A level from 1 to 5
Read against the DAMA maturity bands, with a description of what an organization at that level does and does not yet do.
Data maturity assessment
Under ten minutes, a DAMA-based scorecard, and a written read of where you actually are: level, five-axis radar, and three quick wins on your weakest pillar.
Most organizations know their data situation is not good. Very few can say where in a way that survives a conversation with a sponsor — and "we're quite immature" is not a plan. It doesn't tell you what to fix first, and it gives a skeptical executive nothing to agree with.
This scorecard produces the specific version. It asks about behavior rather than aspiration: not "do you have a data policy?" but "when someone breaks it, what happens?". Fifteen questions, less than ten minutes, and the result lands in your inbox rather than in mine.
Free · under 10 minutes · automatic result
Discover your data maturity level
Fifteen questions about what actually happens in your organization, not about what the policy says. At the end you get a level, a radar and three things you can start on Monday.
Start the assessmentFree for newsletter subscribers. Opens in Google Forms, in a new tab, and the report is emailed as soon as you finish.
See a sample reportA five-axis radar
Almost nobody is uniformly immature. The radar shows the asymmetry a single score hides.
Three quick wins
Chosen against your weakest axis and scoped to need no new budget. This is the part sponsors read.
What lands in your inbox
See the report before you start
This is a real report from a completed assessment, with the respondent's name, company and country removed. Yours follows the same structure, built from your answers.
- Your DAMA maturity level and score out of 25
- A five-pillar radar with an executive analysis
- A pillar-by-pillar scorecard: what you already have and the gaps to close
- Your top three priority gaps, each with a first step
- A 90-day roadmap and the path to the next level
- Risk and AI-readiness signals
Yours is emailed as soon as you finish the form.
Data Governance Journey
"Governance for People, Value from Data"
Hello there,
Here is your official DAMA DMBOK2 Data Governance Maturity Assessment report prepared for your organization. Below is an evaluation of your current data capabilities across the five core DAMA dimensions.
DAMA maturity diagnosis
Level 1 - Initial / Ad Hoc
9 / 25 Points
Fragmented management in operational silos; high compliance/security risk
Maturity profile across DAMA pillars
Executive analysis for your organization:
Your organization shows its strongest relative capability within Data Security, indicating active baseline protection measures, though foundational governance and data culture remain highly siloed and ad hoc. The primary operational bottlenecks stem from a lack of formal data strategy, standardized metadata catalogs, and unified enterprise data literacy.
Pillar-by-pillar scorecard
Pillar I: Foundations (Strategy, Governance & Roles)
1 / 5Strategy alignment exists, but foundational structures, councils, and formal roles are missing.
What you already have:
- Data strategy is formally aligned with company objectives and OKRs.
Gaps to close:
- No governance council or central committee with formal authority.
- Data Owners are not formally designated across business domains.
- Data Stewards have not been identified to operationalize governance.
- Lack of documented data lifecycle policies and assigned accountability.
Pillar II: Metadata & Catalog (Documentation & Lineage)
2 / 5Basic glossary and technical dictionaries exist, but centralization and lineage are lacking.
What you already have:
- Unified approved business glossary established.
- Technical data dictionaries of core systems are documented.
Gaps to close:
- No centralized Data Catalog in place.
- Data lineage is not traceable across critical business processes.
- Metadata tools are not accessible to general business users.
Pillar III: Data Security (Protection, Privacy & Compliance)
3 / 5Solid privacy and classification baseline, but technical enforcement and incident protocols need strengthening.
What you already have:
- Personal and sensitive data identified and classified.
- Data sensitivity classification taxonomy is defined.
- Capacity to answer data-subject / privacy rights requests.
Gaps to close:
- Verifiable technical protections (encryption, pseudonymization, RBAC) lacking in depth.
- Formal data breach management and reporting protocols not fully established.
Pillar IV: Data Quality (Measurement, Rules & Monitoring)
2 / 5Point-of-entry checks and remediation workflows exist, but automated rules and dashboards are missing.
What you already have:
- Formal quality-incident management and remediation workflow.
- Data quality checked at the point of entry.
Gaps to close:
- Automated quality rules based on DAMA dimensions not implemented.
- Periodic data profiling routines absent.
- Data quality dashboards and KPIs not visible to Owners and Stewards.
Pillar V: Data Culture (Change Management & Literacy)
1 / 5Literacy programs have started, but governance remains siloed in IT without broad cultural embedding.
What you already have:
- Ongoing data literacy programs initiated.
Gaps to close:
- Governance perceived as an IT task rather than a business responsibility.
- Governed self-service not actively promoted, increasing Shadow IT risks.
- Privacy and Quality not yet integrated by design and default.
- Periodic internal audits of governance controls missing.
Top 3 priority gaps to address
1. Lack of formal Data Owners & Stewards
Why it matters: Without designated business owners and stewards, data accountability defaults to IT, stalling cross-functional data quality and metadata initiatives.
First step: Appoint initial Data Owners for core operational domains within your organization.
2. Absence of centralized Data Catalog & metadata tools
Why it matters: While business glossaries and technical dictionaries exist in isolation, business users lack centralized discovery tools, hindering self-service analytics.
First step: Evaluate lightweight centralized catalog options to unify existing glossaries and dictionaries.
3. Absence of automated data quality rules & monitoring
Why it matters: Relying solely on point-of-entry checks without automated profiling or dashboards leaves downstream reports vulnerable to undetected quality degradation.
First step: Define automated validation rules for critical data elements in core pipelines.
Your 90-day action roadmap
Days 1–30
Quick wins & role chartering
- Secure executive sponsorship to officially charter Data Owners and Stewards.
- Document core data lifecycle policies for sensitive data handling.
Days 31–60
Build foundations & catalog integration
- Consolidate business glossaries and technical dictionaries into a centralized inventory.
- Establish verifiable technical access controls (RBAC) and data breach protocols.
Days 61–90
Consolidate & scale quality monitoring
- Implement automated data quality rules and initial stakeholder visibility dashboards.
- Expand data literacy sessions to emphasize business accountability and self-service standards.
Path to Level 3 (Defined)
You are currently 2 points away from reaching Level 3 (Defined). To cross this threshold, your organization needs to establish formal governance structures and centralized discovery tools.
Key capabilities required to unlock Level 3:
- Establish a formal governance council or central committee with authority.
- Formally designate Data Owners and Stewards across key domains.
- Deploy a centralized Data Catalog accessible to business users.
- Document and implement data lifecycle accountability policies.
Risk & AI-readiness signals
- Compliance & security exposure: While sensitive data is classified and privacy rights requests can be handled, the absence of verifiable technical protections (encryption/RBAC) and formal breach protocols presents regulatory vulnerabilities under data protection law.
- Analytics & AI readiness: The lack of automated data quality rules, data lineage, and a centralized catalog creates significant risks for downstream AI models and automated decision-making systems relying on untracked data.
- Adoption & culture risk: Because data governance is perceived primarily as an IT responsibility rather than a business-wide duty, long-term user adoption and self-service scaling may face cultural resistance.
Next strategic step
Turn your scorecard into a 90-day action plan
You scored 9/25 points. In this strategy call, we will review your top gaps above and map out a practical execution plan tailored to your organization's unique goals.
1-on-1 session with a CDMP Certified Lead Consultant - Zero obligation
Prefer to talk it through first? Just reply to this email with your questions.
Reading the result
Read it in order — level, then radar, then quick wins — because the quick wins only make sense once you accept the axis they came from.
The level. The number matters less than the description attached to it, which is written in terms of what an organization at that level actually does. Check it against your own week. If it doesn't land, the interesting question is which of the fifteen answers was more generous than it should have been.
The radar. This is the part people screenshot. Almost nobody is uniformly immature, and the most common shape by a distance is respectable tooling and metadata sitting alongside no decision rights at all — a catalog nobody argues with because nobody has to. A single headline score hides exactly that asymmetry. The radar puts it on one page.
The quick wins. Three of them, chosen against your weakest axis and scoped to need no new budget and no new headcount, because "hire a team" is not a first move. This is the part sponsors read, so it is written to be forwarded.
What it is not
It is not a benchmark. There is no claim that you are in the 40th percentile of your industry, because a comparison against organizations you can't inspect tells you nothing you can act on and invites an argument about the sample instead of a decision about the work.
It is also not a lead qualification form wearing a diagnostic costume. The result is the deliverable. If it tells you your governance foundations are solid and your real problem is data literacy, that's a genuinely useful answer and it doesn't point at me.
What to do next week
If the weakest axis is ownership or decision rights, the playbooks and the articles at the foot of this page are the next step, in that order.
If it's quality, put a number on it with the cost of bad data calculator before you propose anything. A quality problem with a figure attached gets funded; the same problem described as "poor data quality" gets noted.
If it's literacy, the constraint is almost never a training budget. It's that nobody has ever been told which number is the official one.
And if you want the assessment run properly — interviews instead of a form, the disagreements between functions surfaced instead of quietly averaged away — that's the governance diagnostic, which is where most of my longer work starts.