Context
A small, publicly traded biotechnology company with several facilities needed a clearer picture of its cyber and data-privacy risks, policy ownership and readiness to respond to an incident.
Engagement
In 2023 we conducted a governance, risk and compliance assessment using leadership interviews, an employee survey, visits to three facilities and a vendor review. Follow-on work translated the findings into training resources and response-program preparation.
What we delivered
- A digital-risk assessment and executive findings/recommendations, delivered in September 2023.
- Response-team roles, escalation and incident-response planning documents, with reporting and regulatory considerations for review.
- A generative-AI usage-policy document, an employee-training model and awareness materials.
- Wizer security-training setup, custom-training authoring guidance and successive learning modules.
- Draft response plans and tabletop scenarios to support preparation for future exercises.
Outcome
The assessment identified unclear policy ownership and uneven awareness alongside existing governance strengths. It gave leadership a documented set of priorities for continuity, responsibility, vendor review, access and training.
The training program moved into use: an April 2024 staff announcement recorded completion of the first module and introduced the second. Response plans and tabletop materials were prepared, but the available evidence does not establish a completed tabletop exercise or formal adoption of every recommendation.