<![CDATA[As digital technologies increasingly permeate the education sector, the need to safeguard sensitive personal data within early childhood education systems becomes paramount. In Indonesia, where the adoption of digital tools in education is rapidly expanding, these systems are particularly vulnerable due to the hybrid nature of their processes, varying levels of digital literacy among stakeholders, and a complex regulatory environment. This research addresses the challenge of securing Indonesia’s early childhood education systems by designing a minimized attack surface through the integration of ISO 27005-based risk assessment and the TOGAF enterprise architecture framework. ISO 27005 provides a systematic methodology for identifying, assessing, and mitigating information security risks, ensuring compliance with the Indonesian Personal Data Protection Law (UUPDP). TOGAF is utilized to structure the enterprise architecture, aligning IT strategies with institutional goals while embedding robust security measures across the digital infrastructure. The research methodology involves identifying critical assets and potential threats, evaluating these threats using ISO 27005, and developing a secure architecture tailored to the unique needs of Indonesian early childhood education systems. The proposed framework is validated through application in a case study involving several Indonesian early childhood education institutions. This approach not only enhances the security posture of these institutions but also aligns with cultural and regulatory considerations, offering a comprehensive solution for protecting vulnerable educational environments in Indonesia.]]>
