Assessing Data Management Maturity

Executive summary

Many data management programs begin with a mandate, a tool purchase or a visible failure, and only later ask where the organization actually stands. A maturity assessment answers that question with an evidence-based picture of current capability, organized by a recognized reference model and scored on a scale that stakeholders can understand. The scale itself, usually running from zero or one to five, is the least important output. What matters is the evidence behind each score, the agreed target for each capability and the decisions that follow.

This paper treats assessment as a planning instrument rather than a scoring exercise. It is model-neutral: the method works with a rubric built on DAMA-DMBOK, with DCAM, or with CMMI's data practices, provided one model is chosen, tailored and then held stable.

• Organizations assess for four reinforcing reasons: a baseline, prioritization, a better funding dialogue and evidence of progress.
• A score shows how consistently practices are defined, adopted and measured; it does not show whether data is fit for purpose today, what closing a gap is worth, or how the organization ranks against peers.
• DAMA-DMBOK supplies scope and vocabulary but leaves the scoring model to the organization; DCAM scores capability attainment on a six-point scale; CMMI rates practice areas, including Data Management and Data Quality, through formal appraisals.
• The method has five steps (scope, select and tailor, gather evidence, score and calibrate, validate and target), and a first assessment of moderate scope fits in about ten weeks.
• Scores rest on the strongest evidence available, are calibrated between independent assessors and are recorded with a rationale, so that results can be defended and repeated.

The later sections show how to present current and target scores, how to set targets by business dependence rather than ambition, how to frame results for four audiences, which pitfalls to avoid, and how an annual reassessment and a quarterly pulse connect the baseline to budgets, objectives and business outcomes.

Why assess maturity

A baseline is the difference between a program that can show progress and one that can only describe activity. Without it, investment follows whichever problem was raised last, and the sponsor has nothing to compare against when asked what the money achieved.

Programs that skip the baseline spend their first year arguing about where to start.

Four reasons to assess

The four reasons reinforce each other. A baseline replaces anecdote with a documented picture of current practice, organized by capability and by domain. Prioritization follows: when scores are read alongside how much the business depends on each capability, the widest and most consequential gaps become visible. The funding dialogue changes character because a target per capability converts a general request into a proposal with a stated rationale. And reassessment with the same rubric shows whether investment has moved the evidence, which sponsors find more convincing than milestone lists. Organizations that assess for only one of these reasons, typically the baseline, tend to produce a report that is read once and filed.

What a score tells you, and what it does not

A maturity score describes how consistently practices are defined, adopted and measured. It is good at exposing unevenness between domains, at separating structural gaps from individual shortcomings, and at showing how an organization compares with its own past. It also reveals where evidence is thin or contested, which is useful information in itself.

A score does not say whether the data is fit for purpose today: a defined governance process can coexist with poor customer data, and quality measurement answers a different question. Nor does a score carry a value. Closing a gap in master data may matter far more than closing a larger gap in document management, depending on the use cases in play. Maturity models are not peer benchmarks unless an external benchmark is explicitly part of the method, and a documented process is not proof that it is followed under pressure. Scores should therefore be read with a value lens and with data quality metrics beside them.

The reference models

Practitioners draw on three main reference points. They differ in nature as much as in content: one is a body of knowledge, one a capability assessment model and one a process improvement model with a formal appraisal method. Each can anchor an assessment, and each has strengths the others lack.

DAMA-DMBOK: a body of knowledge with assessment guidance

The DAMA-DMBOK, published by DAMA International and now in a revised second edition, is a body of knowledge rather than an assessment instrument. It organizes data management into eleven knowledge areas, with data governance at the center of the DAMA Wheel and the other ten around it. Each knowledge area is described through a context diagram covering goals, activities, deliverables, roles, tools, techniques and metrics, which makes the book a useful source of assessment criteria and of shared vocabulary.

The book also contains a chapter on data management maturity assessment. It describes how to plan an assessment, gather evidence, score and interpret results, develop recommendations and reassess, and it illustrates the idea with an example scale that runs from level 0, the absence of a capability, through initial, repeatable, defined and managed levels to level 5, optimized. It also surveys existing maturity frameworks that organizations can adopt. DMBOK describes assessment; it does not prescribe a single scoring model, so teams that build on it still need to choose or write a rubric. Because DAMA revises the body of knowledge from time to time, a rubric based on it should record which edition it maps to.

DCAM: capabilities scored on a six-point scale

The Data Management Capability Assessment Model (DCAM) is maintained by the EDM Association (formerly the EDM Council), a cross-industry data management trade association with roots in financial services, and is developed in collaboration with its member firms. DCAM v3 is organized into seven core components and one optional component. Each component breaks down into capabilities and sub-capabilities, and each sub-capability states its objective, practical advice, the questions an assessor asks, the artifacts that serve as evidence and guidance for scoring.

The evidence column is illustrative of what assessors typically request rather than a quotation from the model. A full DCAM assessment covers the seven core components; analytics management is optional and is not meant to be assessed on its own. Organizations with baselines scored against earlier versions of DCAM should note that v3 merged the two separate architecture components of the earlier model and added the business data knowledge component, so older results need a documented mapping before trends are reported.

Each sub-capability is scored on a six-point scale: 1 Not Initiated, 2 Conceptual, 3 Developmental, 4 Defined, 5 Achieved and 6 Enhanced. The even number of points is deliberate, so that assessors cannot settle on a midpoint. DCAM describes the scale as an assessment of capability attainment rather than of maturity, and its descriptors reflect stakeholder engagement, process formality and evidence, which lets the model distinguish a capability that has been designed from one that is operating and sustained. DCAM is widely used where regulators expect demonstrable data controls. It is available to member firms of the EDM Association and to its authorized partners, which matters when an organization wants to use the model itself rather than an adviser's rubric derived from it.

CMMI: from the DMM to the Data domain

The CMMI Institute, now part of ISACA, published the Data Management Maturity (DMM) model, which applied CMMI's process maturity thinking to data management. The DMM organized data management into six categories (data management strategy, data governance, data quality, data operations, platform and architecture, and supporting processes) containing twenty-five process areas, each described through practice statements by level and example work products. Its five levels were Performed, Managed, Defined, Measured and Optimized.

ISACA has discontinued support for the DMM, and it should not be presented as a supported model. CMMI's data management content now sits in the Data domain of the main CMMI model, introduced with CMMI V3.0, which adds practice areas for Data Management and Data Quality. The Data domain is not a like-for-like successor: the DMM was a stand-alone model devoted entirely to data, whereas the Data domain brings data management and data quality practices into a general process improvement model that also spans development, services, suppliers, security, safety, people and virtual work.

CMMI rates achievement in two ways. Capability levels (0 Incomplete, 1 Initial, 2 Managed, 3 Defined) apply to an organization's performance in an individual practice area. Maturity levels (0 Incomplete, 1 Initial, 2 Managed, 3 Defined, 4 Quantitatively Managed, 5 Optimizing) apply to predefined sets of practice areas. Organizations can appraise their data capabilities in a benchmark appraisal led by a certified appraiser, which gives CMMI an external rating that neither DMBOK nor an internal rubric can provide. The model itself is licensed. CMMI suits organizations that already use it for software or services, that value process discipline, and that want a formal, externally recognized appraisal.

The three references compared

The references are complementary rather than competing. DMBOK gives the broadest scope and the most widely shared vocabulary, and its knowledge areas make a sound structure for scoping an assessment, but it leaves the scoring model to the organization. DCAM scores capabilities on a six-point scale and emphasizes evidence, business engagement and sustainment, which suits organizations building or justifying a program, particularly in regulated industries. CMMI offers a formal appraisal and a benchmark against its own levels, and rewards process discipline, measurement and repeatability.

In practice, many teams scope with DMBOK knowledge areas, adopt DCAM's insistence on artifacts and adoption as evidence, and use a generic level scale that stakeholders find intuitive. Whatever the mix, choose one scale and one vocabulary before scoring, document any mapping between models, and keep both stable across years. Changing frameworks between assessments destroys comparability, which is the main reason to reassess at all.

Maturity levels and the assessment method

An assessment stands up to challenge when its levels are described in observable terms, its method is fixed before fieldwork, its evidence is weighted by strength and its scores are calibrated between independent assessors. This section covers each in turn.

Generic maturity levels and what you can observe at each

Most maturity scales share a shape even when their labels differ. The table below describes that shape in observable terms, with the evidence an assessor can verify at each level.

At the lowest levels, capability depends on individuals: knowledge lives in inboxes and spreadsheets, and problems surface only when something breaks. At level 2, practice is repeatable inside a unit or project but varies across the organization. Level 3 is the point at which enterprise standards, policies and roles exist and are approved, although adoption is often uneven. Level 4 adds measurement: metrics, service levels and audited controls drive decisions. Level 5 is continuous improvement, with automation and the capability embedded in how change is delivered.

Two cautions apply. First, labels are not interchangeable across models. Managed is level 2 in CMMI (as it was in the DMM) but level 4 in many generic scales, including the example in DMBOK, and Defined is point 4 of DCAM's six-point scale but level 3 of most five-level scales. Fix the vocabulary before scoring and document any mapping. Second, the evidence column matters more than the label: a level is claimed only when the evidence listed can be produced.

The assessment method, step by step

Scope first. Agree which domains, business units and capabilities are in scope, which decisions the results must inform, and who will act on them. An assessment without a decision attached is already at risk of becoming a report that nobody reads.

Select and tailor. Choose one reference model and tailor it: map its vocabulary to local terms, drop or merge capabilities that do not apply, and fix the rubric and scale before fieldwork, so that scoring criteria are not negotiated after the fact.

Gather evidence. Use several sources, because artifacts, interviews, workshops and observed data each reveal something the others miss. Interview across executive, management and practitioner levels, and run workshops in which several teams describe the same process.

Score and calibrate. Score with at least two assessors working independently against the rubric, then reconcile in a moderation session and record the rationale for every score.

Validate and target. Validate with stakeholders, not to negotiate scores upward but to correct factual errors and surface missing evidence. Then set a target per capability and derive gaps, initiatives and a roadmap, which is the point at which the assessment becomes a plan.

An illustrative ten-week assessment plan

The plan above is illustrative and assumes a moderate scope of six to ten capabilities across a handful of domains; larger scopes take longer, and a first assessment takes longer than a repeat. The mobilization weeks produce a charter naming the sponsor, scope, model and the decisions to be informed, and issue the evidence request with owners and due dates. Discovery combines artifact review, interviews across three organizational levels, workshops and direct inspection of data, systems and metrics. Scoring is done independently and then calibrated, with findings and gaps drafted against the rubric. The final two weeks are for validation, target setting and the roadmap and funding requests.

Schedule the whole plan so that results land before the budget cycle makes its decisions. An assessment that reports a month after budgets close waits a year to matter.

The evidence ladder: from claims to proof

Evidence varies in strength, and the ladder below ranks it from weakest to strongest.

Self-declared answers from surveys and questionnaires give coverage quickly and are useful for spotting variation across units, but they are the weakest basis for a score because respondents describe intent as often as practice. Interviews and workshops add depth and reveal whether different roles describe the same process in the same way. Artifacts in use, such as policies, models, registers and decision logs, are stronger, provided there is evidence they are actually used. Observed data and systems sit at the top: data profiles, lineage captured from pipelines, access logs, control test results and metrics show what is happening regardless of what anyone says.

Scoring and calibration: keeping the numbers honest

Calibration is what separates an assessment from a survey. Six practices keep the numbers honest.

• Write the rubric first. State observable criteria for each level of each capability before anyone scores; writing them afterward invites rationalization.
• Score independently, then reconcile. Disagreement between assessors is information about either the evidence or the rubric.
• Use half-levels at most. Decimals imply a measurement accuracy that interviews and artifacts cannot support.
• Weight by evidence and adoption. Plans and intentions, however sincere, do not raise a score.
• Record the rationale. A short reason and an evidence reference for every score let results be defended and repeated.
• Keep continuity. Use the same assessors from year to year where possible, or maintain a shared calibration set of scored examples so that new assessors learn the house standard.

Reading and communicating results

Results are useful only if they lead to targets that a budget committee can approve and messages that each audience can act on. This section covers the results view, target setting and communication.

Current versus target by capability

A common way to present results is to show current and target scores side by side for each capability, on the same scale. The values below are illustrative, not survey or benchmark data.

Three features of a good results view are visible. First, targets differ by capability: master data stays near its current level because no priority use case yet needs more, while stewardship, data quality and metadata are asked to move furthest because reporting, customer and self-service use cases depend on them. Second, the gap, not the absolute score, drives the first funding wave. Third, strong areas such as security and privacy are marked to protect rather than to grow, with any uplift aimed at measurement and monitoring.

When communicating, show the evidence summary behind any score a stakeholder challenges, use half-levels at most, and present the same view for each domain so that unevenness is visible. Radar charts are a popular alternative, but bars or tables are easier to read when there are many capabilities or when comparing years.

Not everything to level 5: setting targets by capability

Not every capability should aim for the top level, and the matrix below gives a disciplined way to decide. Each capability is plotted by how much the business depends on it, taken from the use-case portfolio and regulatory obligations, and by the size of the gap between its current score and the proposed target.

Capabilities with high dependence and a large gap are the priority investments; they deserve multi-quarter initiatives with named owners, interim milestones and a quarterly pulse on leading indicators. High dependence with a small gap calls for protection: add metrics and controls so that the level does not erode as volumes, teams and systems change. A large gap where little depends on the capability usually signals a target set by ambition rather than need, and the right response is to lower or defer it. Low dependence and a small gap means maintain and revisit annually. The exercise keeps the roadmap honest and produces targets that a budget committee can approve.

One baseline, four framings

Results need different framing for different audiences, and the same chart should not be sent unchanged to all of them.

In every version, lead with gaps and decisions, show the evidence on request, and avoid ranking people or units against one another. Domain leaders who feel ranked defend their scores; domain leaders who see shared gaps help close them.

Pitfalls that discredit assessments

Each pitfall below has discredited real assessments, and each has a straightforward remedy that is far cheaper to apply at the start than after the results have been challenged.

Self-assessment inflation happens when units score themselves and scores drift upward without new evidence; an evidence-based rubric and independent moderation are the remedy. Maturity theater is the production of artifacts for the assessor, such as policies written the month before fieldwork and never used; the defense is to score adoption and outcomes and to ask to see the artifact in use. Assessing without acting is the most common failure: a report is filed, nobody owns the gaps and no budget changes. It is prevented by agreeing, before fieldwork, which decisions the results will feed and when.

One-size targets, usually level 5 everywhere, spread effort thin and produce a plan nobody will fund; targets should be set by capability and business dependence. Model worship, debating frameworks instead of gaps, wastes the scarce attention of sponsors. Tailor the model once, freeze the vocabulary and move on to the roadmap.

Cadence and the link to funding

An assessment that happens once is a snapshot. Two rhythms, and a clear line of sight from scores to budgets and objectives, turn it into the planning backbone of the program.

Two rhythms: annual reassessment and quarterly pulse

The annual reassessment repeats the full method with the same rubric and, as far as possible, the same calibrated assessors, so that movement is comparable year on year. It is timed to feed the annual planning and budget cycle, resets targets where business priorities have shifted, and is published with the trend against the previous baseline.

The quarterly pulse is lighter. For each funded capability, a handful of leading indicators show whether initiatives are changing the evidence, for example the share of critical data elements with a named owner or with passing quality rules. The pulse does not rescore maturity; it flags risk to the annual target early enough to act, and it is reviewed alongside objectives and key results (OKRs) in the program steering committee. It takes days rather than weeks and keeps the conversation about capability going between formal assessments.

From baseline to business outcomes

The baseline, with calibrated scores and evidence references, sits at the bottom of the pyramid. Capability targets are set on top of it, each with an owner and a rationale drawn from business dependence. Funded initiatives are the budget lines that close specific gaps; each should name the capability and the level it is meant to reach. Objectives and key results translate those initiatives into quarterly commitments that leaders are measured on, and business outcomes such as reduced risk, faster reporting or lower cost sit at the top.

The discipline is traceability in both directions. Each layer must trace to the one below it. A budget line with no capability gap behind it deserves a question, and a gap with no budget line should be stated openly in the plan as an accepted risk rather than left implicit. Reporting outcomes and leading indicators together prevents the program from claiming progress on activity alone.

Readiness checklist

Where to start

The first steps are deliberately small, and the last of them determines whether the assessment matters.

1. Write a one-page charter. Confirm the sponsor, scope, reference model and the decisions the assessment will inform. It takes a week and prevents most later disputes.
2. Issue the evidence request and the interview plan. Send them together, with interviews scheduled across executive, management and practitioner levels.
3. Calibrate and validate. Run the calibration session and validate scores with stakeholders, producing a baseline that will stand up to challenge.
4. Feed the budget. Bring capability targets and gaps into the next budget and OKR cycle, with an owner for each gap.

Done this way, maturity assessment becomes the planning backbone of the data management program rather than an annual ceremony. An assessment earns its cost the day its results change a decision.

Glossary

Maturity assessment

An evidence-based evaluation of how consistently data management practices are defined, adopted and measured, scored against a reference model.

Reference model

The framework that defines what is assessed and how, such as a DMBOK-based rubric, DCAM or CMMI.

Rubric

The observable criteria for each level of each capability, fixed before scoring begins.

Knowledge area

One of the eleven areas into which DAMA-DMBOK divides data management, with data governance at the center.

Component, capability and sub-capability

The three tiers of DCAM's structure; sub-capabilities are the unit at which DCAM scores are assigned.

Practice area

A group of related practices in CMMI, such as Data Management or Data Quality, rated with capability levels.

Capability level

In CMMI, a rating of achievement in an individual practice area, from 0 (Incomplete) to 3 (Defined).

Maturity level

In CMMI, a rating of achievement across a predefined set of practice areas, from 0 (Incomplete) to 5 (Optimizing); in generic scales, the overall level of a capability.

Calibration

A moderation session in which independent assessors reconcile differing scores against the evidence and record the reason for each agreed score.

Evidence ladder

A ranking of evidence by strength, from self-declared answers through interviews and artifacts in use to observed data and systems.

Target state

The level each capability should reach within a stated horizon, justified by business dependence and owned by a named person.

Quarterly pulse

A light review of leading indicators for funded capabilities between annual reassessments, without rescoring.

Objectives and key results (OKRs)

A goal-setting method that pairs qualitative objectives with measurable key results reviewed on a fixed cadence.