In the first 24 hours of a ransomware incident, what single action do you take that most improves cyber insurance coverage outcomes and claim recovery? Could you share one phrasing, form, or evidence-preservation step you used recently?