About ten or more years ago in corp world I remember a trend to start adopting the term "good practice" rather than "best practice". I think this was a reflecti

About ten or more years ago in corp world I remember a trend to start adopting the term "good practice" rather than "best practice". I think this was a reflection of the idea that "best practice" was often a bad fit and/or unachievable and was too often thrown out as a reason for doing something without a more thorough analysis. "Good practice" reflected diligence, progressive maturity, fit for the org's overall capabilities, and an achievable goal. It's like that idea that most companies are aiming to do their core business, and it's not their mission to have a literal state of the art IT or compliance program. They need a passing or better-than-passing grade in these areas, not an A++ grade. Sometimes stopping at maturity level 3 is appropriate for the time being.