Who should own social media account governance in an organisation?

Why This Matters for Security Teams

Social media account governance is not just a brand or communications issue. The real risk sits in who can create, approve, reset, transfer, and recover access to the account. If those privileges are managed informally, organisations often end up with shared passwords, unclear recovery paths, and no reliable offboarding. That is exactly the kind of access ambiguity that turns a routine personnel change into an account takeover.

Security and IAM leadership should own the governance model because identity controls are the control plane, even when business teams own the message. Content owners can decide what gets published, but they should not be the sole arbiters of authentication, recovery, or privileged access. NHIMG’s Top 10 NHI Issues and the NIST Cybersecurity Framework 2.0 both point to the same operational pattern: control ownership must track risk ownership, not convenience.

In practice, many security teams encounter social account misuse only after a marketing departure, agency dispute, or phishing event has already exposed the gap.

How It Works in Practice

The clean operating model separates content ownership from access ownership. Marketing, communications, or customer care can own the editorial calendar, approval flow, and publishing standards. Security, IAM, or a delegated control owner should own the identity lifecycle, including joiner-mover-leaver events, recovery methods, multifactor authentication, and emergency lockout procedures. This is the same lifecycle logic described in NHIMG’s Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs, even though the account is human-facing.

In mature environments, access is granted through named roles, not shared logins. A social platform admin list should be limited, reviewed, and tied to accountable individuals. Recovery codes, API tokens, and password vault access should sit with security controls, not inside a marketing team inbox. Identity proofing and session assurance should follow principles consistent with NIST SP 800-63 Digital Identity Guidelines, especially where account recovery can bypass normal sign-in protections.

• Define a single control owner for authentication, recovery, and offboarding.
• Separate publisher permissions from administrator permissions.
• Use MFA, password vaulting, and documented recovery workflows.
• Review privileged access on a fixed cadence and after staff or agency changes.
• Keep an inventory of official accounts, platform admins, and emergency contacts.

This guidance breaks down when agencies, regional offices, or legacy platform arrangements create shadow administrators and nobody can prove who can still recover the account.

Common Variations and Edge Cases

Tighter governance often increases coordination overhead, requiring organisations to balance speed in publishing against stronger control over access. That tradeoff is real, especially for small teams that rely on a few multi-purpose staff members. Best practice is evolving, but there is no universal standard for whether marketing, security, or IT should hold the final administrative keys; the deciding factor should be accountability for identity risk.

Some organisations delegate day-to-day posting to marketing while keeping administrator rights in IAM or security. Others use a tiered model where communications owns routine publishing, IT handles platform configuration, and security approves privileged changes. The important point is that no single business team should control both message delivery and identity recovery without oversight. NHIMG’s Ultimate Guide to NHIs — Regulatory and Audit Perspectives is useful here because auditors will expect evidence of ownership, not just informal process knowledge.

For high-profile accounts, crisis access procedures should be pre-approved, tested, and limited to a small set of named responders. That is especially important for brands that depend on rapid response during incidents, since a locked-out account can become a reputational event as fast as a security one. In practice, teams that skip this work usually discover the weakness during a takeover, not during a planned access review.

Related resources from NHI Mgmt Group

• Who should be accountable for social media account governance?
• Who should own passwordless governance in a healthcare organisation?
• Why do shared social media accounts create a governance risk?
• What breaks when social media accounts are not brought under identity governance?