Data and Analytics Assessment

Data Products and Data Sharing Maturity Assessment

A maturity assessment of data products and data sharing, from strategy, policy, product ownership and data contracts through agreements, licensing, data ecosystems, external data and controlled environments to usage, feedback, value and improvement.

Already have an account? Log in to start

At a glance

Questions: 41
Domains: 7
Working time: Initial assessment: 8 to 10 hours of facilitated sessions over two weeks with the data governance office, two or three data product owners, the data platform team, legal and partnerships, and privacy and security, starting with a 30-minute session with every area for the four all-area questions. Evidence gathering: the sharing policy and register, product standard and register, contract standard and samples of contracts, agreements, external data records, controlled environment procedure and the performance report. Reassessment: 4 to 5 hours.
Repeat: Annually, and after a new partner program, a data marketplace or data space membership, a major platform change, a large data purchase, a new AI program over shared data, or a sharing incident.
Roles: 6
Updated: October 2026

Who it is for

Data Governance Office
Data Product Owners and Domain Teams
Data Platform and Integration
Legal, Partnerships and Procurement
Privacy, Security and Risk
Process Owner/Full Model Assessor

Primary: chief data officer, head of data platforms and data product leads. Secondary: data product owners and domain teams, data platform and integration teams, legal, partnerships and procurement, privacy, security and risk, and the data governance office.

What you will gain

Shows whether shared data is found, trusted and used, where products and sharing exist only as informal copies and emails, and which arrangements carry the most legal, security and AI risk. Gives the chief data officer a prioritized roadmap for data products and sharing, and a baseline for partners, auditors and regulators.

About this assessment

Most organizations share far more data than they can account for: extracts emailed to partners, copies built because nobody could find the original, feeds that break when a source changes, and purchased data used for purposes its license never allowed. This assessment tests whether data is managed as products with owners, service levels and contracts, published in the catalog and drawn from authoritative sources, and whether every sharing arrangement is approved by risk, recorded, governed by an agreement and usage rights, and ended with proof. It covers joining data spaces and marketplaces, the safer alternatives to raw sharing, such as aggregates, synthetic and de-identified data and controlled environments with output checking, and keeping the use limits of data bought or collected from outside. It gives particular weight to AI: data products fit for AI use, products exposed to AI agents only as registered tools limited to what the acting user may see, and the use limits on external data for AI. It is a deep dive in the ITSG data family. Strategy, policy, decision rights, ownership, risk, value, source approval and the sale of data come from Data Governance and Management; the catalog and glossary from Metadata, Catalog and Lineage; authoritative sources and quality from Master Data and Data Quality Management; channels and masking by level from Data Classification and Handling; processors, de-identification and notification from Privacy Program Operations; APIs, events, schemas and agent tool servers from API and Integration Lifecycle, which also owns API commercial plans and metering. The model is neutral to jurisdiction and vendor.

What we assess: 7 domains

Each domain is a group of related questions, scored on its own and rolled up into your overall result.

01 · 6 questions

1 Sharing Strategy and Policy

Sharing policy and principles, approval authority, sharing risk method, sharing register, roles and skills, strategy and roadmap

02 · 8 questions

2 Data Product Management

Product definition, demand intake, ownership, catalog publication, service levels, consumer onboarding and registration, retirement, AI-ready products

03 · 5 questions

3 Data Contracts

Contract standard, coverage, versioning, breaking change control, enforcement rules

04 · 5 questions

4 Internal Sharing and Interoperability

Authoritative sources, shared semantics, internal use approvals, channel selection, products exposed to AI agents as tools

05 · 7 questions

5 External Sharing and Data Acquisition

Sharing agreements, recipient checks, licensing and usage rights, open data publishing, external data use limits including AI use, data ecosystem participation, review and exit

06 · 5 questions

6 Privacy-Preserving and Controlled Sharing

Method by risk, secure data environments, de-identified and synthetic releases, output checking, monitoring recipients' use

07 · 5 questions

7 Monitoring, Value and Improvement

Usage, adoption and consumer feedback, reliability and contract breaches, realized value, sharing incidents, performance and improvement

KPIs to track

Measures that show whether the improvements hold.

KPI
Products Meeting Adoption Targets - Share of data products meeting the adoption target set at intake. Target: at least 80%.
Products with Contracts - Share of published products and dataset feeds outside managed APIs and event streams with an approved data contract. Target: 100%.
Products Delivering Claimed Benefit - Share of data products launched more than a year ago whose realized benefit meets the benefit claimed at approval. Target: at least 75%.
Service Levels Met - Share of product service level results meeting target in the period. Target: at least 95%.
Raw Sharing Where Less Was Enough - Share of sampled approved requests that shared raw or identifiable data where a less revealing method would have met the purpose. Target: 5% or less.

Framework alignment

Questions are written in plain language and mapped to:

OECD Recommendation on Enhancing Access to and Sharing of Data (2021)
ISO/IEC 23751:2022
Open Data Product Standard v1.0.0
Open Data Contract Standard v3.1.0
W3C DCAT Version 3
W3C ODRL 2.2
DAMA-DMBOK2 Revised
COBIT 2019
ISO/IEC 27001:2022
ISO/IEC 5259-1:2024
ISO/IEC 5259-2:2024
ISO/IEC 5259-3:2024
ISO/IEC 27559:2022
ISO/IEC 20889:2018
NIST SP 800-226
ISO/IEC 29100:2024
ISO/IEC 42001:2023
NIST AI 600-1
OWASP Top 10 for Agentic Applications 2026

Works best with

Practices this assessment relies on. Assessing them too gives a fuller picture.

Data Governance and Management (v1.9.6): owns the Data Strategy (Roadmap), Data Management Policy, Data Governance Charter, Data Risk Register, Data Value Register (External Arrangements; Use Cases; Investment Priorities), Data Ownership Register and Data Management Standard (Data Acquisition). The hub approves new data sources and checks rights before AI use (its Data Acquisition Approval and Data Rights for AI practices); this model keeps the use limits of approved external data current (5.5). The hub's data product portfolio and the sale or licensing of data for value (its Data Product Portfolio and External Data Value practices) stay there; this model reports realized value per product and arrangement and submits benefit figures to the value register owner in the Data Governance Office (1.1-1.6, 2.2, 2.3, 4.1, 5.3, 5.5, 7.3).

Metadata, Catalog and Lineage (v1.9.6): owns the Data Catalog (Asset Records; Access Requests; Data Contracts; Lineage; Search and Discovery) and Business Glossary; products and contracts are published through the catalog, and the catalog serves as the internal marketplace (2.1, 2.4, 2.6, 3.2, 4.2, 7.1).

Master Data and Data Quality Management (v6.9.6): owns the System of Record Register, Data Quality Measurement Framework, Data Quality Rules Catalog and Data Issue Register (2.5, 3.5, 4.1, 5.5, 7.2).

Data Classification and Handling (v9.9.6): owns channels, access, masking, AI assistant and agent access and monitoring by classification level and the publication review (its Publication and Open Data Release practice), which every open data release passes; it cites this model's Data Sharing Agreement Template (Level-Specific Terms) (1.3, 2.6, 4.4, 4.5, 5.1, 5.4, 6.1, 6.2, 6.5).

Privacy Program Operations (v1.9.6): owns purpose compatibility, processor terms and checks, cross-border transfer rules, de-identification techniques and the Breach Response Plan; it decides notification (1.3, 4.3, 5.1, 5.2, 6.3, 6.4, 7.4).

API and Integration Lifecycle (v6.9.6): owns APIs, events and their contracts (its Data Contracts for Integrations practice), the Schema Registry and Canonical Data Model (API and Event Contract Terms), the Integration Flow and Event Catalog, the MCP Server and Agent Consumer Register and API commercial plans and metering (its Plans, Partner Onboarding and Metering practice); this model owns the Data Contract Standard for data products and dataset feeds outside managed APIs and event streams (3.1, 3.2, 3.3, 4.4, 4.5).

Records and Information Management (v1.9.6) and AI Governance (v11.9.6): own the Records Retention Schedule and the AI Data Governance Standard (5.7, 2.8, 5.5).

Data Engineering, Platforms and Observability (v1.9.6): runs contract tests and data service level monitoring and cites the Data Contract Standard and Data Product Register (2.5, 3.5).

Recommended: Run after Data Governance and Management, Metadata, Catalog and Lineage and Privacy Program Operations; run before a data marketplace or partner program, a data space membership, a major data purchase or an AI program that relies on shared data.