Infrastructure firms will now have to report within 24 hours if they make a ransomware payment. “This surely will be a game changer.”