If your business turns over more than $3 million, or runs critical infrastructure, and pays a ransom or extortion demand, you have 72 hours to report it to the...