This paper presents a security policy for separation Virtual Machine Monitors (SVMMS) and interprets Rushby 's Separation Model R USH81] for SVMMS. 44 Applying the technique of [ USH81] yields a practical method for demonstrating that an implementation of an SVMM adheres to the abstract Isolation Axiom of the Separation Model, thus providing relatively strong assurance for a low level of effort. First we describe the relevant characteristics of SVMMS, and note the applicable formal modeling requirements. Next we present a summary of the SVMM Separation Model, a modification of the original model presented in [R USH81 . The Separation Model technique permits a proof of separability among the operating systems under control of the kernel of an SVMM. We supply an interpretation of the elements of the Separation Model using concepts from SVMMS. Finally, we relate this work to similar applications of the Separation Model.