This paper presents a management process for creating adaptive, real-time security policies within the Six Sigma 6σ
framework. A key challenge for the creation of a management process is the integration with models of known Indus-
trial processes. One of the most used industrial process models is Six Sigma which is a business management model
wherein customer centric needs are put in perspective with business data to create an efficient system. The security pol-
icy creation and management process proposed in this paper is based on the Six Sigma model and presents a method to
adapt security goals and risk management of a computing service. By formalizing a security policy management process
within an industrial process model, the adaptability of this model to existing industrial tools is seamless and offers a
clear risk based policy decision framework. In particular, this paper presents the necessary tools and procedures to map
Six Sigma DMAIC (Define-Measure-Analyze-Improve-Control) methodology to security policy management.