A practical checklist for the first day of a ransomware incident: containment, evidence, comms, and recovery.
