Assessing Information Security Awareness Among Indonesian Government Employees: A Case Study of the Meteorology, Climatology, and Geophysics Agency

Abstract

Background: Cybersecurity is important for government agencies and the usefulness shows the need for a thorough understanding of information security awareness (ISA) among employees in order to enhance protective measures and ensure compliance with regulations. The Meteorology, Climatology, and Geophysical Agency (BMKG) of Indonesia is very important in providing essential national data and this responsibility shows the need to assess and promote ISA among the employees. The efforts to ensure a robust ISA culture can allow BMKG to safeguard sensitive meteorological and geophysical data, strengthen operational resilience, maintain public trust, and mitigate potential cyber threats that are capable of compromising national security. Objective: This study aimed to evaluate the level of organizational ISA among employees at BMKG and to improve measures considered important. Methods: The Human Aspects of Information Security Questionnaire (HAIS-Q) was administered as the reference model to assess the knowledge, attitudes, and behaviors of employees regarding information security. A descriptive statistical analysis and Partial Least Squares Structural Equation Modelling (PLS-SEM) were further applied to analyze data from 459 BMKG employees across various security domains, including password management, email use, internet use, social media use, mobile device security, and incident reporting. Results: The results showed that BMKG employees possessed a high overall level of ISA (88.06%) with the average knowledge, attitudes, and behaviors recorded to be 88.06%, 81.89%, and 80.74%, respectively. Meanwhile, specific areas such as email use (78.70%) and mobile device use (73.19%) had only moderate awareness. The structural model analysis also showed that behavior exerted the most significant influence on ISA (β = 0.423), followed by attitude (β = 0.289) and knowledge (β = 0.214). Conclusion: The overall awareness level was positive but there was a need for targeted efforts in password management, email use, and mobile device security to improve ISA practices. Moreover, the implementation of comprehensive information security policies, regular training, and organizational support was suggested to be important for fostering a robust security culture within BMKG. Keywords: Information Security Awareness, Cybersecurity, BMKG, PLS-SEM, Government Employees, Indonesia