Maturity is not sourcing

Do not confuse what a capability must do with how you obtain it.

After the target is clear, the company may buy a product, assemble existing services and internal workflow, or build something distinctive. Sourcing is a separate decision. A strategically important capability is not automatically custom software. A commodity capability is not automatically safe to outsource without governance.

First define the outcome and required maturity. Then select the source.