Avaliação da efetividade do Programa de Privacidade e Segurança da Informação (PPSI) nas instituições federais de ensino superior

Abstract

This dissertation evaluates the perceived effectiveness of the Brazilian Privacy and Information Security Program (PPSI) in Federal Higher Education Institutions (IFES) and identifies the institutional capacities most strongly associated with these results. The study belongs to the Public Policy research line of PROFIAP and contributes to the digital public policy evaluation agenda by combining the literatures on state capacities, information security governance, and public value, treating effectiveness as a perceived outcome rather than declared compliance. The methodology articulated three stages: a systematic literature review following the PRISMA 2020 protocol, which consolidated 82 studies and delimited six capacity and six effectiveness domains; the construction and content validation of an 18-item instrument by a panel of 11 experts (Lawshe’s method); and its application to the entire population of 110 IFES, with 58 valid institutional responses (52.7%), analyzed through descriptive statistics, Spearman correlations, and exploratory regressions with robust standard errors. Results indicate an asymmetry between formal governance, the most consolidated dimension, and material sustainability capacities: budget resources, risk management integrated into planning, and personal data management were among the most fragile. Self-reported maturity was associated with capacities, but not with perceived effectiveness, whose variation was explained by institutional capacities. The study’s originality lies in providing empirical evidence, in the Brazilian context, of the distinction between maturity and effectiveness, with capacities as the linking mechanism. As a practical contribution, with potential impact in the organizational and public policy spheres, the study proposes management recommendations and the PPSI Capacity and Effectiveness Assessment Guide for IFES (GACE-PPSI), a self- applicable technical-technological product derived from the findings.