Ransomware response playbook: the first hour, 24 hours and 72 hours

A timed ransomware playbook: what to do in the first hour, the first 24 hours and the first 72 hours, from isolation and evidence to reporting, the ransom decision and a clean restore.