Information technology (IT) can have a direct and indirect impact on business performance. New technologies change the risks at the strategic and governing levels of an enterprise. In the age of digitalization, we need to develop new understandings and approaches to governance and management. The most established IT governance (ITG) models, such as COBIT, ITIL and CMMI, are universal, one-size-fits-all models that are not in line with contingency theory and are predominantly designed for large multinational enterprises. They are too cumbersome and cost-intensive for small and medium enterprises (SMEs) to use effectively. Therefore, there is a need to develop more efficient models that are contingency-based and easier to implement than existing models and thus adaptable to the actual needs of the business. This paper presents an empirical evaluation of key ITG mechanisms from the literature that clearly shows that several are not universally but situationally necessary, thus demonstrating the need for new contingency-based ITG models.