Data Maturity Assessments: What They Are, What They Find, and Why They Matter

Most public bodies already manage data. Staff maintain registers, process applications, generate reports, and share information with partner organisations every day. The challenge is that how data gets managed often depends on who you ask. One team has a naming convention; another doesn’t. A records management policy exists, but many staff haven’t read it. Someone built a workaround in Excel years ago and it quietly became the process.

A data maturity assessment makes these patterns visible. It gives an organisation a clear picture of how data is managed in practice and identifies where improvements would have the greatest impact.

Capability maturity models have been around since the mid-1980s, when Carnegie Mellon’s Software Engineering Institute developed a framework to evaluate software development practices. The core idea was simple: organisations improve by understanding where they currently sit on a maturity scale and then working deliberately toward the next level. That concept has since been applied to fields well beyond software, including data management.
The DAMA-DMBoK framework (the Data Management Body of Knowledge, maintained by DAMA International) is the most widely adopted maturity model for data management. In Ireland, the OGCIO recommends it as the standard framework for public service bodies.

It covers eleven knowledge areas, including data governance, data quality, security, metadata, and data integration. It places the organisation on a five-level scale: from Level 1 (ad hoc, where success depends on individual staff) through to Level 5 (optimised, where processes are automated and continuously improved).

A maturity assessment should draw evidence from several sources. Surveys alone can produce misleading scores, as staff often answer based on what policies say rather than what actually happens day to day.

A well-run assessment usually combines a structured survey with facilitated workshops or interviews and a review of existing documentation.

The DMBoK names a specific risk here: that “conversations on data quickly devolve into discussions about systems”. A well-run interview should steer past this.

The workshops are often the most valuable part. They surface the everyday realities people rarely have time to discuss: reports that take days because they require data from three systems, folder structures nobody understands, or processes that depend on one person’s knowledge. Giving staff a space to raise these issues, and having those issues documented and taken seriously, matters as much as the final report.

Across organisations, the same patterns appear repeatedly:

Data management exists to support the organisation’s real work

A data maturity assessment gives management an evidence base for deciding what to improve and in what order. Some recommendations will be quick to act on: switching on a feature that’s already available, documenting a process that currently lives in someone’s head. Others will need investment and planning, and the assessment helps make the case in concrete terms.

The DMBoK describes this as an ongoing cycle: an initial assessment establishes a baseline, a roadmap defines the next steps, and periodic reassessment tracks progress over time. The assessment results sit within a broader programme of data governance and strategy, and the roadmap gives a sequence and pace for change.

For organisations considering whether to start, the OGCIO has published a self-assessment guide and advice note based on the DAMA-DMBoK framework. For those looking for external support, Derilinx has conducted data maturity assessments for over 40 public service bodies across Ireland (more information on our recent work in the OGP Framework Report).