Best practice states that IT governance MUST:

While IT governance often enforces policy, this is a function of governance, not its fundamental role or definition as a 'must'.

Applying IT governance in the same manner throughout the enterprise may not be practical or appropriate due to varying departmental needs or regulatory requirements.

Applying consistent target levels of maturity to processes is a specific outcome or goal of governance, not the overarching 'must' of IT governance itself.

IT governance must be a component of enterprise governance to ensure IT activities are aligned with the overall business strategy, objectives, and risk appetite, thereby supporting the enterprise in achieving its goals.