1. A method comprising: receiving from multiple security devices corresponding native security policies each based on a native policy model associated with the corresponding security device, each security device configured to control access to a resource according to the corresponding native security policy; and normalizing the received native security policies across the multiple security devices based on a generic policy model, to produce at least one normalized security policy that is based on the generic policy model and representative of the native security polices.