Social media - part 3

Risk management

We like our risk management, don’t we? It allows us to identify risks, and take action to mitigate them. Risk Management can and should be applied to social media usage.

It makes good sense to manage the risk by having a very clear social media policy. If an organisation thinks that reduced productivity will be the result of allowing staff to have access to social media, they are missing the point. People who want to waste time will find a way to waste time! It is usually a sign that the employee is disengaged.

Social media can be an excellent way to engage people across the organisation, both internally, and with external stakeholders, as long as the social media policy is clear, relevant, and communicated.

The social media policy needs to have clear guidelines about confidential or proprietary information. It should make it very clear to employees what the employer expects of them when they use social media, both in work and on their personal time. It should include reference to the other policies that the employees are bound by, such as:

  • Anti-discrimination
  • Sexual harassment and bullying policies,
  • Referring to management, board, shareholders in social media and so on.

Make sure your employees know that they need to issue a disclaimer stating that opinions expressed in blogs, Twitter, Facebook etc are the employee’s own opinions, and do not necessarily reflect the opinions held by the company. This is now common practice, and serves to protect the brand and reputation of the organisation.

Read Part 1: Is social media really a risky business. Read Social media - Part 2: The benefits of social media.

Performance management and review should not be discounted as a means of reducing risk. Social media codes of conduct can be built into employees’ key performance indicators, and compliance with company policies is also a valid measure. Any inappropriate use of social media to the detriment of the organisation should immediately invoke a performance management meeting with the employee’s manager, and disciplinary action taken, as outlined in the social media policy.

We need to make sure that managers understand that this level of performance management is required of them as part of their own performance measure, and they cannot be negligent in this area. I know of organisations that won’t allow access to social media and adopt a ‘parental style’ approach to management, rather than have the hard conversation with the minority who may abuse the use of social media. Finally, one clear risk is the organisation not acknowledging the inevitability of the role social media is playing in our lives, both at home and at work. If we as employers don’t acknowledge and embrace social media, we are already on the back foot. The sooner we accept it, see the benefits, and put a social media Policy in place, the lower the risk to the organisation.

What Next?

Allow your staff to learn as much as they can via social media. Don’t just give one person the privilege; it limits the reach and the perspective. When you allow your staff to use social media, understand that they will use it sometimes to take a break from whatever they are concentrating on. If you do not allow it, they will find other means of getting ‘down time’, they will not be more productive, and they will definitely not be more engaged! We all need to feel trusted to do our jobs.

Focus on the results, not on the activities. Remember, you employed adults — so let them take responsibility for their own means of delivering the end result (within company policies of course).

Let them tell others what a great place it is to work, and how they can be creative and resourceful with the latest means of communicating and information gathering at their fingertips. You will end up the winner.

Tags: social media policy, risk management, productivity, business, social media
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Open Space Security Suite

Kaspersky Open Space Security provides complete business protection in a single integrated suite of applications that work seamlessly across all platforms.

Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.