Who should own governance for social media and other disconnected business accounts?

Why This Matters for Security Teams

Disconnected business accounts such as social media profiles, campaign tools, and community logins often sit outside traditional IAM programs, yet they can still expose the brand, customer data, and regulated communications. The governance question is not just who can post, but who can approve access, enforce MFA, and remove dormant access before it becomes a takeover path. That is why this belongs in the same control conversation as the NIST Cybersecurity Framework 2.0 and NHI lifecycle discipline described in Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs.

Ownership fails when teams assume the business “naturally” manages these accounts because they are not core infrastructure. In practice, that assumption creates orphaned credentials, weak recovery settings, and access that outlives staff changes or agency transitions. NHIMG’s research shows the scale of the issue: only 1.5 out of 10 organisations are highly confident in securing NHIs, according to The State of Non-Human Identity Security by Astrix Security & CSA. In practice, many security teams encounter account misuse only after a brand incident or unauthorized post has already occurred, rather than through intentional review.

How It Works in Practice

The practical model is shared ownership with explicit control boundaries. Security owns the governance standard, while the business function owns legitimate use of the account. That means security defines the minimum requirements for MFA, approved recovery methods, admin role separation, logging, and periodic access review. The business owner validates who actually needs access, why they need it, and when that access should expire. This aligns with the control intent in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially around access enforcement, account management, and auditability.

A workable process usually includes:

• A named business owner for each account, with a backup owner for continuity.
• Security-approved MFA and recovery controls, never shared casually across teams.
• Role-based access for editors, publishers, and approvers, with removal tied to role changes.
• Quarterly access review for high-visibility accounts, with evidence retained for audit.
• Documented offboarding steps for employees, agencies, and temporary campaigns.

For identity assurance and recovery, teams should also align with NIST SP 800-63 Digital Identity Guidelines, even when the platform itself is consumer-facing. The point is not to force every social account into a full enterprise IAM stack, but to apply the same governance rigor to a disconnected account as would be expected for any privileged business asset. These controls tend to break down when agencies, contractors, and regional marketing teams all share one login because nobody can prove who approved access or who still needs it.

Common Variations and Edge Cases

Tighter control often increases operational friction, requiring organisations to balance campaign speed against account safety. That tradeoff becomes most visible in fast-moving marketing, crisis communications, and regional brand teams, where password sharing can look convenient but creates a permanent governance gap. Best practice is evolving, but current guidance suggests that convenience should never override accountable ownership or revocation discipline.

There are a few common exceptions. In a small business, one person may perform both business and security functions, but the controls should still be documented. In highly distributed enterprises, local teams may manage content while central security retains policy authority and emergency lockout rights. For third-party managed accounts, the vendor should never be the sole owner; the internal business function must retain ultimate accountability and access recovery. That distinction matters because disconnected accounts often overlap with broader NHI risk patterns, as reflected in Top 10 NHI Issues and the audit-oriented guidance in Ultimate Guide to NHIs - Regulatory and Audit Perspectives.

Security should also treat these accounts as part of the broader attack surface described in the ENISA Threat Landscape, especially where account compromise could be used for phishing, fraud, or impersonation. The governance answer is shared ownership, but with security holding the policy keys and the business holding operational accountability.

Related resources from NHI Mgmt Group

• Why do shared social media accounts create a governance risk?
• What breaks when social media accounts are not brought under identity governance?
• How should organisations govern business social media accounts that sit outside IAM?
• Who should own social media account governance in an organisation?