Policy Register
Every policy type · Conduct

Social media policy

What people may say about the organisation, its customers and its information in public channels, and who speaks for it.

How the register reads it

Also calledonline conduct, external communications
FamilyConduct
Document typePolicy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds intoThe regimes accept it folded into the acceptable use policy; when neither is listed, the gap is counted once, under the parent.
Expected ownerCommunications or marketing, with HR.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whennever on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, acceptable use policy, is).
TemplateNo template yet. The clauses below say what the document is expected to contain.

Which standards require it, and what each expects it to contain

2 requiring clauses, 1 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.14 Information transfer

Put rules, procedures or agreements in place for every way information moves, inside and outside the organization.

What the ISO 27002 guidance expects the document to say: Requires transfer rules, procedures or agreements to be in place for every type of transfer facility, covering transfers within the organisation and between the organisation and outside parties.

Evidence an auditor accepts: Transfer rules covering each transfer type in use, being electronic, physical and verbal; transfer agreements with external parties, setting out protection, liability and traceability requirements; technical evidence of protection in transit, such as enforced transport encryption, secure file transfer configuration and managed file transfer logs
Common gap: Reliance on informal verbal agreements
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022
ISO 27001 5.10 Acceptable use of information and other associated assets

Define and enforce rules for how information and assets may be used and handled.

What the ISO 27002 guidance expects the document to say: Requires rules for acceptable use, and procedures for handling information and its associated assets, to be identified, documented and put into effect.

Evidence an auditor accepts: The acceptable use rules, covering personal use, removable media, cloud storage, email, messaging and use of artificial intelligence services where relevant; handling procedures per classification level, covering storage, transmission, printing, sharing and destruction; evidence rules were communicated and accepted by personnel and by third parties given access
Common gap: Policy not reviewed or updated regularly
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Code of conduct · Whistleblowing policy