Information Security Policy Implementation in Surabaya, Indonesia: A Mixed-Methods Approach to a Multi-Stakeholder Urban Context

The absence of a national standard for developing Information Security Policies (ISPs) in Indonesia creates challenges for achieving compliance in interconnected urban digital environments. While ISPs have traditionally been organisational instruments, their development in cities involves multiple stakeholders with differing responsibilities, capacities, and interpretations of compliance. This study examines how ISP compliance is achieved, coordinated, and sustained across organisational boundaries in Surabaya, Indonesia, involving government bodies, market providers, IT consultants, and citizens, using Cram et al.’s (2017) organisational ISP framework as a theoretical lens. An exploratory sequential mixed-methods design was adopted. The study began with 40 semi-structured interviews across the four stakeholder groups. Thematic analysis identified key themes that informed the design of a structured survey, which was completed by 233 respondents to test these themes across a broader sample from the same population. Qualitative findings show that formal standards and bureaucratic control shape ISP development, but stakeholders interpret these constructs differently. Governments are driven by regulatory mandates, market providers by operational continuity and customer trust, IT consultants by technical interpretation and advisory roles, and citizens by transparency and involvement. Although stakeholders share concerns about awareness and enforcement, their motivations differ, indicating that Cram’s constructs carry distinct nuances across stakeholder positions. Coordination is predominantly government-led, with local authorities setting regulatory baselines that other stakeholders operationalise or respond to. These findings inform an extension of Cram’s framework across three cross-boundary dimensions: differentiated communication processes, government-led coordination mechanisms that distribute responsibility, and extended feedback loops that sustain adaptive compliance. Quantitative results confirm broad agreement on ISP principles but reveal gaps between government and non-government groups. This study contributes to the information management body of knowledge by demonstrating how the organisational ISP framework applies to a multi-stakeholder urban context. In practice, the study offers guidance on strengthening coordination, communication, and feedback processes in this context.