Analysis of Academic Scheduling Management Using ISO/IEC 27001:2022 People Controls

User behaviour plays a critical role in determining the effectiveness of academic information system management, particularly in processes requiring high data accuracy and timeliness, such as academic scheduling. Despite system support, inconsistencies in data provision and updates indicate that information reliability is influenced by how users perform their responsibilities. This study evaluates People Controls based on ISO/IEC 27001:2022 Annex A.6 and integrates COBIT–CMMI to measure capability levels from a behavioural perspective. A qualitative approach was employed through observation and structured interviews with key stakeholders involved in academic scheduling. User activities were mapped to Annex A.6 controls to identify implementation gaps, followed by capability level assessment using COBIT–CMMI. The results show that control implementation is largely informal and habit-based, with an overall capability level of Level 2 (40%). User behaviour demonstrates basic control execution but lacks consistency and standardization, particularly affecting data accuracy and timeliness, which leads to misalignment between data availability and operational needs. These findings emphasize that improving information security requires strengthening consistent user behaviour, role accountability, and structured practices, alongside technical system support.