diff --git a/incidents/README.md b/incidents/README.md
index 99fc6cf..29bf1a8 100644
--- a/incidents/README.md
+++ b/incidents/README.md
@@ -1,4 +1,5 @@
-# Regulation S-P
-
+# Regulation S-P
+
+- [Containment procedures](containment.md)
 - Assessment procedures
-- Written incident response program
+- Written incident response program
diff --git a/incidents/containment.md b/incidents/containment.md
new file mode 100644
index 0000000..95dfeaa
--- /dev/null
+++ b/incidents/containment.md
@@ -0,0 +1,3 @@
+# Intrusion Containment
+
+In the event of a break-in, the team shall perform as many actions as possible to contact local police. If authorities arrive and detain the attacker before they access sensitive investor information, then an incident may be reported but immediately closed given the retainment of all physical media. In any case, the team should attain a police report to document the incident.