Information security is difficult without a plan. Don't spin your wheels. Find a framework, find a coach, and find success.