In my comment above I talked about applying security standards or backups, I see that forcing companies to have backups is more viable... To better understand

In my comment above I talked about applying security standards or backups, I see that forcing companies to have backups is more viable... To better understand my point of view, read my example above and the comment of "luckylion ". Companies are simply not going to report because their intellectual property becomes more valuable than the ransom payment. This law does not mitigate anything, instead a backup regulation would mitigate the problem (because it would not be necessary to pay the ransom, if you need such explicit help to understand things).