Back to Assessments & Documents
Data and Analytics Active

Data Products and Data Sharing Maturity Assessment

A 41-question diagnostic across 7 domains that evaluates whether data is run as products people can find, trust and use, and whether it is shared inside and outside the organization safely and on clear terms: sharing str...

Start Assessment

Overview

A 41-question diagnostic across 7 domains that evaluates whether data is run as products people can find, trust and use, and whether it is shared inside and outside the organization safely and on clear terms: sharing strategy, policy and approvals, data product management, data contracts, internal sharing and interoperability, external sharing, data ecosystems and data acquisition, privacy-preserving and controlled sharing, and value and improvement. Written for the chief data officer or head of data platforms who needs to answer: can people inside and outside the organization find, trust and use our data as products, shared safely and on clear terms?

Detailed Description

Most organizations share far more data than they can account for: extracts emailed to partners, copies built because nobody could find the original, feeds that break when a source changes, and purchased data used for purposes its license never allowed. This assessment tests whether data is managed as products with owners, service levels and contracts, published in the catalog and drawn from authoritative sources, and whether every sharing arrangement is approved by risk, recorded, governed by an agreement and usage rights, and ended with proof. It covers joining data spaces and marketplaces, the safer alternatives to raw sharing, such as aggregates, synthetic and de-identified data and controlled environments with output checking, and keeping the use limits of data bought or collected from outside. It gives particular weight to AI: data products fit for AI use, products exposed to AI agents only as registered tools limited to what the acting user may see, and the use limits on external data for AI. It is a deep dive in the ITSG data family. Strategy, policy, decision rights, ownership, risk, value, source approval and the sale of data come from Data Governance and Management; the catalog and glossary from Metadata, Catalog and Lineage; authoritative sources and quality from Master Data and Data Quality Management; channels and masking by level from Data Classification and Handling; processors, de-identification and notification from Privacy Program Operations; APIs, events, schemas and agent tool servers from API and Integration Lifecycle, which also owns API commercial plans and metering. The model is neutral to jurisdiction and vendor.

Assessment Details

Audience

Primary: chief data officer, head of data platforms and data product leads. Secondary: data product owners and domain teams, data platform and integration teams, legal, partnerships and procurement, privacy, security and risk, and the data governance office.

Purpose

Shows whether shared data is found, trusted and used, where products and sharing exist only as informal copies and emails, and which arrangements carry the most legal, security and AI risk. Gives the chief data officer a prioritized roadmap for data products and sharing, and a baseline for partners, auditors and regulators.

Effort

Initial assessment: 8 to 10 hours of facilitated sessions over two weeks with the data governance office, two or three data product owners, the data platform team, legal and partnerships, and privacy and security, starting with a 30-minute session with every area for the four all-area questions. Evidence gathering: the sharing policy and register, product standard and register, contract standard and samples of contracts, agreements, external data records, controlled environment procedure and the performance report. Reassessment: 4 to 5 hours.

Cadence

Annually, and after a new partner program, a data marketplace or data space membership, a major platform change, a large data purchase, a new AI program over shared data, or a sharing incident.

Framework Alignment

OECD Recommendation on Enhancing Access to and Sharing of Data (2021) ISO/IEC 23751:2022 Open Data Product Standard v1.0.0 Open Data Contract Standard v3.1.0 W3C DCAT Version 3 W3C ODRL 2.2 DAMA-DMBOK2 Revised COBIT 2019 ISO/IEC 27001:2022 ISO/IEC 5259-1:2024 ISO/IEC 5259-2:2024 ISO/IEC 5259-3:2024 ISO/IEC 27559:2022 ISO/IEC 20889:2018 NIST SP 800-226 ISO/IEC 29100:2024 ISO/IEC 42001:2023 NIST AI 600-1 OWASP Top 10 for Agentic Applications 2026

KPIs

  • Products Meeting Adoption Targets - Share of data products meeting the adoption target set at intake. Target: at least 80%.
  • Products with Contracts - Share of published products and dataset feeds outside managed APIs and event streams with an approved data contract. Target: 100%.
  • Products Delivering Claimed Benefit - Share of data products launched more than a year ago whose realized benefit meets the benefit claimed at approval. Target: at least 75%.
  • Service Levels Met - Share of product service level results meeting target in the period. Target: at least 95%.
  • Raw Sharing Where Less Was Enough - Share of sampled approved requests that shared raw or identifiable data where a less revealing method would have met the purpose. Target: 5% or less.

Dependencies

Data Governance and Management (v1.9.6): owns the Data Strategy (Roadmap), Data Management Policy, Data Governance Charter, Data Risk Register, Data Value Register (External Arrangements; Use Cases; Investment Priorities), Data Ownership Register and Data Management Standard (Data Acquisition). The hub approves new data sources and checks rights before AI use (its Data Acquisition Approval and Data Rights for AI practices); this model keeps the use limits of approved external data current (5.5). The hub's data product portfolio and the sale or licensing of data for value (its Data Product Portfolio and External Data Value practices) stay there; this model reports realized value per product and arrangement and submits benefit figures to the value register owner in the Data Governance Office (1.1-1.6, 2.2, 2.3, 4.1, 5.3, 5.5, 7.3). Metadata, Catalog and Lineage (v1.9.6): owns the Data Catalog (Asset Records; Access Requests; Data Contracts; Lineage; Search and Discovery) and Business Glossary; products and contracts are published through the catalog, and the catalog serves as the internal marketplace (2.1, 2.4, 2.6, 3.2, 4.2, 7.1). Master Data and Data Quality Management (v6.9.6): owns the System of Record Register, Data Quality Measurement Framework, Data Quality Rules Catalog and Data Issue Register (2.5, 3.5, 4.1, 5.5, 7.2). Data Classification and Handling (v9.9.6): owns channels, access, masking, AI assistant and agent access and monitoring by classification level and the publication review (its Publication and Open Data Release practice), which every open data release passes; it cites this model's Data Sharing Agreement Template (Level-Specific Terms) (1.3, 2.6, 4.4, 4.5, 5.1, 5.4, 6.1, 6.2, 6.5). Privacy Program Operations (v1.9.6): owns purpose compatibility, processor terms and checks, cross-border transfer rules, de-identification techniques and the Breach Response Plan; it decides notification (1.3, 4.3, 5.1, 5.2, 6.3, 6.4, 7.4). API and Integration Lifecycle (v6.9.6): owns APIs, events and their contracts (its Data Contracts for Integrations practice), the Schema Registry and Canonical Data Model (API and Event Contract Terms), the Integration Flow and Event Catalog, the MCP Server and Agent Consumer Register and API commercial plans and metering (its Plans, Partner Onboarding and Metering practice); this model owns the Data Contract Standard for data products and dataset feeds outside managed APIs and event streams (3.1, 3.2, 3.3, 4.4, 4.5). Records and Information Management (v1.9.6) and AI Governance (v11.9.6): own the Records Retention Schedule and the AI Data Governance Standard (5.7, 2.8, 5.5). Data Engineering, Platforms and Observability (v1.9.6): runs contract tests and data service level monitoring and cites the Data Contract Standard and Data Product Register (2.5, 3.5). Recommended: Run after Data Governance and Management, Metadata, Catalog and Lineage and Privacy Program Operations; run before a data marketplace or partner program, a data space membership, a major data purchase or an AI program that relies on shared data.

Assessment Outline

(7 domains · 41 questions)
  1. 1

    1 Sharing Strategy and Policy

    Sharing policy and principles, approval authority, sharing risk method, sharing register, roles and skills, strategy and roadmap

    • 1.1 Data Sharing Policy 1 questions
    • 1.2 Approval Authority 1 questions
    • 1.3 Sharing Risk Assessment 1 questions
    • 1.4 Sharing Register 1 questions
    • 1.5 Roles and Skills 1 questions
    • 1.6 Strategy and Roadmap 1 questions
  2. 2

    2 Data Product Management

    Product definition, demand intake, ownership, catalog publication, service levels, consumer onboarding and registration, retirement, AI-ready products

    • 2.1 Data Product Definition 1 questions
    • 2.2 Demand Intake and Prioritization 1 questions
    • 2.3 Product Ownership 1 questions
    • 2.4 Catalog Publication 1 questions
    • 2.5 Product Service Levels 1 questions
    • 2.6 Consumer Onboarding and Registration 1 questions
    • 2.7 Deprecation and Retirement 1 questions
    • 2.8 AI-Ready Data Products 1 questions
  3. 3

    3 Data Contracts

    Contract standard, coverage, versioning, breaking change control, enforcement rules

    • 3.1 Data Contract Standard 1 questions
    • 3.2 Contract Coverage 1 questions
    • 3.3 Versioning and Compatibility 1 questions
    • 3.4 Breaking Change Control 1 questions
    • 3.5 Contract Enforcement Rules 1 questions
  4. 4

    4 Internal Sharing and Interoperability

    Authoritative sources, shared semantics, internal use approvals, channel selection, products exposed to AI agents as tools

    • 4.1 Authoritative Sources 1 questions
    • 4.2 Shared Meaning and Formats 1 questions
    • 4.3 Internal Use Approvals 1 questions
    • 4.4 Sharing Channel Selection 1 questions
    • 4.5 Products Exposed to AI Agents 1 questions
  5. 5

    5 External Sharing and Data Acquisition

    Sharing agreements, recipient checks, licensing and usage rights, open data publishing, external data use limits including AI use, data ecosystem participation, review and exit

    • 5.1 Data Sharing Agreements 1 questions
    • 5.2 Recipient Checks 1 questions
    • 5.3 Licensing and Usage Rights 1 questions
    • 5.4 Open Data Publication 1 questions
    • 5.5 External Data Acquisition 1 questions
    • 5.6 Data Ecosystem Participation 1 questions
    • 5.7 Review, Renewal and Exit 1 questions
  6. 6

    6 Privacy-Preserving and Controlled Sharing

    Method by risk, secure data environments, de-identified and synthetic releases, output checking, monitoring recipients' use

    • 6.1 Sharing Method by Risk 1 questions
    • 6.2 Secure Data Environments 1 questions
    • 6.3 De-identified and Synthetic Releases 1 questions
    • 6.4 Output Checking 1 questions
    • 6.5 Monitoring High-Risk Recipients 1 questions
  7. 7

    7 Monitoring, Value and Improvement

    Usage, adoption and consumer feedback, reliability and contract breaches, realized value, sharing incidents, performance and improvement

    • 7.1 Usage and Reuse 1 questions
    • 7.2 Service Level Misses and Contract Breaches 1 questions
    • 7.3 Value of Shared Data 1 questions
    • 7.4 Sharing Incidents 1 questions
    • 7.5 Performance and Improvement 1 questions

At a Glance

Category Data and Analytics
Type Free
Roles 6
Domains 7
Questions 41
Start Assessment

Still have questions? Get in touch

ITSGovernance
  • Twitter

Contact us

ITSGovernance