M6 Procedure: Creating a Security Policy