# GRC assessment and incident-response program

[Source](https://listentosee.com/work/b6-grc-incident-response-biotech)

A delivered risk assessment, security-training rollout, AI usage-policy work and incident-response planning across a multi-site business.

Client: A publicly traded biotech company.

Historical engagement years: 2023–2024.

Sectors: Biotech.

Related services: [Governance, Risk & Compliance](https://listentosee.com/services/governance-risk-compliance); [Business Continuity Strategy](https://listentosee.com/services/business-continuity).

Work stories describe separate historical engagements. Engagement years are not publication dates and do not imply a continuous contract. Preserve each story's distinctions between delivered work, tested implementations, previews, planning and later advice. Retain partner credits and the anonymized descriptions of private clients.

## Context

A small, publicly traded biotechnology company with several facilities needed a clearer picture of its cyber and data-privacy risks, policy ownership and readiness to respond to an incident.

## Engagement

In 2023 we conducted a governance, risk and compliance assessment using leadership interviews, an employee survey, visits to three facilities and a vendor review. Follow-on work translated the findings into training resources and response-program preparation.

## What we delivered

- A digital-risk assessment and executive findings/recommendations, delivered in September 2023.
- Response-team roles, escalation and incident-response planning documents, with reporting and regulatory considerations for review.
- A generative-AI usage-policy document, an employee-training model and awareness materials.
- Wizer security-training setup, custom-training authoring guidance and successive learning modules.
- Draft response plans and tabletop scenarios to support preparation for future exercises.

## Outcome

The assessment identified unclear policy ownership and uneven awareness alongside existing governance strengths. It gave leadership a documented set of priorities for continuity, responsibility, vendor review, access and training.

The training program moved into use: an April 2024 staff announcement recorded completion of the first module and introduced the second. Response plans and tabletop materials were prepared, but the available evidence does not establish a completed tabletop exercise or formal adoption of every recommendation.

Generated images are illustrations, not photographs of actual client projects or evidence of delivery. Archive artifacts are separately identified on the source pages.