Security Policy
If the intruder is found to be an internal person (most likely) then the policy should say what action will be taken against this person
The two paths above should be carefully analyzed as to which one you take. Both have pro’s and cons