ABSTRACT. University campuses now operate as complex cyber–physical infrastructures integrating building automation networks, IoT sensor grids, energy management systems, and cloud-based analytical platforms. Digital twins (DTs) have emerged as a unifying technology to orchestrate these heterogeneous systems by maintaining synchronized virtual representations of physical assets and enabling predictive control workflows. However, the tight integration between digital analytics and physical actuation introduces a new class of cybersecurity risks: compromises affecting telemetry integrity, cryptographic transport layers, or analytic models can propagate directly into unsafe physical operations. Traditional perimeter-based security approaches and static encryption policies are ill-suited to such environments, particularly given the energy and computational constraints of IoT hardware deployed at scale. This paper presents a unified Zero-Trust security framework for smart-campus digital twins, experimentally validated through a live cyber-range deployment. The architecture combines continuous device identity verification, machine-learning driven adaptive cryptographic governance, and multivariate digital-twin anomaly detection into an end-to-end trust enforcement loop. Cryptographic protections are continuously tailored to device energy availability, computational load, telemetry sensitivity, and control latency requirements. Concurrently, a hybrid Isolation Forest and DBSCAN analytics pipeline verifies the semantic integrity of cyber–physical telemetry streams, detecting spoofing, replay, and desynchronization attacks. The framework is implemented and evaluated on a lecture-hall HVAC digital twin using embedded ESP8266 controllers, encrypted MQTT telemetry, and a Unity-based DT visualization platform operating as a cyber-range testbed. Results demonstrate that adaptive encryption reduces energy overhead by over 60% relative to static AES enforcement while maintaining real-time control stability. Behavioral anomaly detection achieves detection rates exceeding 94% across representative attack scenarios without introducing operational disruptions. The study establishes campus digital twins not only as operational optimization tools, but as active Zero-Trust enforcement platforms and experimentally viable cyber-ranges for advancing cyber–physical infrastructure security.