Making the Hard Choices for Ransomware Readiness and Response