The literature has mainly focused on examining information security behavior at the individual level. However, information security practice incorporates structural elements and as such may be explored as a social practice. In a preliminary step, we briefly review theories of social practice and explore information security as a social practice. We derive three propositions related to (1) the three elements of materials, competences, and meanings, (2) the relation of information security with other practices, and (3) the necessity of retaining practice “hosts.” We briefly discuss the potential implications of this work.