SAMPLE DOCUMENT Social Media Policy Disclaimer: This resource is intended to be used only as guidance in the development of a social media policy. Any policy developed should be reviewed by that organization s legal team.
Table of Contents Purpose 3 Scope 3 Policies 4 Reporting Requirements 5
Purpose Social media has become an important part of many people s lives and <THE COMPANY> encourages all employees to use social media. However, our company has a requirement to protect its information assets and to safeguard its customers, intellectual property and reputation. For your protection and the company s, it is important to use social media in the right way. The definition of social media necessarily is very broad, given the increasing tendency to integrate such technology into conventional, broadly used applications like email. It isn t just Facebook and Twitter. It is also Linkedin, YouTube, Flickr, blogs essentially, it s any platform designed for user conversation. While a great place to interact, social media also represents a significant risk to information security, being both a heavily targeted resource for malware/hacking and a place where corporate data is inadvertently leaked. This document outlines a set of practices and requirements for the safe use of social media and gives a framework for discussing <THE COMPANY> on social media. It is closely linked to other <THE COMPANY> policies, including the <COMPANY> Privacy Policy and Crisis Communication plan. Scope The <COMPANY> Social Media Policy covers all social media platforms, sites and applications used by employees or contractors at the premises of <COMPANY>, using <COMPANY S> equipment, services or Internet access, or representing <COMPANY> more generally. 3
Policies 1. Protect Company Information Through your relationship with <THE COMPANY>, you have access to confidential information that should not be made public. Do not share confidential customer information or customers personally-identifiable information. Loose tweets sink ships. Be aware that <COMPANY> competitors monitor social media so avoid mentioning customers, customer appointments, or any other information a competitor could find of value. 2. Disclose Your COMPANY Role When you talk about <COMPANY> on social media, always be transparent in your role with the company. It is important that you be very up front about this. 3. Be Responsible When engaging on social media in topics related to IT and/or IT security, be clear that you do not speak on behalf of <THE COMPANY>. All employees must disclose that thoughts expressed expressed here are my own and do not represent the views of my employer. A good rule of thumb is to always be honest. If you aren t an expert on the topic, be clear about that. The social media manager is the only person charged with releasing official information when circumstances call for it. Employees are not authorized to release official information. 4. Use Secure Passwords and Never Duplicate Them When accessing social media, all employees need use a secure password for all systems. To protect your information and <COMPANY S> this password must not be the same as any credentials used within the company. 5. Adopt Sensible Privacy Permissions The user must follow best practice for configuration of social media privacy permissions, where available, using controls to sensibly and appropriately restrict access to information. 6. Avoid Negativity Disprargaing remarks made by one <COMPANY> employee against another on any social media platform will not be toleterated and could be grounds for dismissal. A good rule of thumb is to keep your opinions on other <COMPANY> employees to yourself. If you see something written about <THE COMPANY> on social media that is inaccurate, or shouldn t be happening for any other reason, it is your duty to promptly report it to the <THE COMPANY.> 4
Reporting Requirements The user has responsibility to notify IT in the event of a breach, or if they have concerns that they are not in accord with this policy. The social media policy is supported by other operational and information security policies which are tracked as health metrics by IT. 5