Information Security -- Risk Assessment -- Planning and Architecture -- Gap