This study examines how national legal and institutional frameworks can translate the International Ship and Port Facility Security (ISPS) Code into cooperative, operational practice to prevent, detect, and respond to port security incidents. The paper situates ISPS within contemporary hybrid risk kinetic disruptions to sea lanes, transnational crime, and escalating cyber threats and argues that outcomes depend less on “paper compliance” than on domestic laws and institutions that enable interoperability among public authorities and industry actors. The objective is to develop a practical model aligning legal mandates, institutional roles, and cooperation mechanisms across prevention, preparedness, response, and recovery. Methodologically, the study adopts a qualitative, normative–juridical design with comparative policy and documentary analysis to map (i) the international framework (SOLAS XI-2/ISPS), (ii) Indonesia’s legal-institutional arrangements, and (iii) cooperation mechanisms in practice (information-sharing, inspections/joint patrols, training, intelligence, Declarations of Security, incident command). Empirically grounded discussion highlights budgetary constraints and the value of international cooperation resource sharing, regulatory harmonization, and enhanced coordination for strengthening ISPS implementation. The paper organizes mechanisms against threat categories (violence, legal-violation crime, terrorism) to assess fit-for-purpose alignment and identify interoperability gaps. The contribution is a design blueprint specifying minimum legal features, institutional options, and process enablers (SOPs, joint exercises, audits, feedback loops) to improve cooperative ISPS implementation, with Indonesia as the primary reference case and adaptable guidance for similar jurisdictions.