The correct answer is A because a social media policy is primarily intended to protect the organization from reputational, legal, confidentiality, and brand-related risks arising from employee or corporate use of social media. Social media can quickly expose the organization to public criticism, unauthorized disclosures, inappropriate statements, misinformation, privacy violations, and brand damage. While productivity may be affected by social media use, productivity is not usually the most important information security or governance concern. Monitoring employee internet activity may be one method of enforcement, but it is not the main reason for having the policy. Preventing malware is important, but malware risk is normally addressed through technical controls such as web filtering, endpoint protection, and awareness training. A social media policy defines acceptable use, responsibilities, restrictions, approval requirements, and consequences. In CISM terms, policies should address business risk and protect organizational value. Since social media misuse can significantly harm public trust and reputation, protecting the company brand is the best answer.
Reference: CISM Information Security Governance; policy development, acceptable use, reputation risk, communication risk, and organizational governance principles.