By now, most companies use social media as part of their marketing mix, but only 63% have implemented a social media policy according to a 2014 study from Protiviti.

Jay Shepherd has suggested that organizations adopt a very simple, two-word policy relating to employee blogging (which he’s since extended to social media): “Be professional.”

I might double this in size and suggest “don’t be a moron,” although the results should be largely the same.

If you hire the right people (professional non-morons), their use of social media should not expose you to an inordinate amount of risk. In some instances, having a policy could cause problems you didn’t have before.

For instance, most employees are “at-will,” meaning they can be fired at any time for almost any legal, non-discriminatory reason. However, if you adopt a social media policy, then use that as the basis for firing someone, that employee might appeal their termination to the National Labor Relations Board.

Depending on the nature of their social media offense, they might be able to have their termination declared illegal. Posts complaining about working conditions, for instance, are protected according to the NLRB.

You now have a problem you didn’t have before, and even if you ultimately win the argument, you will lose money and time in the process.

If you do elect to formalize a social media policy, there are examples from which you could draw. (See 5 Great Corporate Social Media Policy Examples.)

Here are some provisions you’ll want to include.

What “social media” means.
Everyone has a slightly different idea of what is or isn’t covered. Most people would assume the policy covers Twitter and Facebook, but what else? Pinterest, for example, is a “taste graph,” technically speaking, and not a social network, but clearly it has social elements. Does your policy apply to Pinterest? Online forums? Comments on third-party sites or blogs? Define what’s included, but try and leave room for the evolution of new social networks and platforms. You don’t want to edit the policy every time a start-up gets funded!

A caution against sharing confidential information.
Explain what kinds of company information are confidential and should not be shared via social media, email, or other channels (client data, upcoming plans, trade secrets, other intellectual property, etc.). Take care not to be too broad in your phrasing: if your policy might apply to employees discussing working conditions or wages among themselves, it’s very likely that the NLRB would not enforce it.

A statement against speaking as the company’s official representative (unless you are the company’s official representative)
If your company is large, name the point-person (or position title) responsible for fielding certain kinds of inquiries.For instance, media inquiries should be directed to the Director of Public Relations, customer service inquiries should be directed to any member of the Customer Service department, employment inquiries go to the Human Resources Coordinator, etc.

However you want the workflow to go, specify it in your policy. Explain the protocol for crisis communications, as well. Otherwise, loyal employees might make well-intentioned posts that reveal information before the company’s ready, or else misstate the situation because you don’t yet have all the facts.

Specify who is authorized to speak on behalf of the company during a crisis situation, and consider assigning someone different for each type of crisis (your CFO for a financial issue, CMO for a social media gaffe, CEO for a general organizational crisis, etc.).

No anonymous posting
It’s natural for employees to feel protective of your brand: ideally, they are your biggest fans. However, employees posting anonymously in response to negative reviews or comments about your company will ultimately do more harm than good, because the identity of the commenter always comes to light sooner or later.

Let your employees know that if they speak publicly about your brand, they must use their own identity and disclose their relationship with your company.

State who owns your brand’s social channels
This should be an easy one. If someone at your company creates an official presence online, anywhere other than your site, the company owns it. Specify that any profiles or pages created by employees in their official capacity on behalf of the company are company-owned.

Require all online accounts be opened using a company email address (ideally, Facebook@YourCompany.com) or something similar, so you can easily reset the passwords and restrict access if an employee leaves the company.

Clearly explain the consequences of violating the policy
This is the “or what?” If you tell employees they can’t do something, they need to know what happens if they do it.Typically, you’d want to extend the penalties for “real world” offenses to social media, as well. If calling another employee a “whore” offline would result in firing, the same should be true for an online posting.

Explain which person or department is in charge of enforcing the policy, and what procedures you will have in place for appealing decisions.

Overall, the benefits of implementing a social media policy outweigh the risks, because they help to clarify what’s expected of everyone involved.

Do consider the appeal of a four-word policy, though: most of the time, “don’t be a moron” just about covers it.