With the first 24 hours being the most crucial, it's important that organisations are aware of what must be done in order to first assess any damage caused and what mitigation can be placed in order to contain the threat, with a retrospective view on pro-active layered controls that would have served to reduce the probability of a successful attack in the first place.