Ransomware is usually a personal data breach, especially when data was stolen. Both the encryption and any data theft must be assessed. Restoring from backup does not remove the duty to assess.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Assess unavailability and data theft separately
- Assume data theft until proven otherwise
- Coordinate with your incident responders
Making it stick
See the ransomware guide for the technical side. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.