M6 Procedure: Testing a Security Policy