- Does it meet a business need? (cost savings, new business, needed enhancement)
- Does it provide a necessary function for IT infrastructure?
- Do we need it for protection: data, security, legal?
If it does not meet these, then it may be nice, but not necessary. And if there are more important items to tackle, we cannot get to it.