LINK I thought this was well written. I suggest taking a look on vulnerability scanning and the frequency of the scanning.
LINK This is a good document. Not all may apply to you but most will. Alot of the data here provides a good list of items that can help pressure business owners and other service owners to make appropriate changes to avoid catastrophic infections by ransomware.