This obligation won’t be backed by a fine if the company fails to comply, and businesses will still be permitted to pay ransoms, though this is discouraged.