Merging Information Security Policies - Requirements and Best Practices