An activity theory approach to information security non-compliance

Abstract

Purpose The purpose of this paper is to introduce activity theory (AT) as a new theoretical lens to the field of information security non-compliance by explaining how research in that field can benefit from AT and to suggest eight propositions for future research. Design/methodology/approach Based on AT, the paper suggests that employees, IT systems, task characteristics, information security policies (ISPs), community and division of labor can be viewed to form an ensemble that is labeled activity. Their characteristics and/or the relationships that exist between them in organizational contexts are hypothesized to influence non-compliance behaviors. Findings The paper suggests that AT provides a broad lens that can be useful for explaining a large variety of non-compliant behaviors related to information security. Research limitations/implications The paper focuses only on non-compliant behaviors that employees undertake with non-malicious intentions and offers avenues for future research based on the propositions that are developed in the paper. Originality/value The paper provides a useful step toward a better understanding of non-compliant ISP behaviors. In addition, it proposes and explains new research areas in the non-compliance field.

Organizational Determinants and Compliance Behavior to Shape Information Security Plan

“…The organizational role embodies the responsibilities, duties, and functions assigned to individuals within the organizational structure Khatib and Barki (2020). It serves as a framework that delineates the scope of an individual's professional engagement and the tasks they are expected to perform.…”

How different rewards tend to influence employee non-compliance with information security policies

“…However, as Sommestad et al (2014) observed in their meta-analysis, the results of the 29 studies they examined have not been consistently similar, with variables showing considerable variations among different studies in terms of how they influenced compliant/ non-compliant behaviors. Recent studies have also suggested that an interplay is likely to exist among the variables that explain non-compliance (Khatib and Barki, 2020b;Vance et al, 2020;Woltjer, 2017). This paper draws from RCT to explain the different possibilities summarized above.…”

“…Despite the growing literature on information security non-compliance, recent research has observed disparate results among the variables that have been used to explain noncompliance (Sommestad et al, 2014). This, in turn, suggests that examining an interplay of variables could better explain non-compliance (Khatib and Barki, 2020b;Woltjer, 2017). This paper drew from rational choice theory (RCT) to follow these suggestions and examine what motivates many employees to engage in non-compliant behaviors routinely.…”

The role of organizational and social factors for information security in a nuclear power industry

“…There has been little research attention paid to the role of organizational factors in relation to the management of information security (Al-Darwish and Choe, 2019). Khatib and Barki (2020) held forth that it is important to consider the organizational circumstances, not only individual perceptions, when trying to understand non-compliance in information technology (IT) contexts. Factors, such as organizational security culture and climate, and sanctions (Alfawaz et al, 2010;Bulgurcu et al, 2010;D'Arcy et al, 2014), have been found to influence information security compliance.…”