Data and Analytics Assessment

Data Governance and Management Maturity Assessment

A maturity assessment of enterprise data governance and management, from board accountability and data strategy through ownership and AI-assisted stewardship, standards, obligations and data location, literacy, risk and ethics, data for AI, value and assurance.

Already have an account? Log in to start

At a glance

Questions: 61
Domains: 9
Working time: Initial assessment: 10 to 12 hours of facilitated sessions over two weeks with the data office, council members, two or three data owners, risk and legal, and finance. Evidence gathering: board and council minutes, the strategy and policy, the ownership register, standards index, obligations and risk registers, value register and performance reports. Reassessment: 5 to 6 hours.
Repeat: Annually, and after a merger or reorganization, a new data strategy, a major regulatory change or a significant data incident.
Roles: 6
Updated: October 2026

Who it is for

Executive Leadership and Finance
Data Office
Business Data Owners and Stewards
Technology, Architecture and AI Platforms
Risk, Legal and Compliance
Process Owner/Full Model Assessor

Primary: Chief Data Officer, head of data governance and the accountable executive. Secondary: governance council members, business data owners and stewards, CIO and enterprise architects, risk, legal and compliance, finance and internal audit.

What you will gain

Shows whether data governance has the mandate, roles, rules and measures to work, where it exists only on paper, and which gaps to close first. Gives the data office an evidence-based roadmap and a baseline that the deep-dive data models build on.

About this assessment

Most organizations say data is an asset, yet few can name who owns each data domain, show the rules every system must meet, or prove that data investment pays off. This assessment tests the foundations that every data practice rests on: who is accountable at the top, what the data strategy and policy require, how the data office, council, owners and stewards share decisions, including steward approval of AI-proposed governance outputs, which obligations apply in each jurisdiction and where data may be stored and sent, how data risk and ethics are handled, the rules for using data in AI and agents, the content that grounds AI assistants and deletion that reaches AI copies, and how value and performance are measured. It is the hub of the ITSG data family. It does not assess practice depth: Metadata, Catalog and Lineage; Master Data and Data Quality Management; Data Classification and Handling; Records and Information Management; Privacy Program Operations; Data Loss Prevention Operations; and the other deep dives do. Here, privacy, classification and retention are tested only as alignment with the owning practice. The model is jurisdiction-neutral: laws and national schemes are captured in the Data Obligations Register, and regulatory overlay models map onto it.

What we assess: 9 domains

Each domain is a group of related questions, scored on its own and rolled up into your overall result.

01 · 7 questions

1 Data Strategy and Mandate

Governing body accountability, the data strategy, the data management policy, funding, the roadmap, strategy communication and strategy review.

02 · 9 questions

2 Data Governance Operating Model

The data office, the governance operating model, the governance council, decision rights, data ownership, stewardship, issue escalation, governance checkpoints in delivery and steward approval of AI-assisted governance work.

03 · 7 questions

3 Policies, Standards and Obligations

The data management standard, the index of data standards, policy exceptions, the data obligations register, control framework mapping, compliance testing and data location and cross-border transfer rules.

04 · 5 questions

4 Data Literacy and Culture

The data literacy program, AI data literacy, data-informed decisions, adoption of governance changes and recognition of data work.

05 · 6 questions

5 Data Landscape and Architecture Alignment

The data domain map, critical data criteria, alignment with the enterprise information model, approval of new data sources, data architecture principles and duplicate data.

06 · 7 questions

6 Data Risk, Ethics and Protection Alignment

Data risk appetite, the data risk register, data ethics principles, ethical use review and alignment with privacy, classification and retention.

07 · 8 questions

7 Data for AI

Rules for using data in AI, rights and licensing, provenance, synthetic data, AI agent access to enterprise data, data readiness for AI demand, unstructured content that grounds AI and deletion that reaches AI copies.

08 · 6 questions

8 Data Value and Investment

The data value method, business cases, value realization, the cost of data management, the data product portfolio and value from external data arrangements.

09 · 6 questions

9 Performance, Assurance and Improvement

Data management KPIs, reporting to the governing body, independent assurance, data practice maturity, learning from data incidents and improvement of the governance framework.

KPIs to track

Measures that show whether the improvements hold.

KPI
Domains with an Accepting Owner - Share of data domains with a named owner who has accepted written accountabilities. Target: 100%.
Council Decisions Closed - Share of governance council decisions implemented by their due date. Target: at least 90%.
Obligations with an Owner and Home - Share of data obligations with a named owning practice and a document where each is met. Target: 100%.
Compliance Test Pass Rate - Share of scheduled data standard tests passed at first attempt. Target: at least 90%.
Benefits Realized - Finance-validated benefits achieved as a share of benefits committed for the year. Target: at least 80%.

Framework alignment

Questions are written in plain language and mapped to:

ISO/IEC 38505-1:2017
DAMA-DMBOK2 Revised
COBIT 2019
ISO 8000-150:2022
ISO 8000-61:2016
ISO/IEC 42001:2023
ISO/IEC 8183:2023
NIST AI RMF 1.0
OWASP Top 10 for Agentic Applications 2026
ISO/IEC 27001:2022
ISO/IEC 29100:2024
ISO/IEC 27701:2025
ISO 15489-1:2016
DCAM v3

Works best with

Practices this assessment relies on. Assessing them too gives a fuller picture.

Enterprise Architecture (v7.9.6): owns the Enterprise Information Model; this model tests that the data domain map aligns with it (5.1, 5.3, 5.5).

AI Governance (v11.9.6): owns the AI Data Governance Standard and AI Dataset Catalog; this model sets the enterprise rules for data used in AI (7.1, 7.3) and uses the catalog lineage to reach AI copies on deletion (7.8).

AI Use Case Lifecycle Management (v4.9.6): owns the Data Readiness Assessment used before AI funding (7.6).

Privacy Program Operations (v1.9.6): owns the Data Protection Policy; this model tests alignment only (6.5); transfer mechanisms for personal data stay there while this model sets enterprise data location rules (3.7).

Data Classification and Handling (v9.9.6): owns the Data Classification Standard; this model tests alignment only (6.6); content sources grounding AI carry its labels (7.7).

Knowledge Management (v10.9.6) and Identity and Access Management and Privileged Access Management (v6.9.6): own who may see each content source; this model sets the ownership, classification and currency of content that grounds AI (7.7).

Records and Information Management (v1.9.6): owns the Records Retention Schedule; this model tests alignment only (6.7) and uses its retention periods to trigger deletion from AI copies (7.8).

Master Data and Data Quality Management (v6.9.6) and Metadata, Catalog and Lineage (v1.9.6): use the Data Ownership Register and critical data criteria owned here (2.5, 5.2).

Recommended: Run this hub first, then the data deep dives in the order set by Data Family Plan v2; reassess the hub yearly.