Back to Assessments & Documents
Data and Analytics Active

Data Governance and Management Maturity Assessment

A 61-question diagnostic across 9 domains that evaluates whether data is run as a governed enterprise asset: board accountability, strategy and policy, the operating model, ownership and AI-assisted stewardship, standard...

Start Assessment

Overview

A 61-question diagnostic across 9 domains that evaluates whether data is run as a governed enterprise asset: board accountability, strategy and policy, the operating model, ownership and AI-assisted stewardship, standards, obligations and data location, literacy, the data landscape, risk and ethics, data for AI, value, and assurance. Written for the Chief Data Officer or head of data governance who needs to answer: is our data governed with a clear mandate, accountable owners, enforced rules and measured value?

Detailed Description

Most organizations say data is an asset, yet few can name who owns each data domain, show the rules every system must meet, or prove that data investment pays off. This assessment tests the foundations that every data practice rests on: who is accountable at the top, what the data strategy and policy require, how the data office, council, owners and stewards share decisions, including steward approval of AI-proposed governance outputs, which obligations apply in each jurisdiction and where data may be stored and sent, how data risk and ethics are handled, the rules for using data in AI and agents, the content that grounds AI assistants and deletion that reaches AI copies, and how value and performance are measured. It is the hub of the ITSG data family. It does not assess practice depth: Metadata, Catalog and Lineage; Master Data and Data Quality Management; Data Classification and Handling; Records and Information Management; Privacy Program Operations; Data Loss Prevention Operations; and the other deep dives do. Here, privacy, classification and retention are tested only as alignment with the owning practice. The model is jurisdiction-neutral: laws and national schemes are captured in the Data Obligations Register, and regulatory overlay models map onto it.

Assessment Details

Audience

Primary: Chief Data Officer, head of data governance and the accountable executive. Secondary: governance council members, business data owners and stewards, CIO and enterprise architects, risk, legal and compliance, finance and internal audit.

Purpose

Shows whether data governance has the mandate, roles, rules and measures to work, where it exists only on paper, and which gaps to close first. Gives the data office an evidence-based roadmap and a baseline that the deep-dive data models build on.

Effort

Initial assessment: 10 to 12 hours of facilitated sessions over two weeks with the data office, council members, two or three data owners, risk and legal, and finance. Evidence gathering: board and council minutes, the strategy and policy, the ownership register, standards index, obligations and risk registers, value register and performance reports. Reassessment: 5 to 6 hours.

Cadence

Annually, and after a merger or reorganization, a new data strategy, a major regulatory change or a significant data incident.

Framework Alignment

ISO/IEC 38505-1:2017 DAMA-DMBOK2 Revised COBIT 2019 ISO 8000-150:2022 ISO 8000-61:2016 ISO/IEC 42001:2023 ISO/IEC 8183:2023 NIST AI RMF 1.0 OWASP Top 10 for Agentic Applications 2026 ISO/IEC 27001:2022 ISO/IEC 29100:2024 ISO/IEC 27701:2025 ISO 15489-1:2016 DCAM v3

KPIs

  • Domains with an Accepting Owner - Share of data domains with a named owner who has accepted written accountabilities. Target: 100%.
  • Council Decisions Closed - Share of governance council decisions implemented by their due date. Target: at least 90%.
  • Obligations with an Owner and Home - Share of data obligations with a named owning practice and a document where each is met. Target: 100%.
  • Compliance Test Pass Rate - Share of scheduled data standard tests passed at first attempt. Target: at least 90%.
  • Benefits Realized - Finance-validated benefits achieved as a share of benefits committed for the year. Target: at least 80%.

Dependencies

Enterprise Architecture (v7.9.6): owns the Enterprise Information Model; this model tests that the data domain map aligns with it (5.1, 5.3, 5.5). AI Governance (v11.9.6): owns the AI Data Governance Standard and AI Dataset Catalog; this model sets the enterprise rules for data used in AI (7.1, 7.3) and uses the catalog lineage to reach AI copies on deletion (7.8). AI Use Case Lifecycle Management (v4.9.6): owns the Data Readiness Assessment used before AI funding (7.6). Privacy Program Operations (v1.9.6): owns the Data Protection Policy; this model tests alignment only (6.5); transfer mechanisms for personal data stay there while this model sets enterprise data location rules (3.7). Data Classification and Handling (v9.9.6): owns the Data Classification Standard; this model tests alignment only (6.6); content sources grounding AI carry its labels (7.7). Knowledge Management (v10.9.6) and Identity and Access Management and Privileged Access Management (v6.9.6): own who may see each content source; this model sets the ownership, classification and currency of content that grounds AI (7.7). Records and Information Management (v1.9.6): owns the Records Retention Schedule; this model tests alignment only (6.7) and uses its retention periods to trigger deletion from AI copies (7.8). Master Data and Data Quality Management (v6.9.6) and Metadata, Catalog and Lineage (v1.9.6): use the Data Ownership Register and critical data criteria owned here (2.5, 5.2). Recommended: Run this hub first, then the data deep dives in the order set by Data Family Plan v2; reassess the hub yearly.

Assessment Outline

(9 domains · 61 questions)
  1. 1

    1 Data Strategy and Mandate

    Governing body accountability, the data strategy, the data management policy, funding, the roadmap, strategy communication and strategy review.

    • 1.1 Governing Body Accountability for Data 1 questions
    • 1.2 Data Strategy 1 questions
    • 1.3 Data Management Policy 1 questions
    • 1.4 Data Management Funding 1 questions
    • 1.5 Data Strategy Roadmap 1 questions
    • 1.6 Data Strategy Communication 1 questions
    • 1.7 Data Strategy Review 1 questions
  2. 2

    2 Data Governance Operating Model

    The data office, the governance operating model, the governance council, decision rights, data ownership, stewardship, issue escalation, governance checkpoints in delivery and steward approval of AI-assisted governance work.

    • 2.1 Data Office Mandate 1 questions
    • 2.2 Governance Operating Model Design 1 questions
    • 2.3 Data Governance Council 1 questions
    • 2.4 Data Decision Rights 1 questions
    • 2.5 Data Ownership 1 questions
    • 2.6 Data Stewardship Network 1 questions
    • 2.7 Data Issue Escalation 1 questions
    • 2.8 Governance in Delivery 1 questions
    • 2.9 AI-Assisted Governance Work 1 questions
  3. 3

    3 Policies, Standards and Obligations

    The data management standard, the index of data standards, policy exceptions, the data obligations register, control framework mapping, compliance testing and data location and cross-border transfer rules.

    • 3.1 Data Management Standard 1 questions
    • 3.2 Data Standards Index 1 questions
    • 3.3 Data Policy Exceptions 1 questions
    • 3.4 Data Obligations Register 1 questions
    • 3.5 Data Control Framework Mapping 1 questions
    • 3.6 Data Standards Compliance Testing 1 questions
    • 3.7 Data Location and Cross-Border Transfer Rules 1 questions
  4. 4

    4 Data Literacy and Culture

    The data literacy program, AI data literacy, data-informed decisions, adoption of governance changes and recognition of data work.

    • 4.1 Data Literacy Program 1 questions
    • 4.2 AI Data Literacy 1 questions
    • 4.3 Data-Informed Decisions 1 questions
    • 4.4 Data Change Adoption 1 questions
    • 4.5 Recognition of Data Work 1 questions
  5. 5

    5 Data Landscape and Architecture Alignment

    The data domain map, critical data criteria, alignment with the enterprise information model, approval of new data sources, data architecture principles and duplicate data.

    • 5.1 Data Domain Map 1 questions
    • 5.2 Critical Data Criteria 1 questions
    • 5.3 Enterprise Information Model Alignment 1 questions
    • 5.4 Data Acquisition Approval 1 questions
    • 5.5 Data Architecture Principles 1 questions
    • 5.6 Duplicate Data Rationalization 1 questions
  6. 6

    6 Data Risk, Ethics and Protection Alignment

    Data risk appetite, the data risk register, data ethics principles, ethical use review and alignment with privacy, classification and retention.

    • 6.1 Data Risk Appetite 1 questions
    • 6.2 Data Risk Register 1 questions
    • 6.3 Data Ethics Principles 1 questions
    • 6.4 Ethical Use Review 1 questions
    • 6.5 Privacy Alignment 1 questions
    • 6.6 Classification Alignment 1 questions
    • 6.7 Retention Alignment 1 questions
  7. 7

    7 Data for AI

    Rules for using data in AI, rights and licensing, provenance, synthetic data, AI agent access to enterprise data, data readiness for AI demand, unstructured content that grounds AI and deletion that reaches AI copies.

    • 7.1 AI Data Rules 1 questions
    • 7.2 Data Rights for AI 1 questions
    • 7.3 AI Data Provenance 1 questions
    • 7.4 Synthetic and AI-Generated Data 1 questions
    • 7.5 Agent Access to Enterprise Data 1 questions
    • 7.6 AI Data Demand and Readiness 1 questions
    • 7.7 Unstructured Content Used by AI 1 questions
    • 7.8 Deletion and Retention Reaching AI 1 questions
  8. 8

    8 Data Value and Investment

    The data value method, business cases, value realization, the cost of data management, the data product portfolio and value from external data arrangements.

    • 8.1 Data Value Method 1 questions
    • 8.2 Data Business Cases 1 questions
    • 8.3 Value Realization 1 questions
    • 8.4 Cost of Data Management 1 questions
    • 8.5 Data Product Portfolio 1 questions
    • 8.6 External Data Value 1 questions
  9. 9

    9 Performance, Assurance and Improvement

    Data management KPIs, reporting to the governing body, independent assurance, data practice maturity, learning from data incidents and improvement of the governance framework.

    • 9.1 Data Management KPIs 1 questions
    • 9.2 Governing Body Reporting 1 questions
    • 9.3 Independent Assurance 1 questions
    • 9.4 Data Practice Maturity 1 questions
    • 9.5 Data Incident Learning 1 questions
    • 9.6 Governance Framework Improvement 1 questions

At a Glance

Category Data and Analytics
Type Free
Roles 6
Domains 9
Questions 61
Start Assessment

Still have questions? Get in touch

ITSGovernance
  • Twitter

Contact us

ITSGovernance