nerdexam
Isaca

CISM · Question #326

Which of the following is MOST important to include in a social media policy?

The correct answer is C. Acceptable use of social media by employees. A social media policy's primary purpose is to define acceptable use - it sets clear boundaries on how employees may use social media in ways that affect the organization, covering both work-related and personal activity that could create liability or reputational harm. Without…

Submitted by krish.m· Apr 18, 2026Information Security Program Development and Management

Question

Which of the following is MOST important to include in a social media policy?

Options

  • ARecommendations for privacy settings on social media accounts
  • BRequirements for mandatory training on social media
  • CAcceptable use of social media by employees
  • DMonitoring rights of employee's social media accounts

How the community answered

(35 responses)
  • A
    3% (1)
  • B
    3% (1)
  • C
    86% (30)
  • D
    9% (3)

Explanation

A social media policy's primary purpose is to define acceptable use - it sets clear boundaries on how employees may use social media in ways that affect the organization, covering both work-related and personal activity that could create liability or reputational harm. Without this foundation, the policy has no core function.

Why the distractors fall short:

  • A (Privacy settings): Recommendations for personal privacy settings are helpful guidance but not a policy requirement - they're advisory, not enforceable organizational rules.
  • B (Mandatory training): Training programs may support a policy, but a policy can exist and function without mandating training; this is a supplementary element, not the core.
  • D (Monitoring rights): Monitoring clauses are legally sensitive and vary widely by jurisdiction; while some policies include them, they are not the most important element and can create legal exposure if not carefully crafted.

Memory tip: Think of a policy as answering "What CAN and CANNOT you do?" - that's acceptable use (C). Everything else (training, monitoring, privacy tips) supports or enforces that core answer, but the rules themselves must come first.

Topics

#Social media policy#Acceptable use policy#Policy development#Information security policies

Community Discussion

No community discussion yet for this question.

Full CISM Practice