How to assess data governance maturity: models, scoring and a light-weight method for Luxembourg

A data governance maturity assessment scores how consistently an organisation manages its data, area by area, on a scale that typically runs from 0 (no capability) to 5 (optimised), and it backs each score with evidence. For a Luxembourg organisation, a light-weight version needs three ingredients: a recognised framework such as DAMA-DMBOK2, a small set of interviews and documents, and a roadmap that turns the scores into decisions.

What maturity models measure

Maturity models describe how predictable and repeatable a practice is, not how much technology an organisation owns. The DAMA-DMBOK2 assessment uses six levels, as presented at DAMA Sydney in September 2019:

Other frameworks follow similar logic. The CMMI Data Management Maturity (DMM) model uses five levels (performed, managed, defined, measured, optimising) across six categories, among them data management strategy, data governance and data quality. The EDM Council’s DCAM, popular in financial services, is organised in eight components, from data strategy and business case to data operations and the control environment, as summarised in a CDMP study guide.

The dimensions to score

DAMA-DMBOK2, published in 2017 and revised in 2024, divides data management into 11 knowledge areas, with data governance at the centre of the “DAMA wheel”:

• Data governance
• Data architecture
• Data modelling and design
• Data storage and operations
• Data security
• Data integration and interoperability
• Documents and content
• Reference and master data
• Data warehousing and business intelligence
• Metadata
• Data quality

Within each area, DAMA-DMBOK2 proposes four assessment criteria: activities (is the process performed?), tools (is it supported by technology?), standards (is it documented?), and people and resources (are roles, skills and budget assigned?). Scoring each criterion separately avoids a common illusion: a data catalogue licence is a tool, not proof that metadata is managed.

Running a light-weight assessment

A full assessment of all 11 areas is rarely needed for a first pass. A pragmatic scope is data governance plus the three to five areas that matter most to the business, for example reference and master data, data quality, metadata and data security.

1. Plan. Agree the scope, the scale and the sponsor. DAMA-DMBOK2 describes five activities: plan the assessment, perform it, interpret the results, create a targeted improvement programme and re-assess.

2. Survey. A short questionnaire captures how staff perceive current practice. In Luxembourg, the administrative languages are Luxembourgish, French and German under the law of 24 February 1984, and English is common in business, so the questionnaire should be available in the languages respondents actually work in. Organisations that do not want to design their own questionnaire can start from a structured maturity assessment survey and adapt it to their scope.

3. Interview. Survey results are perceptions. Structured interviews test them. Typical interviewees are:

• the executive sponsor or management committee member responsible for data;
• the data protection officer, where one has been appointed under the GDPR;
• business data owners for the key domains (customer, product, finance);
• IT, architecture and data platform leads;
• compliance, risk and internal audit.

4. Ask for evidence. Each score should point to something that can be inspected. Useful evidence includes data policies and standards, a list of named data owners and stewards, governance committee minutes, a business glossary or data catalogue, data quality rules and reports, issue logs, and the record of processing activities required by Article 30 GDPR. Where no evidence exists, the score should not be higher than level 1.

5. Score and calibrate. Score each area on the four criteria, then hold a short calibration workshop where interviewees can challenge the scores. Disagreement between business and IT is itself a finding.

Turning the result into a roadmap

A score is a baseline, not a plan. Three steps make it actionable:

1. Set a target level per area. Not every area needs level 4. A target follows business value and regulatory exposure: an organisation that must answer data access requests or regulatory reporting will need defined processes for the data concerned.
2. Prioritise the gaps. A value-versus-feasibility matrix separates quick wins (high value, high feasibility) from strategic initiatives (high value, low feasibility) and tasks that can wait.
3. Schedule the re-assessment. Re-assessing with the same scale and method shows whether the programme moves the scores. Changing the method between rounds makes the comparison meaningless.

The roadmap should name owners and dates for each initiative, and it should start with governance foundations (roles, decision rights, policies), because most other areas depend on them.

Common pitfalls

• Averaging everything into one number. As Data Crossroads notes, neither DAMA-DMBOK2 nor DCAM clearly defines how to aggregate scores into one overall level. A single average hides the weak area that causes the incidents.
• Self-assessment without evidence. A survey captures perception; only interviews and document review show whether a practice is actually performed.
• Treating maturity as the goal. Higher levels cost money; the right level is the one the business and its regulators need.
• Assessing everything at once. A broad first pass with thin evidence is less useful than a focused one with solid evidence.
• No follow-up. Without a re-assessment date, the exercise becomes a one-off report.

What to do now

1. Choose a framework and scale (for example the DAMA knowledge areas and the 0–5 scale) and document the choice.
2. Limit the first assessment to data governance and three to five priority areas.
3. Name an executive sponsor and the interviewees, including the DPO where one exists.
4. Prepare an evidence checklist before the interviews start.
5. Agree target levels and a re-assessment date in the same meeting where the results are presented.