A social media account can become an operational dependency long before anyone adds it to the technology inventory. The original creator moves roles, an agency is replaced, or the recovery code goes to a phone the organization no longer controls.
Keep the channel under organizational control
The public profile depends on identities and tools plus continuing responsibility.
RDA approaches these accounts as organizational assets supported by User Credentials. Knowing the public account name is not enough; the organization also needs to know who can administer it, publish through it, and recover it.
Assign ownership and publishing roles
Record the organizational owner and the platform accounts or business tools used to administer the channel. Where the platform supports delegated roles, give staff the access appropriate to their work. Review both direct access and agency or scheduling-tool connections.
The NCSC's social media guidance emphasizes authorized publishing, appropriate security features, approval practices, and recovery planning. Read the official source.
Secure the identity behind the profile
The identity source may be the platform's own user directory rather than a company domain controller. Establish who owns each authorized identity, protect sign-in, and maintain recovery arrangements appropriate to the platform. Read about Credential Security and MFA.
Include external agencies and integrations
An outside agency's access should have a named organizational approver, a defined purpose, and a process for removal. Third-party publishing tools may retain access even after a staff password is changed. Maintain a list of those connections and review their permissions when the relationship changes.
Practice the handover
When someone leaves or a contract ends, remove their roles and review recovery details, connected tools, and any shared credentials they knew. Confirm that authorized backup staff can still work without relying on the departing person. See the Offboarding guide.
Keep approval separate from the ability to publish
A technically valid account can still publish content that has not been authorized. Document who prepares, reviews, and approves material, including urgent announcements. Coordinate those responsibilities with the organization's communication policy and recordkeeping requirements where applicable.
RDA can help connect the asset record, credentials, vendor access, and staff-change procedure. Begin with a short review of who can publish today and how the organization would regain control if a key person were unavailable.