What organisations can learn from the fine over Capita's ransomware incident