The best way to protect company sensitive information from being exposed when an organization allows employee use of social media accounts for work purposes is to require employees to sign nondisclosure agreements. Nondisclosure agreements are legal contracts that prohibit the employees from disclosing or sharing the company sensitive information with unauthorized parties, such as competitors, media, or regulators. Nondisclosure agreements also specify the scope, duration, and conditions of the nondisclosure obligation, and the penalties or remedies for breaching the agreement. Requiring employees to sign nondisclosure agreements is the best way to protect company sensitive information, as it helps to prevent or deter the employees from exposing or leaking the company sensitive information on social media, and to hold the employees accountable and liable for their actions. Requiring employees to signnondisclosure agreements also helps to comply with the legal and regulatory requirements for data protection and privacy. Educating employees on what needs to be kept confidential, implementing a data loss prevention (DLP) solution, and taking punitive action against employees who expose confidential data are also useful ways, but they are not as effective as requiring employees to sign nondisclosure agreements, as they are either dependent on the employees’ awareness or behavior, or reactive or corrective measures, rather than proactive or preventive measures. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 217.