Template content

We need some guidance in understanding and applying one section of your template for the Acceptable Use Policy, §3.14 — E- mail and other message exchange methods.

The final paragraph of that section requires that “Each e-mail message must contain a disclaimer, except messages sent through communication systems determined by IT Manager. Should a user post a message on a message exchange system (social networks, forums, etc.), he/she must unambiguously state that it does not represent the organization's viewpoint.“

It is not clear to us the intended purpose or scope of this requirement. Does it apply to both business and personal messages?  We state elsewhere that only business communications may take place over the organization’s information exchange systems. Is it referring to postings on social mediatalking about the company which should state that it does not represent the organization's viewpoint? Can you give us examples of the kind of disclaimer that is intended here? I find no direct reference to this within ISO 27001.

Is this really two separate requirements?  One for all e-mail communications stating privacy requirements that we often see at the bottom of incoming e-mails, and another requirement stating that someone's personal opinion does not necessarily represent the organization’s viewpoint. Can you please help us understand this requirement so we can establish the appropriate controls.