How to protect ZVM from ransomware attack

Recently, I have seen cases of AD-joined systems being infected from AD infected with ransomware.

Fortunately, the ZVM was not infected.

However, if a ZVM is infected, especially in a ZDP environment (without a peer site), what actions can be taken?

And I want to hear from everyone if there are other ways besides a local firewall to make ZVM more secure against ransomware attacks.