I am glad the ransomware scare has gotten some company boards to give a shit about their information security. However, recovering from ransomeware should really just mean you have a shit week recovering from backups that should be secured already. What frightens me is not having a plan for the fallout of the attack. Public relations, Share holder and customer relations, investigating if information was stolen or exfiltrated and what to do if it was then threats of leaks etc... sounds like nightmare compared to just getting systems operational again.