Zero Trust Security and FERPA Aligned Data Governance for Higher Education Web Systems with Identity Centric Access Control Secure APIs and Tamper Evident Audit Logging

Abstract Higher education web systems manage highly sensitive student and academic data that are protected under the Family Educational Rights and Privacy Act (FERPA). However, many institutions continue to rely on perimeter-based security models, coarse-grained access control, and mutable audit logging mechanisms that are increasingly inadequate in distributed, cloud-enabled, and API-driven environments. These limitations expose academic systems to unauthorized access, compliance risks, and insufficient accountability. This paper proposes a comprehensive Zero Trust security framework that integrates FERPA-aligned data governance with identity-centric access control, secure application programming interfaces, and tamper-evident audit logging for higher education web systems. The proposed approach eliminates implicit trust assumptions by enforcing continuous authentication and authorization based on identity attributes, contextual information, and policy-driven governance rules. Secure APIs act as controlled access points to institutional data, while cryptographically chained, append-only audit logs ensure integrity, non-repudiation, and regulatory audit readiness. The framework is evaluated using simulated higher education access scenarios, comparing traditional perimeter-based systems with the proposed Zero Trust architecture. Results demonstrate significant improvements in access control precision, unauthorized access reduction, FERPA compliance coverage, and audit log integrity. The findings highlight the effectiveness of embedding regulatory compliance directly into system architecture rather than treating it as an external administrative requirement. This study contributes a unified, scalable, and reproducible model for securing academic web systems and advancing compliant data governance through Zero Trust principles.