The reason the company had to pay the ransom is because they did not have valid backups, otherwise they would have just restored their data. If your company just had to pay ransom and your boss says, "Don't let this happen again", what is the first thing you are going to do. The only action after a ransomware attack is "restore from backup".

SOAR (Security Orchestration, Automation, and Response) Can use either playbook or runbook. It assists in collecting threat related data from a range of sources and automate responses to low level threats. (frees up some of the CSIRT time)

Containment is the next step according to the incident response process after identifying affected devices that are running a malicious application with a unique hash. Containment involves isolating the compromised devices or systems from the rest of the network to prevent the spread of the attack and limit its impact. Containment can be done by disconnecting the devices from the network, blocking network traffic to or from them, or applying firewall rules or access control lists. Containment is a critical step in incident response because it helps to preserve evidence for further analysis and remediation, and reduces the risk of data loss or exfiltration
https://www.fortinet.com/resources/cyberglossary/incident-response
https://www.ibm.com/topics/incident-response

There are mainly three types of backup: full, differential, and incremental.
Let's dive in to know more about the types of backup, the difference between them and which one would be the best fit for your business.

Full Backup
A full backup is the most complete type of backup where you clone all the selected data. This includes files, folders, SaaS applications, hard drives and more. The highlight of a full backup is the minimal time it requires to restore data. However, since as everything is backed up in one go, it takes longer to backup compared to other types of backup.
The other common issue with running full backups is that it overloads storage space. That's why most businesses tend to run a full backup and occasionally follow it up with differential or incremental backup. This reduces the burden on the storage space, increasing backup speed.
Differential Backup
A differential backup straddles the line between a full and an incremental backup. This type of backup involves backing up data that was created or changed since the last full backup. To put it simply, a full backup is done initially, and then subsequent backups are run to include all the changes made to the files and folders.
It lets you restore data faster than full backup since it requires only two backup components: an initial full backup and the latest differential backup.
Let's see how a differential backup works:
Day 1 - Schedule a full backup
Day 2 - Schedule a differential backup. It will cover all the changes that took place between Day 1 and Day 2 Day 3 - Schedule a differential backup. It will make a copy of all the data that has changed from Day 2 (this includes the full backup on Day 1 + differential backup) and Day 3.
Incremental Backup
The first backup in an incremental backup is a full backup. The succeeding backups will only store changes that were made to the previous backup. Businesses have more flexibility in spinning these types of backups as often as they want, with only the most recent changes stored.
Incremental backup requires space to store only the changes (increments), which allows for lightning-fast backups.
Difference Between Full, Differential and Incremental Backups
Full
Differential
Incremental
Storage Space
High
Medium to High
Low
Backup Speed
Slowest
Fast
Fastest
Restoration Speed
Fastest
Fast
Slowest
Media Required for Recovery
Most recent backup only
Most recent full backup &most recent differential backup
Most recent full backup &all incremental backups since full backup
Duplication
Stores a lot of duplicate files
Stores duplicate files
No duplicate files