Most social media policies fail in the same place. They are written as a list of prohibitions, the prohibitions cover things nobody was going to do, and the two situations that actually arise are not addressed at all: an employee posting about work on a personal account, and somebody replying to a customer from the company account without being asked to. A policy that does not settle those two says nothing, however long it is.
Who is authorised to speak as the company
Name the accounts and name the roles that may post from them, and say what happens when somebody outside that list is the first to see a complaint. This is the single most useful line in the document because it is the one that gets tested on a bad afternoon. A policy that only says employees must be professional leaves the question of authority open, and an open question at speed becomes whoever felt confident enough to answer.
What a personal account may say about work
Say plainly what is confidential, which is usually customers, unreleased work and anything covered by an agreement, and be equally plain that ordinary discussion of pay and working conditions is not something this document is trying to reach. A policy drawn so wide that it appears to forbid employees discussing their own terms invites a fight you did not need. Narrow it to the two things you actually care about: confidential information, and speaking as the company without authority.
The disclosure line, and why it is short
If employees post about the company's products, ask for a plain disclosure of the relationship in the post itself. One sentence in the policy, one phrase in the post. Keeping it short is the point: a disclosure rule people can remember is followed, and one that runs to a paragraph is a rule nobody applies at the moment they are typing on a phone.
Agreement, and why an unread policy is not one
A social media policy is only worth having if the people it binds have seen the current version. That means a record: which version, which person, which date. It is the part that gets skipped, and it is the only part anybody asks about later. The free builder on this site produces the document and the acknowledgement record together, because a document nobody agreed to is a draft with a title.
Questions people ask about social media policy
Should the policy list banned platforms?
No. Platforms change faster than policies do, and a named list dates the document. Write the rule about conduct and confidential information and it survives the next app.
Does it apply outside working hours?
The confidentiality part does, because confidential information does not become public at six o'clock. The speaking-as-the-company part only applies when somebody is doing exactly that.
How long should it be?
One page. The six questions above fit on one, and every additional page reduces the number of people who have read to the end of it.