All I can say here is that my experience with ransomware response is that _every_ company has some document stating they can recover from scratch with backups in x hours, and in no case have I ever seen those hours be accurate, or even close by an order of magnitude.