1Eradicate, then restore
Before restoring service, remove what the attacker left: persistence such as scheduled tasks or new accounts, the entry point (patch it), and every credential they may hold (reset and revoke sessions). Restoring onto a host the attacker still controls invites them straight back.
2Backups that survive an attacker
The 3-2-1 rule: three copies of the data, on two different types of media, with one copy offsite. Against ransomware, at least one copy must also be offline or immutable, because attackers deliberately find and destroy reachable backups before encrypting.
An untested backup is a hope, not a backup. Restore from it regularly and time how long it takes.
3Verify, don't assume
Recovery is finished when the observed state matches the expected state: services healthy, the indicators gone, no beacon, no new persistence. Keep watching for a while, because re-infection often shows up days later. Close the incident only once that is verified.