I’m curious if the average company even bothers planning/testing their ability to recover from a ransom ware attack wo paying. Like do they even bother plannin

I’m curious if the average company even bothers planning/testing their ability to recover from a ransom ware attack wo paying. Like do they even bother planning for that or are they unaware of the risk or did they decide it’s more cost effective to purely rely on prevention and plan to pay any ransom. I feel like there should be a regulation, where if they pay the ransom then they get a penalty of 2-5x the ransom charged.