Yes, and both can be short. An internal social media policy tells employees what they can say about the company publicly, what is confidential, how to disclose their affiliation when they comment in industry communities, and who to escalate to when something looks like a problem.
A crisis plan names who has authority to pause scheduled posts, who drafts the response, who approves it, and what the holding statement says while you establish what actually happened.
Write both before you need them, because the drafting happens badly under pressure. The most common social crisis is not a scandal, it is a cheerful scheduled post publishing during a national tragedy or during your own service outage, and the fix for that is one named person with pause access and the authority to use it.
