You make a valid point that when a user “reacts” to a security breach, it is simply that, a reaction. It is much better to be proactive than reactive, as you outline in your post.

It is interesting to note that Twitter's internal security controls were not as tight as they should be, and that is a great lesson for any business using the service. While it is a great idea to establish those guidelines you mention, it is even more important to share those guidelines through policymaking and enforcing them regularly.

Just because one person is prudent about online information doesn't mean that somebody else will be! Any marketing initiatives that place another employee at the controls of a personal or business Twitter account should have a Security Policy in place.