How do we define containment and eradication phases within an incident response plan template for a ransomware event?