From 373020cf4d6ae81a7e4200adfd89728aac41fa80 Mon Sep 17 00:00:00 2001
From: "john.xlm" <60260750+JFWooten4@users.noreply.github.com>
Date: Mon, 18 May 2026 13:59:22 -0400
Subject: [PATCH 1/2] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Add=20containment?=
 =?UTF-8?q?=20procedures?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 incidents/README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/incidents/README.md b/incidents/README.md
index f887ccb..969394a 100644
--- a/incidents/README.md
+++ b/incidents/README.md
@@ -1 +1,3 @@
 # Regulation S-P
+
+- Containment procedures

From a3a956a4a55967d85e517290598d826eaee961a8 Mon Sep 17 00:00:00 2001
From: John Wooten <noreply@wooten.link>
Date: Tue, 2 Jun 2026 20:18:54 -0400
Subject: [PATCH 2/2] =?UTF-8?q?=F0=9F=A7=AF=20Add=20containment=20procedur?=
 =?UTF-8?q?es?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 incidents/README.md      | 2 +-
 incidents/containment.md | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)
 create mode 100644 incidents/containment.md

diff --git a/incidents/README.md b/incidents/README.md
index 5b0927b..29bf1a8 100644
--- a/incidents/README.md
+++ b/incidents/README.md
@@ -1,5 +1,5 @@
 # Regulation S-P
 
-- Containment procedures
+- [Containment procedures](containment.md)
 - Assessment procedures
 - Written incident response program
diff --git a/incidents/containment.md b/incidents/containment.md
new file mode 100644
index 0000000..95dfeaa
--- /dev/null
+++ b/incidents/containment.md
@@ -0,0 +1,3 @@
+# Intrusion Containment
+
+In the event of a break-in, the team shall perform as many actions as possible to contact local police. If authorities arrive and detain the attacker before they access sensitive investor information, then an incident may be reported but immediately closed given the retainment of all physical media. In any case, the team should attain a police report to document the incident.