A data governance maturity model is a scale, typically of four to six levels, that describes how well an organization decides who owns data, sets the rules for it and makes those rules stick. “We need better governance” is hard to fund, while “we are at level 2 and need to reach level 3 by June” is a plan. The rubric below adds what level names alone leave out: the document an assessor would ask to see at each level. After it comes a way to score your own governance in about an hour.
Key takeaways
- Maturity models typically have four to six levels, and the levels vary with the model’s focus (TechTarget, “How to use a data governance maturity model”, July 2024).
- Three of the most well-known data governance maturity models date from 2007 to 2011: IBM’s Data Governance Council model (October 2007), Gartner’s enterprise information management model (December 2008) and Stanford’s (2011), according to George Firican’s LightsOnData summaries.
- In the EDM Association’s 2026 benchmark of over 435 organizations, most scored Developmental or Defined on nearly every DCAM component, and the report concludes that data management is not yet business as usual in most enterprises.
- In our rubric, level 3 is the first level whose evidence is approved rather than drafted: a signed-off charter, named owners, minutes that record decisions and an issue log with closure dates.
Updated November 2026
What is a data governance maturity model?
It is a narrower cousin of the data maturity model. A data maturity model scores every area of data management, from architecture to quality. A governance model scores only the hub of a data governance framework: decision rights, roles, policies, the forums where decisions are made, and how data issues get resolved. On the DAMA Wheel, that is the one area in the middle.
Because governance is about authority, the evidence looks different from other areas. You don’t prove governance with a tool. You prove it with documents that show a decision was made by someone entitled to make it, and that people followed it.
What are the five levels of governance maturity?
Here is the rubric we use, with our five level names. Read across a row to see what an assessor would expect at each level, and use the last column to decide what to ask for.
| Level | Roles and decision rights | Policies and forums | Issue handling | Evidence to ask for |
|---|---|---|---|---|
| 1 Initial | Nobody formally owns data. IT decides by default. | No policies, or one from years ago that nobody can find. No forum. | Whoever finds a problem fixes it, often downstream in a spreadsheet. | Ask who would approve a change to the definition of “customer”. Expect several different answers. |
| 2 Developing | An executive sponsor exists. A few owners are named, mostly in IT. | Draft policies. A working group meets when someone calls it. | Issues are logged but rarely tracked to closure. | A sponsor’s email or memo, a draft charter, an issues spreadsheet. |
| 3 Defined | Owners and stewards named for critical data domains, with written responsibilities. | Approved policies, published where staff look. A council with a charter that meets on a schedule. | A documented process: owner, priority and due date for every issue. | The approved charter, a RACI, minutes that record decisions, an issue log with closure dates. |
| 4 Managed | Governance duties are in job descriptions and performance goals. | Compliance with policies is checked; exceptions are recorded and approved. | Issues are root-caused, and their age and volume are reported. | A governance scorecard sent to executives, compliance check results, issue trends over two or more quarters. |
| 5 Optimized | Owners act without being chased; new systems get owners before go-live. | Policies are reviewed on a cycle and changed when the measures say so. | Recurring issues fall because their causes are fixed at source. | Project gates with governance sign-off, records of the annual review, changes made because of the measures. |
Score each column on its own. For illustration, an organization might have level 3 policies (written, approved, published) and level 1 issue handling. An average of the two would hide the more useful finding.
How do the well-known models compare?
The models in the table below were published between 2007 and 2014. This is what each one is, in brief:
| Model | Published | Scale | Worth knowing |
|---|---|---|---|
| IBM Data Governance Council Maturity Model | October 2007 | 5 levels: Initial, Managed, Defined, Quantitatively Managed, Optimizing | Scores 11 categories, from value creation and policy to stewardship and audit |
| Gartner enterprise information management maturity model | December 2008 | 6 levels, 0 Unaware to 5 Effective | Covers information management as a whole; Gartner updated it in 2016, and its material is for Gartner clients |
| Stanford Data Governance Maturity Model | 2011 | The same levels as IBM’s | Three dimensions (people, policies, capabilities) across six components |
| CMMI Data Management Maturity (DMM) model | May 2014 | 5 capability levels | 25 process areas covering the disciplines of data management |
| DAMA-DMBOK2 | Second edition, revised 2024 | 6 levels, 0 to 5 | A chapter on running a maturity assessment, with a generic scale |
| DCAM (EDM Association) | 2014 (v3 July 2025) | 6 points, 1 Not Initiated to 6 Enhanced | Governance is one of eight components; 5 (Achieved) is the minimum target |
Our comparison of data management maturity models covers the wider models in more depth. The level names differ, but they describe the same climb: from ad hoc, through written and repeatable, to measured and improving. The summaries cited above give level names and descriptions, not the documents that prove each level, which is why we built the rubric above around documents an assessor can check. If you also need to assess the other areas, our post on the DCAM framework explains how DCAM scores governance alongside strategy, funding and controls.
How do you score your governance in an hour?
- Get three to five people in a room: the sponsor or their delegate, a data owner from the business, someone from IT and someone who handles data issues day to day.
- Score the first three columns of the rubric one at a time, each person privately, from 1 to 5. Anyone who can’t tell answers “Don’t know”, and that answer is left out of the score.
- Check the last column before you accept any score of 3 or more. No document, no 3.
- Average each column across people, then average the columns for an overall governance score.
- Start work on the lowest column, not the one that is easiest to improve.
For illustration, a team of four ends up with these column averages: roles and decision rights 2.5, policies and forums 3.0, issue handling 1.5. The overall score is (2.5 + 3.0 + 1.5) ÷ 3 = 2.3, level 2, Developing. Issue handling is the lowest, so the next quarter goes into an issue process with owners and due dates, ahead of another policy. For a full assessment across every area, see our six steps for a data maturity assessment.
What does it take to move from level 2 to level 3?
The EDM Association calls a similar step on the DCAM scale, from Developmental to Defined, the hardest one. Level 2 depends on goodwill: a sponsor who cares and a working group of volunteers. Level 3 replaces goodwill with written authority. In practice that means four documents and one habit:
- A governance charter, approved by an executive, that says what the council decides and who sits on it.
- Named owners and stewards for the three to five data domains that matter most, with responsibilities in writing.
- A short set of approved policies, starting with data ownership and data quality.
- An issue process with an owner, a priority and a due date for each issue.
- The habit: a council that meets on a fixed schedule and minutes every decision.
None of this needs software. It is meetings and signatures, and the order matters: the charter first, because the owners and policies need someone with authority to approve them. Our data governance roadmap lays the steps out over 12 months.
DAMA and DAMA-DMBOK are trademarks of DAMA International, and DCAM is a registered trademark of EDM Council Inc. (EDM Association). Level Up Your Data is not affiliated with or endorsed by either organization; the rubric above is our own.
Frequently asked questions
What are the levels of data governance maturity?
Most models use four to six levels, according to TechTarget. The five levels this post uses are Initial, Developing, Defined, Managed and Optimized: from no formal ownership, through written and approved roles and policies, to governance that is measured and improved. Gartner’s older model has six, from Unaware to Effective.
How do you assess data governance maturity?
Ask a small group from business, IT and data operations to score roles, policies and forums, and issue handling separately, then ask for the documents behind any score of 3 or above. A data governance maturity assessment without evidence measures opinion, not governance.
What is the Gartner data governance maturity model?
In George Firican’s LightsOnData summary, it is Gartner’s enterprise information management maturity model, introduced in December 2008, with six levels from 0 (Unaware) to 5 (Effective). Gartner released an updated model in 2016. Its research and toolkits are for Gartner clients, so public descriptions, this one included, are second-hand.
What level of governance maturity do most organizations reach?
The EDM Association’s 2026 benchmark, a survey of over 435 organizations, found most scoring Developmental or Defined on nearly every DCAM component. On a five-level model, that roughly corresponds to working toward level 3, with formal roles and policies only partly in place.
Summary
A data governance maturity model is only useful if each level comes with evidence you can check. Score roles, policies and forums, and issue handling separately, ask for the documents, and put your first quarter into the lowest column.