What to do after a cyber attack?

Question for all the small business owners out there. Do any of you have a company policy/guideline they can share when it comes to dealing with cyber attacks? We're only a small office of about 20 employees, but the business is growing rapidly, and we currently have no protocol in case of an attack. What is the best way to recover data?