An activity theory approach to information security non-compliance

Abstract

Purpose

The purpose of this paper is to introduce activity theory (AT) as a new theoretical lens to the field of information security non-compliance by explaining how research in that field can benefit from AT and to suggest eight propositions for future research.

Design/methodology/approach

Based on AT, the paper suggests that employees, IT systems, task characteristics, information security policies (ISPs), community and division of labor can be viewed to form an ensemble that is labeled activity. Their characteristics and/or the relationships that exist between them in organizational contexts are hypothesized to influence non-compliance behaviors.

Findings

The paper suggests that AT provides a broad lens that can be useful for explaining a large variety of non-compliant behaviors related to information security.

Research limitations/implications

The paper focuses only on non-compliant behaviors that employees undertake with non-malicious intentions and offers avenues for future research based on the propositions that are developed in the paper.

Originality/value

The paper provides a useful step toward a better understanding of non-compliant ISP behaviors. In addition, it proposes and explains new research areas in the non-compliance field.

Citation

Khatib, R. and Barki, H. (2020), "An activity theory approach to information security non-compliance", Information and Computer Security, Vol. 28 No. 4, pp. 485-501. https://doi.org/10.1108/ICS-11-2018-0128