Ransom decisions

Paying may or may not get your systems back, and it does not reliably stop stolen data being published.

That is the uncomfortable part. Payment buys a decryption tool of variable quality and a promise from criminals, and there are well-documented cases of data being published or resold afterwards anyway. It is a business decision made under duress, with legal and sanctions implications, and it belongs with executives and lawyers rather than with the technical team. Deciding the principle in advance, calmly, is worth doing.