Social Media Usage Policy

Purpose

This policy establishes Westlink Logistics’ requirements for the appropriate use of social media. It protects the organisation’s reputation, safeguards confidential and security-classified information, mitigates social engineering risks, and ensures compliance with information security obligations under the ISM and DISP frameworks.

Scope

This policy applies to all Westlink Logistics directors, workers, contractors, and labour hire workers. It covers all social media platforms including Facebook, LinkedIn, X, Instagram, TikTok, YouTube, Reddit, online forums, blogs, and messaging platforms with public-facing features. It applies to both business and personal use where there is a connection to Westlink’s operations, clients, or personnel.

Organisational Context

Westlink Logistics operates heavy haulage, project logistics, and maritime services across Australia, primarily supporting defence, government, resources, and infrastructure sectors. Workers may have access to security-classified information, client-sensitive project details, and operational information that could be exploited through social engineering if disclosed on social media.

The organisation holds DISP membership requiring personnel security standards, and is subject to JOSCAR pre-qualification including information security requirements. Social media usage is a recognised vector for insider threat, social engineering, and inadvertent disclosure of classified or sensitive information.

Policy Commitments

Westlink Logistics requires that:

• No confidential business information, client details, contract specifics, project locations, cargo descriptions, vessel movements, or information classified under the PSPF or DISP is disclosed on social media. No photographs or videos from operational sites or client facilities are posted without prior written approval.

• Workers holding or seeking Australian Government security clearances exercise heightened caution. Social media activity may be considered during security vetting and ongoing suitability assessments under DISP personnel security requirements.

• Workers limit work-related information visible on personal social media profiles, configure privacy settings to restrict visibility, and treat unsolicited connection requests from unknown individuals with caution, reporting suspicious contacts to the QHSE Manager.

• Official Westlink social media accounts are managed only by authorised personnel. When expressing personal opinions online, workers must make clear the views are their own and not those of Westlink Logistics.

• Westlink may monitor use of social media on company devices and networks for security and compliance purposes. Breaches may result in disciplinary action and, where security-classified information is involved, referral to relevant authorities.

Responsibilities

Review

This policy is reviewed annually as part of the management review cycle, or following a social media security incident, significant change to ISM or DISP requirements, or emergence of new platforms presenting novel risks. This policy is communicated to all workers at induction and is available on the WMS.

Applicable Standards and Legislation

• Australian Government Information Security Manual (ISM) — ACSC

• Defence Industry Security Program (DISP) — Security Governance Framework

• Protective Security Policy Framework (PSPF)

• Fair Work Act 2009 (Cth)

• Privacy Act 1988 (Cth)

• ISO 9001:2015 Quality Management Systems — Requirements

Related Documents

• TEC-POL-001 Information Security Policy

• GOV-POL-006 Workplace Behaviour Policy

• GOV-POL-015 Privacy Policy

• DEF-POL-001 Security Policies and Plans