I prefer the term "best practice" to capture what companies should do but typically don't adhere to all best practices for everything.