Which of the following should be done FIRST after a ransomware incident has been successfully contained?
Notify relevant stakeholders.
Conduct forensic analysis.
Perform lessons learned.
Restore impacted systems.
Submit