A formal model to aid documenting and harmonizing of information security requirements