I am sure there are some links etc (she said helpfully) to dos and don'ts. I'm still trying to find you one that is any good!
Tell him that anything he writes or posts can be seen by everyone he knows. Don't let him fall into the trap of saying something nasty about someone, as it's so easy for someone else to then forward it on and cause problems.
Go on it yourself and become his friend. This will remind him he shouldn't put anything on there he doesn't want you to see. Lose your virginity I really believe it's important for you to be on it too. It can't be this strange world where you assume everything that goes on there is OK (not that it sounds like you are assuming that).
Tell him its only for contact with people he already knows in RL. Anyone who tries to contact him who he doesnt' know, tell him to "Ignore" them (this removes the friend request), even if they are friends with his other friends. I guess this will become a battleground in the future but at his age he shouldn't be friending mystery people.
Set the security so he can only be seen by friends. Often the default is "friends of friends", I would take that off.
Make sure he doesnt' give a phone number or address. Facebook has lots of spaces to put information but fields can be left blank.
Your goal is to help him communicate with his friends but to also ensure he doesn't come to the notice of someone dodgy, who then has a chance to build a relationship with him. So you need to a) hide his details from general searchers and b) make sure he doesnt' respond to invitations if people find him.
Will keep looking for a sensible dos and don'ts list. HTH.