Information security risk factors in Chinese smart cities: a multi-level analysis from the TOE perspective

Purpose The rapid digitalization of smart cities has increased the complexity of information security risk (ISR). Existing studies identify many ISR factors, but their structural relationships and different roles remain unclear. This study examines key ISR factors in Chinese smart cities and their multi-level relationships from the technology-organization-environment (TOE) perspective. Design/methodology/approach A literature review and a three-round Delphi process were used to identify and validate 12 ISR factors. We then applied three methods in sequence: the decision-making trial and evaluation laboratory (DEMATEL) method to assess factor prominence and net influence, interpretive structural modeling (ISM) to identify hierarchical positions, and Matrice d’Impacts Croisés Multiplication Appliquée à un Classement (MICMAC) to classify the factors by driving power and dependence. Findings Policy systems and legal norms emerge as root and driving factors. Personnel and infrastructure factors occupy deeper levels, while data and software security connect these conditions to the technology-related factors. The organizational dimension therefore contains factors with distinct structural roles. The findings suggest that smart-city security management should combine clear institutional responsibilities and personnel capability with data, software and technology-specific safeguards. Originality/value The study develops a relational interpretation of TOE by distinguishing the structural roles of factors within and across its dimensions. In particular, personnel conditions exert net influence, whereas data and software security combine high prominence with greater dependence. This distinction explains how institutional and organizational conditions relate to technological exposure and provides a basis for coordinating governance priorities beyond a single risk ranking.