Ransomware response is not mainly technical. The technical part is well understood. What goes wrong is that a small number of consequential decisions have to be made quickly, by people who are frightened, without complete information, often outside business hours.
Contain before you diagnose
The instinct is to work out what happened. The right first move is to stop it spreading: isolate affected hosts, disable the compromised accounts, and cut the paths between segments. Understanding the intrusion is essential and can wait twenty minutes. Encryption cannot.
Decide who is allowed to say yes
Someone has to authorise taking production offline. If that person is unreachable at 2am and nobody else is empowered, the incident lengthens by however long it takes to find them. Name a deputy, write it down, and make sure the technicians know both names.
Do not touch the backups yet
Restoring into an environment that is still compromised is a common and expensive mistake. It reinfects the clean copy and destroys the evidence you will need for your insurer. Verify the backups are intact and isolated, then restore in an agreed order once containment holds.
Start the clock on notification
If personal information may have been reached, PIPEDA obligations begin, and your cyber policy almost certainly requires prompt notice. Insurers frequently reserve the right to appoint counsel and a response firm, so calling them late can affect coverage. This is a phone call, not an email.
The part to do this quarter
Every one of these decisions is easier to make in daylight. A single page listing who authorises what, which systems come back first, and which numbers get called is worth more during an incident than any tool you could buy.