<Short Name> Information Security Policy

Social Networking Policy

1 Introduction
2 Scope
This document sets out <Short Name>’s social networking policy which is designed to allow
the company to take advantage of social media’s business benefits and promote its
products/services, contribute to the relevant online dialog, and better engage with customers
and prospects, while avoiding the significant risks involved.
This policy applies to all staff, including staff, contractors and interns etc. working for, or
under the control of, <Short Name>.

3 Revision History
Revision Date Record of Changes Approved By
0.0 [Date of Issue] Initial Issue

4 Control of hardcopy versions

The digital version of this document is the most recent version. It is the responsibility of the
individual to ensure that any printed version is the most recent version. The printed version
of this manual is uncontrolled, and cannot be relied upon, except when formally issued by
the <Document Controller> and provided with a document reference number and revision in
the fields below:
Document Ref. Rev. Uncontrolled Copy X Controlled Copy

5 References
Standard Title Description
ISO 27000:2014 Information security management systems Overview and vocabulary
ISO 27001:2013 Information security management systems Requirements
ISO 27002:2013 Information technology - security Code of practice for information security
techniques controls

6 Terms and Definitions

 “staff” and “users” means all of those who work under our control, including
employees, contractors, interns etc.

 “we” and “our” refer to <Short Name>

7 Responsibilities

Social Networking Policy Page 1 of 3

 <Short Name> Information Security Policy

Managers and supervisors are responsible for the implementation of this policy, within the
scope of their responsibilities, and must ensure that all staff under their control understand
and undertake their responsibilities accordingly.

8 Social Networking Policy

You should set out your social networking policy below. We have provided a ‘good practice’
model which hopefully meets most of your requirements. This document is part of your
ISMS.
A social networking policy will cover two main areas: employees’ use of social media at
work, and use of social media that affects the company.
For the first point, companies must decide what level of freedom to give employees. Some
employers choose to ban all use of social media sites, except when someone’s job requires
it, while others choose to have different rules for different positions within the company.
However, many experts recommend focusing on performance and simply warning
employees about excessive social media use that interferes with their work:

9 General
 all staff are expected to use the Internet responsibly and productively, and excessive
personal Internet browsing, including social media use, is not permitted

 we reserve the right to monitor how staff use company-owned property, including
computers and networking equipment, and employees should be mindful that any
and all web browsing they do on the company’s premises may be monitored

10 Social media posts about <Short Name>

 staff are forbidden from using social networks to post or display comments about co-
workers, supervisors or <Short Name> that are vulgar, obscene, threatening,
harassing, or a violation of our policies on discrimination or harassment

 staff may not use social networks to disclose any confidential or proprietary
information about <Short Name> or its employees, customers or business partners

 when appropriate, employees should disclose their relationship with <Short Name> in
their online posts and refrain from speaking on behalf of <Short Name> when not
authorised to do so

 staff should keep in mind that they are personally responsible for what they post
online and be mindful that what they say will be available publicly for a long period of
time

 social media use is subject to the same workplace policies staff must follow in other
situations, including but not limited to our policies regarding harassment,
discrimination, defamation, confidentiality, non-competition and general Internet use

11 Breaches of policy
<Short Name> will take all necessary measures to remedy any breach of this policy
including the use of our disciplinary or contractual processes where appropriate.

Social Networking Policy Page 2 of 3

 <Short Name> Information Security Policy

1 Records
Records retained in support of this procedure are listed in the ISMS Controlled Records
Register and controlled according to the Control of Management System Records
Procedure.

Social Networking Policy Page 3 of 3