When determining the desired maturity levels for IT governance processes, it is MOST important to:

Focusing only on existing strengths might lead to overlooking critical areas that require improvement or neglecting strategic imperatives.

Benchmarking against competitors can provide context, but blindly aligning with external benchmarks might not suit the unique needs and strategic priorities of a particular organization.

The optimal maturity level for IT governance processes is not a one-size-fits-all, but rather depends on the organization's specific context, risk appetite, strategic goals, and regulatory requirements. Agreeing on target levels in response to identified needs ensures that governance efforts are appropriately scaled, cost-effective, and directly contribute to achieving business objectives without over-engineering or under-governing.

While cost-effectiveness is a consideration, making 'lowest cost' the primary driver for maturity levels could lead to inadequate governance and increased risk.