sources. Technical documentation on APIs, microservices, and systems integration was represented by E07, whereas E13 corresponded to the DINARP interoperability authorization. This distinction enabled the study to separate the technical implementation of interoperability from its legal and organizational basis. The analysis examined the authorized institutional purpose, scope of access, responsible organizational units, applicable security and data-protection requirements, and the institutional processes supported by the external data exchange. It also examined whether the implemented mechanisms supported more consistent information exchange and traceable administrative validation, while distinguishing documented capabilities from quantitatively measured performance effects [24,25]. A chronological reconstruction of the principal evidence-supported milestones is presented in Table 3.

Table 3. Chronological reconstruction of key MITD-UTMACH milestones, 2023–April 2026.

Period	Evidence-Supported Milestone	Evidence Source
2023	Institutional planning and progressive development of integrated applications, APIs, microservices, interoperability mechanisms, and UX/accessibility-oriented improvements.	E02, E07, E08, E11
April 2024	Formalization of information security governance through Information Security Committee records and related governance documentation.	E04
July 2024	Consolidation of strategic IT alignment through the Strategic Information Technology Plan (PETI).	E01
2 September–10 October 2024	Staged migration of 52 institutional servers in four operational lots, with continuity, rollback, and post-migration monitoring controls.	E06
December 2024	Formal authorization for UTMACH access to public interoperability services administered by DINARP.	E13
April 2025	Institutionalization of information-security policies and procedures through EGSI documentation.	E05
June–July 2025	MMGSI-Cloud baseline diagnosis, gap analysis, and definition of the improvement roadmap.	E12
August 2025–April 2026	Implementation, monitoring, documentation, and structured follow-up of cloud security governance improvement actions.	E12
January 2026	External review by the Prosecutor’s Office of the automated admission allocation process within an investigation; no observations were recorded regarding the automated process within the reviewed scope.	E14
April 2026	Closure of the analytical period of the present case reconstruction.	E03, E08–E12

This chronology supports the process-tracing logic by distinguishing the progressive establishment of institutional capabilities from the subsequent maturity-assessment and improvement cycle. It also clarifies that the transformation did not occur as a single intervention but through a sequence of governance, architectural, operational, and evaluative developments.

3.2. Analytical Procedure and Artifact Evaluation

The analytical procedure followed a thematic coding strategy. First, institutional evidence was read repeatedly to identify descriptive categories related to strategy, governance, infrastructure, applications, data, security, accessibility and results. Second, these categories were connected to theoretical variables derived from the literature. Third, the categories were reorganized into a five-layer model that explained the transformation architecture. This iterative process supported interpretive rigor by moving between empirical evidence and conceptual abstraction [15,52].

The coding process was conducted by the lead researcher using a structured analytical matrix. Initial deductive codes were derived from the theoretical framework and included strategic alignment, governance, infrastructure, interoperability, institutional applications, data analytics, cybersecurity, accessibility, and continuous improvement. Each code was operationalized through a definition, an inclusion rule, its relationship with the MITD-UTMACH architecture, the research question addressed, and representative types of documentary evidence. During iterative analysis, several codes were refined or added inductively to represent implementation characteristics emerging from the corpus, including governance-bound interoperability, process traceability and reviewability, human oversight of AI-assisted processing, and monitoring-based feedback. A subsequent higher-order analytical stage examined relationships among codes and resulted in three cross-layer mechanisms: vertical alignment, governance-bound interoperability, and an evidence-based feedback loop. The complete coding manual, including code origin, operational definitions, inclusion rules, representative evidence examples, associated evidence categories, and corresponding research questions, is provided in Supplementary Table S2.

Coding was iterative rather than strictly sequential. Documentary segments could receive more than one code when they provided evidence relevant to multiple dimensions of the transformation. For example, DINARP interoperability evidence was coded for both technical interoperability and governance-bound authorization, whereas the admission-process evidence was coded for automation, traceability, and external reviewability. Coding decisions were repeatedly checked against the original documentary source, the temporal process-tracing sequence, and the corresponding research question to strengthen analytical consistency and prevent claims from extending beyond the available evidence.

Coding was conducted manually through a structured spreadsheet matrix that linked each individual documentary or technical record with its evidence category, deductive and/or inductive codes, corresponding MITD-UTMACH layer, research question addressed, temporal position in the transformation process, and resulting analytical proposition [53]. Coding was performed at the level of analytically meaningful documentary segments rather than assigning a single code to an entire evidence category. The lead researcher checked each coding decision against the original evidence and the process-tracing sequence. To strengthen coding dependability, a second researcher independently reviewed 18 records, corresponding to 25% of the final 72-record documentary corpus. The 18 records were selected using a stratified purposive procedure to ensure representation of all 14 evidence categories (E01–E14). One record was selected from each category, with four additional records drawn from E06, E07, E08, and E12 because these categories supported central technical, interoperability, application, and continuous-improvement claims. The selection therefore prioritized analytical coverage across the architecture while preserving the predefined 25% review proportion. The review was conducted using the finalized coding manual provided in Supplementary Table S2 and without modifying the original evidence categories or analytical framework. The second review confirmed the coding assignments for all reviewed records, and no discrepancies requiring recoding were identified. This additional verification complemented the evidence-to-claim traceability procedure and strengthened the dependability of the thematic analysis.

Design-science evaluation criteria were then applied to assess the model as an artifact. The evaluation considered problem relevance, design coherence, implementation feasibility, utility, contribution and communication. This did not imply a laboratory validation of all system components; rather, it provided a structured way to interpret whether the model addressed the institutional problem and generated knowledge transferable to other settings. The model was therefore evaluated as an applied system innovation artifact embedded in a real university context [9,12].

A process-tracing logic was used to reconstruct the movement from initial conditions to current capabilities. The analysis compared the initial situation, characterized by fragmented systems, limited governance, manual or semi-automated processes, limited systematic use of integrated institutional data for decision support and partially formalized information security controls, with the current situation, characterized by structured governance, interoperable systems, automated and traceable processes, data analytics and risk-based security management. This comparative logic supported a temporally ordered and theoretically informed explanation of how the documented changes were associated, without establishing causal attribution [11,54].

Triangulation was pursued across documentary evidence, system descriptions, governance records, implementation outputs and theoretical constructs. The purpose was not to accumulate sources mechanically but to examine whether different types of evidence converged on the same interpretation of institutional transformation. For example, the existence of governance committees was interpreted together with PETI alignment, security roles, interoperable architecture and automated processes, which strengthened the plausibility of the integrated model [55,56].

The study used analytic generalization rather than statistical generalization. The findings were not intended to estimate the prevalence of digital transformation models across universities, but to develop a theoretically informed account of how one public university implemented a transferable model. Analytic generalization was appropriate because the case generated propositions about alignment, governance, interoperability, analytics and user-centered design that could be compared with other higher education settings [11,13].

3.3. Role of the MMGSI-Cloud Assessment Within the Case Study

The temporal scope of the case extended from 2023 to April 2026. The principal governance, infrastructure, interoperability, application, cybersecurity, and data-analytics initiatives were progressively planned and implemented from 2023 onward. The MMGSI-Cloud baseline diagnosis and roadmap definition were conducted in June and July 2025, followed by the implementation and improvement follow-up from August 2025 to April 2026. The subsequent final reassessment falls outside the temporal boundary of this case reconstruction and is reported in the separate MMGSI-Cloud manuscript. This temporal distinction separates the earlier development of enabling institutional capabilities from the subsequent maturity-assessment and improvement process.

MMGSI-Cloud was used solely as an embedded evaluative mechanism within the implemented MITD-UTMACH architecture. The analysis focused on the organizational implications of the assessment—evidence availability, governance formalization, identified gaps, improvement priorities, and their incorporation into institutional planning—rather than on revalidating the maturity model itself. Accordingly, the complete questionnaire, scoring procedure, maturity-level definitions, item-level results, and model-validation procedures were not reproduced here and are addressed in the separate MMGSI-Cloud study.

The analytical procedure followed four stages. First, the institutional evidence supporting the maturity assessment was mapped to the components of MITD-UTMACH. Second, the main strengths and areas requiring improvement were synthesized at the organizational level. Third, improvement priorities were connected to institutional governance and technological planning. Fourth, the maturity assessment was interpreted as a feedback mechanism within the continuous transformation cycle.

3.4. Trustworthiness, Reflexivity and Ethics

Trustworthiness was addressed through credibility, transferability, dependability and confirmability:

• Credibility was supported by triangulation and alignment between evidence and theory.
• Transferability was supported by thick description of the institutional context and model architecture.
• Dependability was supported by an explicit analytical procedure, a documented coding manual, evidence-to-claim traceability, and an independent second review of 25% of the final documentary corpus.
• Confirmability was supported by distinguishing between documented outputs, theoretical interpretation and recommendations.

These criteria were selected because qualitative rigor required transparency about how interpretations were produced [56,57]. The methodological design also considered reflexivity. Since institutional transformation studies could easily become celebratory narratives, the analysis deliberately included limitations, ethical concerns and risks associated with datafication, AI, cloud dependency and governance sustainability. Reflexivity allowed the study to recognize that successful implementation did not eliminate future challenges and that digital maturity required continuous evaluation. This approach strengthened the scientific credibility of the manuscript by avoiding deterministic or promotional claims [48,56,57].

The lead researcher held a senior institutional IT management role during part of the period analyzed and participated in several initiatives reconstructed in the case. This insider position provided access to institutional processes and documentary evidence but also introduced a potential risk of interpretive bias.

To mitigate this risk, claims were restricted to verifiable documentary and technical evidence, evidence-to-claim relationships were recorded in the traceability matrix and documented outputs were distinguished from interpretive propositions. Ethical considerations were organized around confidentiality, data protection, public accountability and responsible representation. The study used institutional-level evidence and did not report identifiable personal data from students, faculty or staff.

The analysis also emphasized that digital transformation systems handling personal information had to comply with data-protection principles and cybersecurity safeguards. This ethical stance was consistent with data-protection and responsible-AI principles [24,39].

3.5. Methodological Scope and Contribution

The study did not use experimental metrics, randomized comparisons or large-scale user surveys. Although operational post-implementation indicators were available for selected components—particularly the cloud-migration process—a homogeneous historical baseline was not available across the broader set of institutional processes. Formal pre/post effect sizes were therefore not retrospectively estimated. This limitation was methodologically relevant because it meant that claims about user experience, accessibility and institutional efficiency were based on documented system improvements and implementation evidence rather than direct psychometric measurement. The article therefore avoided overstating causal effects and recommended future mixed-methods evaluation, including usability testing, service-quality metrics, learning analytics validation and cost–benefit analysis [50,58].

The methodological contribution consisted of transforming an institutional digital transformation experience into an analyzable applied system innovation model. The procedure showed how technical evidence, governance arrangements, process changes and educational objectives could be integrated into a coherent analytical framework. This was relevant because institutional digital initiatives are frequently documented as operational achievements without being systematically reconstructed as transferable design knowledge. The study therefore contributed both an institutional model and a structured procedure for documenting and theorizing university digital transformation [10,12].

The methodological strategy enabled the examination of UTMACH’s digital transformation with contextual depth, theoretical grounding and design-oriented clarity. The case-study design preserved the institutional specificity of a public university in El Oro, while the design-science orientation supported the abstraction of that experience into a potentially transferable architecture. This methodological combination was therefore consistent with the research objective, the institutional problem and the applied system innovation perspective adopted in the study [9,11] (see Table 4).

Table 4. Methodological matrix for case-study and design-science reconstruction.

Methodological Dimension	Decision Adopted	Purpose
Design	Qualitative embedded case study with design-science orientation.	To analyze a real institutional transformation and reconstruct the model as an artifact.
Unit of analysis	MITD-UTMACH.	To examine the integrated digital transformation model.
Embedded units	Strategy, governance, infrastructure, applications, data, security, UX/accessibility.	To identify interdependent components of the model.
Data sources	Institutional documents, technical records, system descriptions, governance evidence.	To triangulate implementation evidence.
Analysis	Thematic coding, process tracing, artifact evaluation.	To connect evidence with theoretical variables and model layers.
Artifact evaluation	Problem relevance, design coherence, implementation feasibility, utility, contribution and communication.	To assess whether MITD-UTMACH addressed the institutional problem and generated transferable design knowledge.
Continuous assessment	Institutional application of MMGSI-Cloud and analysis of the resulting improvement roadmap.	To examine how maturity assessment supported gap identification, planning, monitoring and continuous institutional improvement.

4. Results

The results showed that UTMACH’s digital transformation was structured around a movement from fragmented technological administration toward an integrated institutional model. The initial situation was characterized by disconnected systems, duplicated information, limited interoperability, manual or semi-automated processes, limited systematic use of integrated institutional data for decision support and partially formalized information security controls.

The current configuration exhibited a more integrated and institutionally structured digital ecosystem based on strategic alignment, formal governance, interoperable architecture, institutional applications, data-driven management and a structured mechanism for continuous cloud security governance assessment. This trajectory was consistent with digital transformation theory because it involved organizational redesign, not only technology adoption [1,2].

Documentary evidence E01 and E02 showed that strategic IT planning was aligned with institutional development planning. The PETI translated institutional objectives into technological priorities, project portfolios, responsibilities and implementation actions. This alignment supported a shift in the institutional role of IT from predominantly operational support toward a more strategic contribution to academic and administrative modernization. The PETI provided a roadmap for prioritizing projects, assigning resources and evaluating technological initiatives according to institutional value. This result confirmed the relevance of strategic alignment as a condition for sustained technology-enabled transformation in complex organizations [3,21].

Documentary evidence E01 and E02 indicated a shift from isolated technological initiatives toward a portfolio-based logic of technological management. This portfolio logic improved the capacity to prioritize systems related to substantive university functions, external evaluation and technical regulation. As a result, the university created a more disciplined relationship between institutional objectives and digital investment, which reflected core principles of enterprise governance of information and technology [7,8].

Documentary evidence E03–E05 showed that the university formalized IT governance and information security structures. The university established institutional mechanisms such as an IT Committee and an Information Security Committee, while also defining strategic roles associated with information security and personal data protection. These arrangements clarified responsibilities, strengthened accountability and provided institutional spaces for evaluating risks and priorities. The result was significant because governance bodies converted digital transformation from a technical department’s effort into a university-wide institutional process [8,20,22].

The governance layer also incorporated the adoption of the Governmental Information Security Scheme and risk-management practices. This strengthened the institution’s capacity to protect information assets, organize controls, and respond to regulatory expectations. The result indicated that institutional cybersecurity capability depended not only on technical tools, but also on policies, roles, processes, evidence and continuous monitoring. This finding aligned with contemporary cybersecurity frameworks that locate governance as the first condition for reliable protection, detection, response and recovery [45,46].

4.1. Five-Layer Architecture and Cloud-Enabled Continuity

A further result was the definition of a five-layer transformation architecture complemented by a continuous assessment and improvement cycle. The strategic layer connected PETI with institutional objectives; the governance layer organized committees, roles, policies and controls; the technological layer used APIs, microservices, interoperability and cloud infrastructure; the application layer included integrated institutional systems; and the data layer consolidated dashboards, analytics and selected AI-assisted processes. This layered architecture made the model intelligible and transferable because it showed how institutional value emerged from the interaction among layers rather than from isolated components [9,12] (see Table 5).

Table 5. Evolution of digital governance and institutional management after the transformation process.

Component	Initial Situation	Current Situation After Implementation
IT governance	Limited formalization of an integrated IT governance model.	Structured model with committees, roles and accountability mechanisms.
Institutional systems	Fragmented and disconnected platforms.	Integrated systems supported by interoperability.
Processes	Manual or semi-automated procedures.	Selected automated and traceable processes, including admission allocation.
Decision-making	Limited systematic use of integrated institutional data for decision support.	Data-informed management supported by dashboards and analytics.
Information security	Partially formalized controls and distributed security responsibilities.	Risk-based model aligned with institutional security governance.

The technological layer generated one of the most visible documented outputs: the staged migration of 52 institutional servers between 2 September and 10 October 2024. The server portfolio included institutional applications, web/CMS services, databases, e-learning platforms, authentication and directory services, repositories, support services, and infrastructure/monitoring components. Migration was performed in four operational lots organized according to service type, dependency, and criticality: base infrastructure and test environments (n = 11), web portals, repositories, and internal services (n = 15), academic and administrative applications (n = 11), and critical systems, main databases, core academic services, and authentication/directory services (n = 15).

Following each migration lot, the technical team verified network reachability and service ports, web responses, database connectivity, authentication, system and application logs, resource utilization, and reported incidents. Post-migration monitoring continued for 15 days after each lot. For each monitored server, uptime was calculated relative to the expected monitored time during its respective 15-day post-migration window. The reported 99.85% average server uptime represents the arithmetic mean of the individual server uptime percentages across the migrated server portfolio. Institutional monitoring records also documented no critical incidents attributable to the migration, while minor cache or DNS adjustment requests were resolved within 24 h. These indicators are interpreted as institutional operational metrics rather than as the results of an independent availability audit (Supplementary Table S3).

The cloud migration results also indicated the presence of internal technological capacity. Rather than depending solely on external implementation, the university mobilized its internal team to redesign infrastructure under demanding operational conditions. This finding was relevant because transformation in resource-constrained public institutions often depended on the strategic use of existing human capital. The migration therefore represented both a technical achievement and an organizational learning process through which the institution expanded its capacity to manage complex digital infrastructure [16,17].

4.2. Interoperability and Institutional Applications

Technical evidence E07 documented a centralized API-based integration architecture comprising 61 principal endpoints registered through the institutional API Gateway and six microservices or integration modules. The integrations supported data exchange among the main academic system (SIUTMACH), EVEA/Moodle, electronic-signature services, the online-program learning platform, employment and scholarship services, the scientific-information platform, institutional planning services, and external public interoperability services. The exchanged information comprised three principal categories: academic data, identification and enrollment data, and scientific-production information.

Security and traceability controls included HTTPS/TLS 1.2 or higher for communications, bearer-token authentication using JWT, API keys, gateway-level source restrictions, rate limiting, verification and sanitization of incoming parameters, structured request logging, HTTP status and response-time records, and centralized JSON-based error handling designed to avoid exposing internal system or database details. The available evidence did not document a standardized API-versioning policy; consequently, the study does not make claims regarding version-management maturity. Likewise, no homogeneous pre-implementation baseline was available for processing time or duplicate-record rates, so these results are reported as documented architectural and operational capabilities rather than formal pre/post effect estimates [26,27,28]. Documentary evidence E13 established the formal authorization governing UTMACH access to public interoperability services administered by the Dirección Nacional de Registros Públicos (DINARP). The authorization, issued in December 2024, defined the institutional purpose, scope of access, responsible organizational units, and applicable security and data-protection conditions. This evidence demonstrated that external data exchange was supported not only by APIs and microservices, but also by a formally documented institutional and legal basis. Accordingly, interoperability in the UTMACH case combined technical integration, purpose-bound access, assigned responsibility, and traceable authorization [24,25].

Documentary evidence E08 identified a portfolio of institutional systems supporting administrative, academic, talent-management, research and knowledge-management processes. These systems included documentary management, the institutional Help Desk, integrated academic platforms, the virtual learning environment, scholarship services, employment services, faculty evaluation modules, the research information system and the automated admission system.

The evidence documented the implementation and operation of these applications within a progressively integrated institutional ecosystem. Their institutional relevance was associated with process automation, information traceability and reduced operational dispersion, although the study did not independently measure the net benefits of each individual system [50,51] (see Table 6 and Figure 1).

Table 6. Five-layer architecture and cross-cutting continuous improvement cycle of MITD-UTMACH.

Layer	Purpose	Key Components	Institutional Value
Strategic	Align IT with institutional planning.	PETI aligned with institutional development planning.	Prioritization and strategic coherence.
Governance and management	Direct, evaluate, monitor and control IT.	IT Committee, Information Security Committee, Information Security Officer and Data Protection Delegate.	Accountability, risk management, policy coherence.
Technological architecture	Enable integration, continuity and scalability.	Cloud infrastructure, APIs, microservices, interoperability.	Resilience, modularity, service continuity.
Institutional applications	Digitalize critical academic and administrative processes.	SIUTMACH, EVEA, SIGEDA, Help Desk, admission system, research system.	Traceability, transparency, operational efficiency.
Data-driven management	Support strategic decisions with analytics.	Institutional dashboards, data models, and selected AI-assisted support for organizing, preliminarily validating, and visualizing academic-production records, with human verification of the resulting outputs.	Evidence-informed governance, improved information organization and assisted institutional processing.
Cross-cutting continuous assessment and improvement cycle	Evaluate implemented governance and security capabilities and feed findings back into institutional planning.	MMGSI-Cloud assessment, evidence review, gap identification, improvement roadmap, monitoring.	Continuous improvement, prioritization, accountability and traceability.

Figure 1. MITD-UTMACH architecture and continuous cloud security governance improvement cycle. Note: MITD-UTMACH = Integrated University Digital Transformation Model; MMGSI-Cloud = Maturity Model for Information Security Governance in Cloud Computing; PETI = Strategic Information Technology Plan; API = application programming interface; AI = artificial intelligence. Arrows indicate the sequential and iterative flow from implementation and evidence collection through assessment, gap identification, improvement planning, monitoring, and strategic review, with feedback to the institutional architecture.

The academic-management systems strengthened the digital foundation for student trajectories, enrollment processes, virtual teaching and evaluation evidence. The integrated academic platform and the virtual learning environment made it possible to connect administrative data with pedagogical processes, although the study recognized that this integration should be deepened through future learning analytics validation. The result was pedagogically relevant because digital systems became part of the academic infrastructure through which the university monitored, supported and organized learning processes [35,36].

4.3. Admission Automation, Analytics and AI-Assisted Processes

A significant documented result was the automation of the student admission process, including the allocation of places without manual intervention and with recorded process traceability. Evidence E08 documented the implementation and institutional operation of the admission system, including its integration with the broader portfolio of academic–administrative applications.

The admission workflow was governed by predefined eligibility, scoring, prioritization, and allocation rules. Institutional system documentation showed that participation required prior registration in the national admission system, after which applicants registered on the UTMACH platform, verified their information, selected an available degree program, and confirmed their postulation. The allocation logic combined the admission-test score and the applicant’s high-school academic record, each weighted at 50%, together with applicable affirmative-action and institutionally defined additional points. Allocation was further constrained by available places, the applicant’s selected program, population-priority segments, and merit-based ordering within each segment. Applicants not allocated a place within an eligible priority segment could continue through subsequent applicable segments, while unaccepted places were processed as remaining places and could subsequently enter additional allocation rounds. The documented rules also established sequential tie-breaking criteria for the last available place. No discretionary manual-override mechanism for place allocation was identified in the reviewed documentation; exceptional situations were instead addressed through predefined allocation, remaining-place, acceptance/rejection, and subsequent-postulation rules.

This evidence supported the characterization of the process as automated and traceable, but it did not independently establish the accuracy, fairness or absence of operational errors in every allocation cycle. The admission case illustrated how automation could support procedural accountability when documented eligibility, scoring, prioritization and allocation rules, reduced manual intervention, process traceability and external review were combined with formal governance. The finding did not demonstrate that automation was inherently fair or free from all possible errors. Rather, it showed that the process had been implemented with documented traceability and was subsequently reviewed by the Prosecutor’s Office within an investigation, with no observations recorded regarding the automated allocation process within the scope examined in E14 [6,23].

Evidence E14 corresponded to a review of the automated admission allocation process conducted by the Prosecutor’s Office in January 2026 within the context of an investigation. The documentary material within the reviewed scope included a copy of the admission database, the allocation scripts or algorithms, and consolidated applicant-result tables. These elements are reported only to characterize the documentary scope available for external examination. They do not transform E14 into an independent algorithmic audit or comprehensive validation of accuracy, fairness, security, or performance. According to the documentary evidence analyzed, no observations were recorded regarding the automated allocation process within the scope reviewed. This evidence supported the external reviewability and documentary traceability of the process. However, it did not constitute a technical audit, independent algorithmic validation, or comprehensive assessment of fairness, accuracy, security, or performance across every admission cycle.

Evidence E09 documented institutional dashboards and analytics mechanisms for monitoring academic and administrative indicators. These tools increased visibility over academic and administrative processes and supported more timely decision-making. The result represented a transition from limited systematic use of integrated institutional data toward more evidence-informed governance. The study interpreted dashboards as decision-support instruments rather than decision substitutes, because educational and institutional judgments still required contextual interpretation, deliberation and ethical responsibility [33,34].

Evidence E10 documented selected AI-assisted functionality in institutional knowledge-management processes, particularly the organization, preliminary validation, and visualization of academic-production records. The evidence supported its characterization as information-processing assistance rather than autonomous institutional decision-making. Generated outputs remained subject to review and correction by authorized personnel before being incorporated into institutional records.

The available documentation established the existence and organizational function of this AI-assisted capability but did not provide an independent evaluation of algorithmic accuracy, bias, explainability, processing efficiency or user impact. The result was therefore interpreted as a bounded human-in-the-loop capability rather than as autonomous institutional decision-making [39,40]. The technical evidence available for this study did not identify a standalone AI module name, model family or version, deployment architecture, or independently validated performance metrics. Consequently, the AI-related finding is intentionally restricted to the documented human-in-the-loop information-processing function and should not be interpreted as an independently evaluated AI system.

4.4. UX, Accessibility, Security and Transferability

Evidence E11 described navigation, interface, usability and accessibility-oriented improvements in selected digital services. These records indicated that the transformation model incorporated human-centered design considerations; however, the study did not conduct a formal WCAG conformance audit or large-scale usability evaluation. Accordingly, the findings demonstrated the incorporation of accessibility-oriented practices rather than verified compliance with a specific accessibility level [41,42,43,44].

The security results included stronger controls, clearer roles, governance committees, risk management and alignment with national security expectations. These outputs increased the institution’s capacity to manage information assets and protect data. The finding was relevant because public universities increasingly faced cybersecurity risks while handling sensitive student, academic and administrative information. The model therefore showed that digital transformation and cybersecurity had to advance together; otherwise, innovation could increase vulnerability instead of institutional resilience [45,46].

The layered architecture supports analytical rather than statistical transferability; empirical replication in additional universities remains necessary [12,16,17].

These results demonstrated that UTMACH’s transformation advanced through the integration of strategy, governance, infrastructure, applications, data, security and user-centered design. The model supported continuity, traceability, automation, procedural transparency and greater visibility of institutional information while creating a foundation for future analytics and AI-assisted processes. These findings supported the argument that university digital transformation became an applied system innovation when technological architecture, institutional governance and educational public value were designed as mutually reinforcing components [1,12] (see Table 7).

Table 7. Implemented results and interpretive relevance.

Dimension	Result Synthesized	Interpretive Relevance
Cloud infrastructure	Staged migration of 52 institutional servers in four operational lots, followed by 15-day post-migration monitoring for each lot; institutional records indicated 99.85% average server uptime and no critical incidents attributable to the migration during the monitored period.	Documented continuity-oriented implementation supported by operational monitoring; not interpreted as an independent availability audit.
Interoperability	61 principal API endpoints, six microservices/integration modules, eight connected institutional/external service domains, gateway-level security and logging controls, and documented access to public interoperability services.	Operationally traceable and institutionally governed interoperability; quantitative pre/post effects on duplication and processing time were not estimated.
Automation	Automated admission allocation process documented through E08 and reviewed by the Prosecutor’s Office within an investigation, with no observations recorded regarding the process within the scope examined in E14.	Process traceability, external reviewability, and support for procedural accountability.
Security	Governance roles, security committee, risk-management scheme.	Digital trust and institutional Protection.
Analytics and AI-assisted processes	Institutional dashboards and selected AI-assisted support for organizing, preliminarily validating, and visualizing academic-production records, with outputs reviewed by authorized personnel.	Evidence-informed decision support and bounded human-in-the-loop assistance in institutional information processing.
UX/accessibility	Documented navigation, usability and accessibility-oriented design improvements.	Incorporation of human-centered design and accessibility-oriented criteria.

4.5. Cloud Security Governance Maturity Assessment and Continuous Improvement

Assessment records E12 provided an additional evaluative perspective on the institutional transformation. The assessment showed that UTMACH had established documented capabilities in strategic IT alignment, formal governance structures, information security responsibilities, cloud infrastructure management, service continuity and institutional process traceability. These capabilities made it possible to conduct an evidence-based assessment rather than relying exclusively on managerial perception.

The implementation and improvement follow-up period extended from August 2025 to April 2026. The observed improvements during this period were enabled by governance, infrastructure, security, continuity, and technical capabilities that had been progressively established before the baseline assessment. Consequently, the follow-up period represented the formalization, documentation, measurement, monitoring, and structured improvement of existing and newly strengthened practices rather than the construction of the entire institutional capability base within nine months (see Table 8).

Table 8. Institutional capabilities identified through the MMGSI-Cloud assessment within the MITD-UTMACH transformation model.

Assessed Institutional Capability	Evidence Identified in UTMACH	Institutional Implication	Improvement Orientation
Governance formalization	Committees, roles, PETI alignment, security responsibilities.	Established basis for cloud security decision-making.	Strengthen periodic monitoring and governance reporting.
Risk management	Risk-management practices and institutional security controls.	Initial capacity for structured risk treatment.	Improve integration, evidence consistency and reassessment.
Technical controls	Cloud infrastructure, access controls, service monitoring, security mechanisms.	Operational protection of institutional services.	Strengthen control-effectiveness verification.
Compliance	Data-protection roles, institutional policies, regulatory alignment.	Formal basis for accountability.	Consolidate traceable compliance evidence.
Continuity	Planned cloud migration and continuity-oriented practices.	Documented continuity-oriented operational capability.	Formalize periodic testing and lessons learned.
Continuous improvement	Assessment findings and improvement actions.	Feedback between assessment and planning.	Institutionalize reassessment and roadmap monitoring.

Note: The table summarizes capabilities and improvement orientations examined during the August 2025–April 2026 MMGSI-Cloud implementation and improvement-follow-up period. It does not imply that all institutional and technological capabilities were created during that period.

Table 8 synthesizes the institutional implications derived from the MMGSI-Cloud assessment. Rather than reporting maturity scores or reproducing the assessment instrument, the table summarizes how the evaluation contributed to identifying organizational capabilities, supporting governance decisions and prioritizing continuous improvement actions within the broader MITD-UTMACH transformation architecture.

The maturity assessment generated an improvement-oriented feedback process. Identified gaps were translated into actions that could be incorporated into IT planning, information security governance, cloud service management, compliance activities and continuity arrangements. This result extended the transformation model beyond implementation because institutional progress could be periodically reviewed and adjusted using documented evidence.

4.6. Design-Science Evaluation of MITD-UTMACH

The design-science evaluation introduced in Section 3.2 was applied after reconstructing the organizational and technological results of the case. The evaluation examined whether MITD-UTMACH addressed the documented institutional problem, maintained internal coherence among its components, was feasible within the institutional context, generated observable utility, contributed transferable design knowledge and could be communicated through a structured representation. Table 9 summarizes the operational meaning of each criterion and the resulting evidence-based evaluation. This assessment was interpretive and evidence-based; it did not constitute experimental validation, independent certification or external replication of the model [9,12] (see Table 9).

Table 9. Design-science evaluation of MITD-UTMACH as an applied system innovation artifact.

Criterion	Operational Focus	Evidence-Based Finding
Problem relevance	Address documented fragmentation, limited interoperability, governance formalization, and data use.	MITD-UTMACH integrated strategy, governance, architecture, applications, and data management (E01–E05, E07–E09).
Design coherence	Consistency across the five layers and improvement cycle.	Evidence showed coherent cross-layer relationships across E01–E14.
Implementation feasibility	Implementation using available institutional structures and capabilities.	Supported by governance formalization, cloud migration, APIs/microservices, institutional systems, dashboards, and UX/accessibility improvements (E03–E11).
Utility	Documented operational and governance contribution.	Supported continuity, interoperability, admission traceability/reviewability, security governance, decision support, and improvement planning (E06–E14).
Contribution	Transferable design knowledge.	Five-layer architecture complemented by an embedded evidence-based cloud-security-governance feedback cycle.
Communication	Clarity of architectural and evidence representation.	Model represented through the layered architecture, traceability structure, and seven-stage improvement cycle; stakeholder comprehension was not independently tested.

The evaluation indicated that MITD-UTMACH addressed a documented institutional problem and was implemented as a coherent, feasible and operationally useful architecture. Its principal design contribution lay in integrating strategic alignment, governance, technological architecture, institutional applications, data-driven management and a specialized cloud security governance assessment mechanism within a continuous improvement cycle.

4.7. Synthesis of the Answers to the Research Questions

The results provided direct answers to the four research questions.

• Regarding RQ1, MITD-UTMACH was structured as a five-layer architecture comprising strategic alignment, governance and management, technological architecture, institutional applications and data-driven management, complemented by a cross-cutting continuous assessment and improvement cycle.
• Regarding RQ2, the documented outcomes included continuity-oriented cloud migration, interoperable services based on APIs and microservices, selected automated and traceable academic–administrative processes, formalized information security governance, institutional dashboards and accessibility-oriented design improvements.
• Regarding RQ3, MMGSI-Cloud contributed by organizing institutional evidence, identifying governance and security gaps, prioritizing improvement actions and linking assessment findings with planning, monitoring and strategic review.
• Regarding RQ4, the case generated design principles based on strategic alignment, formal accountability, layered architecture, formally authorized and organizationally governed interoperability, human oversight, evidence traceability, and iterative improvement.

These principles may inform comparable public higher education institutions, although their transferability remains analytical and requires empirical evaluation in additional organizational contexts.

5. Discussion

The findings indicate that MITD-UTMACH should be interpreted as a governance-centered sociotechnical architecture rather than as a portfolio of technological projects. Its principal contribution lies in the relationships established among strategic alignment, governance structures, technological architecture, institutional applications, data-driven management, security assessment and continuous improvement.

Recent higher education research similarly suggests that digital transformation depends on the coordination of technological, organizational, managerial and leadership capabilities, whereas fragmented initiatives tend to reproduce institutional silos and limit sustainable change [59,60,61,62]. In the UTMACH case, the value of the model therefore emerged not from any single platform, migration or automated process, but from the institutional mechanisms that connected these components and directed them toward continuity, accountability, public value and evidence-informed management.

Regional evidence provides an important contextual comparison. A regional study involving almost 100 higher education institutions across 14 Latin American and Caribbean countries identified digital transformation as a strategic institutional process shaped by organizational capabilities, digital skills, infrastructure, and institutional planning [63]. An empirical study across nine Latin American countries similarly identified training, infrastructure, resource, and connectivity limitations as significant barriers to the effective use of digital technologies in higher education, while emphasizing the importance of institutional governance and decision-support capacity [64]. In Ecuador, case studies conducted at Universidad Politécnica Salesiana have proposed digital transformation initiatives based on technology, data analytics, and coordinated process management, showing that transformation in higher education requires organizational and process redesign rather than isolated technology adoption [65,66]. These findings position the UTMACH case within a broader regional pattern while extending the discussion toward a governance-centered architecture that integrates cloud infrastructure, interoperability, security assessment, data-driven management, and continuous improvement.

5.1. Infrastructure, Interoperability and Procedural Accountability

The principal finding regarding infrastructure and interoperability was that their institutional value depended on being embedded in governance, continuity planning, internal technical capacity and formally authorized data-exchange arrangements. The migration of 52 institutional servers provided evidence of implementation scale, but the analytically relevant result was the combination of technical execution with service-continuity planning, defined responsibilities and documentary traceability.

More specifically, the staged execution across four migration lots, combined with planned maintenance windows, pre-migration snapshots and backups, controlled traffic redirection, service verification, and 15-day post-migration monitoring, showed that infrastructure modernization was operationalized through explicit continuity safeguards rather than through a single cutover event. The 99.85% average server uptime and absence of critical migration-attributable incidents recorded during the documented monitoring period provide operational support for this interpretation, although these indicators originated from institutional monitoring rather than an independent availability audit.

This interpretation is consistent with research showing that cloud adoption creates value when technological capabilities are integrated with knowledge management, organizational readiness and governance rather than treated as an isolated infrastructure decision [29,67]. A similar mechanism was observed in the interoperability layer. APIs and microservices provided the technical means for connecting institutional applications, whereas formal authorization for access to public interoperability services established the legal and organizational basis for external data exchange.

The model therefore treated interoperability as a joint technical, semantic, organizational, security and regulatory capability. This distinction is especially relevant for public universities, where the possibility of exchanging data does not by itself justify access, use or institutional responsibility [24,25]. This interpretation is also consistent with recent regional evidence on digital government. The OECD/CAF Digital Government Review of Latin America and the Caribbean emphasizes governance for public-sector digital transformation, public-sector data integration, service design, and digital innovation, with Ecuador included among the countries examined [68]. This regional perspective reinforces the interpretation of interoperability in MITD-UTMACH as an organizationally governed capability that combines technical exchange with institutional responsibility, authorized purposes, and data-governance requirements. For comparable institutions, the implication is that cloud migration and interoperability should be preceded or accompanied by service inventories, dependency mapping, assignment of decision rights, continuity controls, data-governance rules and evidence of authorized purposes.

Architectural modernization without these complementary arrangements may increase technical connectivity while preserving fragmented accountability. However, the transferability of this finding remains analytical because the present study did not include an independent availability audit, quantitative measurement of reduced duplication or comparison with another university. The evidence supports the plausibility and institutional coherence of the mechanism, but not a universal causal effect.

The automated admission process further illustrated how digital architecture could contribute to procedural accountability. Its significance did not reside solely in reducing manual intervention, but in combining documented rules, process traceability, reviewability, and an external review conducted by the Prosecutor’s Office within an investigation. No observations were recorded regarding the automated allocation process within the specific scope examined; however, this finding should not be interpreted as a comprehensive technical or algorithmic validation.

Automation should not be interpreted as inherently neutral or fair; rather, it can strengthen procedural transparency when decision rules, data sources, responsibilities, exception handling and audit mechanisms remain visible and contestable [6,23]. Other universities considering similar processes should therefore evaluate not only operational efficiency but also the governance conditions under which automated outputs can be reviewed, corrected, explained and institutionally defended.

5.2. Analytics, AI-Assisted Processes, Accessibility and Institutional Trust

The data-driven management layer showed that institutional analytics generated value when integrated data were transformed into decision-support information without displacing professional and managerial judgment. Dashboards increased the visibility and traceability of selected academic and administrative processes, but their usefulness depended on data quality, shared definitions, interoperability, appropriate interpretation and governance of access. Recent research on data-driven universities similarly demonstrates that generating institutional data is substantially easier than establishing the organizational capabilities required to make those data trustworthy, interpretable and actionable [33,34,69].

This finding implies that universities should not evaluate analytics maturity by counting dashboards or indicators. They should examine who defines the indicators, which data sources are used, how inconsistencies are resolved, who is authorized to interpret the results and how analytics influence institutional decisions.

Data-driven management becomes institutionally meaningful only when analytical outputs are connected to accountable deliberation and when indicators remain open to contextual interpretation. Otherwise, analytics may reproduce reductionism, surveillance or an excessive dependence on what can be quantified.

The AI-assisted functionality represented a bounded institutional capability rather than autonomous decision-making. Its contribution consisted of supporting specific information-processing tasks while maintaining human verification and responsibility for official institutional outputs. This human-in-the-loop arrangement was consistent with recent higher education AI-governance frameworks, which emphasize the need to combine pedagogical or administrative opportunities with privacy, transparency, institutional responsibility, operational controls and human oversight [39,40,70,71].

The implication for other universities is that the incorporation of AI should begin with a clearly delimited institutional purpose, identifiable data inputs, defined outputs, authorized users, verification responsibilities and documented limitations. The presence of an AI component does not by itself demonstrate innovation, effectiveness or responsible use. Institutional value must be established through evidence of task relevance, controlled integration, traceability and measurable performance.

In this case, the evidence demonstrated the existence and organizational integration of AI-assisted functionality, but it did not establish algorithmic superiority, accuracy, fairness, explainability or efficiency gains. These limits are important because the study did not measure false-positive or false-negative rates, correction patterns, processing-time reduction, user acceptance or differential impacts. Consequently, the result should be interpreted as evidence of an emerging governed capability requiring further technical and organizational evaluation.

Accessibility and UX-oriented improvements contributed to institutional trust by recognizing that digital transformation must remain usable and inclusive for heterogeneous university communities. Nevertheless, the evidence demonstrated the incorporation of accessibility-oriented design practices rather than formal compliance with a specific Web Content Accessibility Guidelines level.

The broader implication is that accessibility should be incorporated throughout requirements definition, architecture, development, testing, procurement and continuous improvement rather than treated as a final interface adjustment [41,42,43,44]. Verified transferability will require formal accessibility audits, usability testing and participation by users with diverse capabilities.

5.3. From Digital Implementation to Maturity-Based Continuous Improvement

A central contribution of the case was the transition from implementation-centered transformation toward assessment-supported continuous improvement. MITD-UTMACH organized the institutional transformation architecture, whereas MMGSI-Cloud provided a specialized mechanism for examining the degree to which cloud security governance practices were documented, repeatable, monitored and connected to improvement actions. Their relationship was therefore complementary: one artifact structured implementation, while the other supported systematic evaluation within the implemented environment.

The mechanism connecting both artifacts can be expressed as an evidence-based feedback cycle: institutional capabilities generated documentary and technical evidence; the assessment organized that evidence and identified gaps; identified gaps informed improvement priorities; priorities were incorporated into planning and governance; and subsequent monitoring enabled reassessment. This cycle extended the model beyond a static representation of completed initiatives and positioned digital transformation as an evolving institutional capability.

This interpretation is consistent with contemporary studies that describe higher education digital transformation as a multidimensional management process whose sustainability depends on critical success factors, organizational learning, strategic integration and the capacity to address technological, cultural, governance and human barriers [61,62]. It also reinforces the design-science principle that an implemented artifact should be evaluated in relation to the problem it addresses, its utility and the knowledge generated through its application [9,12].

For other public universities, the implication is that assessment should not be postponed until the transformation is considered complete. Periodic evidence review, risk reassessment, control verification, roadmap monitoring and governance reporting should be incorporated into the transformation architecture from the outset. This approach can prevent institutions from equating the existence of cloud services, policies, committees or technical controls with actual maturity.

The present study therefore reports only the organizational role of MMGSI-Cloud within the continuous improvement cycle; instrument-level scores, maturity calculations, and validation results remain outside its scope.

5.4. Transferability, Digital Maturity and Pedagogical Implications

The transferable contribution of MITD-UTMACH resides primarily in its design logic rather than in the replication of specific systems, providers, platforms or technical configurations. The model proposes a sequence in which strategic alignment establishes direction; governance defines decision rights and accountability; technological architecture enables integration and continuity; institutional applications operationalize academic and administrative processes; data-driven management supports institutional deliberation; and maturity assessment feeds evidence back into planning and improvement.

Recent bibliometric and systematic evidence likewise shows that higher education digital transformation research increasingly converges around digital technologies, user experience, and social inclusiveness, reinforcing the need for institutional models that connect technological implementation with organizational and human dimensions rather than treating these elements separately [72].

This layered logic is compatible with recent research emphasizing that digital leadership and institutional transformation require distributed responsibilities, strategic coordination, organizational learning and integration between educational and technological change [60,61]. It also responds to studies showing that higher education institutions face interdependent strategic, organizational, technological, cultural and people-related barriers that cannot be resolved through technology acquisition alone [61,62].

Comparable public universities could adapt this logic to their own regulatory frameworks, institutional missions, technological legacies, financial conditions, human capabilities and data-protection requirements. Adaptation would require identifying which components are essential design principles and which are context-dependent implementation choices. Strategic alignment, accountability, interoperability, security governance, evidence traceability and continuous assessment represent potentially transferable principles. In contrast, the specific systems, committee configurations, cloud services, staffing arrangements and implementation sequence may require substantial contextual modification.

The case also suggests that digital maturity should not be inferred from the number of platforms, servers, integrations or dashboards implemented. Maturity is relational: dashboards depend on governed and integrated data; interoperability depends on authorized purposes and accountable data exchange; cloud infrastructure depends on continuity and security governance; AI-assisted processes depend on human oversight and data quality; and continuous improvement depends on evidence that can be reviewed and acted upon.

The pedagogical implications remain more tentative than the administrative and technological findings. Integrated academic systems and virtual learning environments created conditions for enhanced monitoring, coordination and student support, but the study did not evaluate learning outcomes, teaching practices, faculty adoption, student experience or the validity of academic-risk indicators. The model should therefore not be interpreted as demonstrating educational effectiveness. Future replication should connect institutional digital maturity with evidence of pedagogical value, inclusion, student participation and learning quality.

5.5. Limitations and Future Research Agenda

The principal limitation was the reliance on institutional documentary and technical evidence. Where operational indicators were available, such as post-migration uptime and incident records, they were reported descriptively. However, the absence of homogeneous historical baselines prevented formal quantitative pre/post comparisons across most institutional outcomes. These sources enabled a detailed reconstruction of governance structures, architectural components, implementation processes and documented outputs, but they did not provide direct measurement of all user, educational, financial or organizational effects. The study consequently supports an evidence-based explanation of the implemented model rather than experimental causal attribution.

A second limitation concerned the institutional origin of much of the evidence and the insider position of the lead researcher. Institutional documents may emphasize formal achievements while underrepresenting resistance, informal practices, implementation tensions or unresolved problems. The study mitigated this risk by restricting claims to traceable evidence, distinguishing documented outputs from interpretation and explicitly reporting methodological boundaries. Future research should incorporate independent documentary review, external audits, interviews with diverse institutional actors and evidence from users who were not directly involved in the transformation process.

A third limitation was the limited duration and scope of longitudinal measurement and the absence of a comparative institutional case. Although the MMGSI-Cloud improvement follow-up covered nine months, from August 2025 to April 2026, the study did not establish the longer-term sustainability of all capabilities under changes in leadership, financing, regulation, technological providers, staffing, or threat conditions. Neither did it compare UTMACH with a university that followed a different transformation approach. Transferability therefore remains theoretical and requires empirical examination.

A fourth methodological consideration concerned the coding process. The initial thematic coding was conducted by the lead researcher; however, coding dependability was subsequently strengthened through an independent second review of 18 records, representing 25% of the final documentary corpus, using the finalized coding manual. The second review confirmed the coding assignments for all reviewed records and identified no discrepancies requiring recoding. Although this procedure strengthened analytical dependability, it did not constitute a full double-coding of the complete corpus or a formal statistical intercoder-reliability study. Future multi-institutional applications could extend this procedure through full or larger-sample independent coding and formal agreement statistics where appropriate.

Future research should proceed through four complementary directions:

• First, multi-institutional studies should examine whether the five-layer architecture and continuous improvement cycle can be adapted across public universities with different levels of resources and digital maturity.
• Second, longitudinal evaluation should measure service availability, incident response, processing time, data quality, control effectiveness, roadmap completion, operating costs and vendor dependency.
• Third, user-centered studies should assess usability, accessibility conformance, satisfaction, adoption, academic value and the experiences of students, faculty members, administrative personnel and persons with disabilities.
• Fourth, AI-assisted processes should be evaluated through technical performance metrics, bias and explainability analysis, human correction patterns, data-governance controls and institutional accountability mechanisms [70,71].

The discussion indicates that MITD-UTMACH contributed an integrated explanation of how a public university connected governance, architecture, applications, data, security and continuous assessment within a single institutional transformation process. Its principal value was not the isolated implementation of cloud infrastructure, interoperability mechanisms, automated processes, dashboards or AI-assisted functionality.

The contribution resided in the governance and improvement relationships that enabled these components to operate as an institutional system. The case therefore supports the proposition that sustainable university digital transformation requires technological capability, formal accountability, human and organizational capacity, evidence-based evaluation and continued adaptation.

6. Conclusions

This study analyzed the digital transformation of Universidad Técnica de Machala as an applied system innovation based on the integration of strategic IT alignment, institutional governance, cloud infrastructure, interoperability, digital applications, data analytics, information security, accessibility and continuous improvement.

The findings showed that the transformation was not limited to the implementation of isolated technologies. It involved the development of an institutional architecture connecting decision-making structures, technical capabilities, academic–administrative processes, data use and accountability mechanisms.

MITD-UTMACH was structured through five interdependent layers: strategic alignment, governance and management, technological architecture, institutional applications and data-driven management. The migration of 52 institutional servers, the formalization of IT and information security governance structures, the implementation of APIs and microservices, the automation of selected institutional processes, including the admissions process, and the development of dashboards constituted documented outputs of this transformation.

A central contribution of the study was the incorporation of a continuous assessment and improvement cycle. The application of MMGSI-Cloud complemented the institutional architecture by enabling evidence-based assessment of cloud security governance capabilities, identification of organizational gaps and prioritization of improvement actions. The maturity model was not redeveloped or revalidated in this article; instead, its institutional role was analyzed as part of the wider transformation and governance process.

The findings supported the interpretation that digital transformation and cloud security maturity are related but distinct constructs. The assessment timeline also clarified that the maturity progression documented in the separate MMGSI-Cloud manuscript did not represent the creation of the university’s cloud security governance capabilities from an initial state within nine months. It reflected the structured formalization, evidence consolidation, measurement, monitoring, and improvement of capabilities that had been progressively established during the preceding digital transformation process. Digital transformation explained how technological and organizational capabilities were implemented, whereas maturity assessment examined the degree to which cloud security governance practices were documented, repeatable, monitored and continuously improved. Their integration provided a feedback mechanism connecting implementation, assessment, planning and institutional learning.

The study also showed that public-value-oriented institutional outputs such as transparency, continuity, traceability, accessibility-oriented service improvement and evidence-informed decision-making depended on the interaction among governance, architecture, data, security and users. The findings indicated that cloud migration required governance to manage institutional dependency and risk, that governance required documented evidence to support accountability and that analytics depended on interoperability and data quality to provide reliable decision support.

The main limitation was the reliance on institutional documentary and technical evidence without large-scale measurement of user satisfaction, learning outcomes, cost efficiency or longitudinal control effectiveness. In addition, detailed maturity scores, instrument-level findings and model-validation procedures were excluded because they belonged to a separate manuscript in preparation. Future research should evaluate the evolution of the institutional roadmap, incorporate service and user metrics and compare the application of MMGSI-Cloud across organizations and economic sectors.

The transferable contribution of the UTMACH case resided in its integration logic rather than in the replication of specific technologies. Comparable universities could adapt the sequence of strategic alignment, governance formalization, architecture modernization, process integration, data-driven management, maturity assessment and continuous improvement according to their regulatory, organizational and resource conditions. The study therefore concluded that sustainable university digital transformation required not only technological implementation but also institutional governance, systematic evaluation and evidence-based improvement.