If it helps, I don't mind sharing (of course after removing everything that's confidential to my organization) the Incident Response Checklist that I specifically built for when a Ransomware attack is observed on the network. It has been tested, reviewed and vetted by large consulting firms.
