Pass the law to 1) forbid public entities from paying ransom; 2) stringent public timely (less than 24 hours) reporting incidents; 3) stringent public reporting on root cause analysis/resolution/future remediation.

If it is a legal requirement of my job to do the right thing, I'm gonna do the right thing.