An activity theory approach to information security non-compliance. (10th March 2020)

• Record Type: Journal Article
• Authors: Khatib, Rima; Barki, Henri
• Is Part Of: Information and computer security. Volume 28:Number 4(2020)
• Page Start: 485
• Page End: 501
• Publication Date: 2020-03-10
• Subjects: Information security -- Activity theory -- Information security policy compliance -- Employee compliance -- Non-compliance; Computer security -- Management -- Periodicals; Computer networks -- Security measures -- Periodicals; Data protection -- Management -- Periodicals; 658.47
• DOI: 10.1108/ICS-11-2018-0128
• Languages: English
• ISSNs: 2056-4961

Abstract

Abstract : Purpose: The purpose of this paper is to introduce activity theory (AT) as a new theoretical lens to the field of information security non-compliance by explaining how research in that field can benefit from AT and to suggest eight propositions for future research. Design/methodology/approach: Based on AT, the paper suggests that employees, IT systems, task characteristics, information security policies (ISPs), community and division of labor can be viewed to form an ensemble that is labeled activity. Their characteristics and/or the relationships that exist between them in organizational contexts are hypothesized to influence non-compliance behaviors. Findings: The paper suggests that AT provides a broad lens that can be useful for explaining a large variety of non-compliant behaviors related to information security. Research limitations/implications: The paper focuses only on non-compliant behaviors that employees undertake with non-malicious intentions and offers avenues for future research based on the propositions that are developed in the paper. Originality/value: The paper provides a useful step toward a better understanding of non-compliant ISP behaviors. In addition, it proposes and explains new research areas in the non-compliance field.