Ransomware IR — Playbook, Containment, and Recovery

Execute a structured ransomware response: stop encryption spread, scope the blast radius, evaluate decryption options, negotiate or restore from backup, and prevent re-encryption.