If clean backups are available, then these can be used to restore service.
6. Lessons learnt, improve future responses - once the threat has been fully remediated the next step will involve answering the question ‘how do we stop this from happening again?’