The DCMM Data Management Maturity Guide
DCMM is not "buying a certificate". It grades your data management capability into levels. Five levels, eight capability domains, and Level 3 is the target the majority of enterprises should genuinely aim at; Levels 1 and 2 carry limited weight in practice.
The Short Answer
If you only remember three sentences, remember these three:
One, DCMM is a "capability grading", not a "paperwork pass". What the assessment body wants to see are the data management activities the enterprise actually runs — whether the policies have landed, whether responsibility sits with named people, whether data quality closes the loop. A pile of documents improvised at the last minute will not survive an on-site review.
Two, Level 3 is the realistic target for the majority of enterprises. Level 1 means "basically no system"; Level 2 means "policies and posts have started to exist". Those two levels carry limited persuasive weight in bidding, performance assessment and data-on-balance-sheet scenarios, and many tender documents write the threshold at Level 3 outright. Levels 4 and 5 rest on quantified indicators and long-term data accumulation; they cannot be rushed through in a few months.
Three, DCMM assesses "data management capability as a whole", not data security specifically. For a security-specific scheme, look at DSMM; for an internationally recognised information security management system certification, look at ISO 27001. The three have different positions, can be combined, but cannot substitute for one another.
Certification Overview
This table sets the basic coordinates first: who promotes it, what is assessed, how many levels there are, and how the result is used.
| Item | Governing and promoting system | Assessment object | Levels | Reference notes |
|---|---|---|---|---|
| DCMM data management capability maturity assessment | An assessment system in the domestic data management field, implemented by qualified assessment bodies | The data management capability of the enterprise (organisation) as a whole | Level 1 to Level 5, five levels in total | The level result is issued by the assessment body; the certificate has a validity period, subject to current rules |
| What the assessment covers | Developed within the same system | 8 capability domains: Data Strategy, Data Governance, Data Architecture, Data Application, Data Security, Data Quality, Data Standards, Data Lifecycle | Each domain is rated, then an overall level is formed | The specific clauses of the capability domains are subject to the current version of the standard |
| Common acceptance scenarios | Tender issuers, group headquarters, supervisory authorities | Bid qualification and scoring, data asset capitalisation, group digitalisation performance assessment | Level 3 or above is usually required | The acceptance criteria are subject to the tender documents and the requirements of the authority in force at the time |
| Relationship with DSMM | Two independent systems that can be combined | DCMM assesses data management as a whole; DSMM focuses on data security capability | Each is rated independently | They cannot substitute for each other |
| Relationship with ISO 27001 | Domestic assessment system vs international standard certification | DCMM assesses data management capability; ISO 27001 assesses the information security management system | ISO 27001 is a certification and has no maturity levels | They cannot substitute for each other |
What DCMM Actually Assesses
People who work with data often hold an illusion: that data governance is "an internal matter" nobody outside can see. DCMM exists precisely to refute that — it breaks "how well is data managed" into a set of actions that can be checked against a list, discussed in interviews and sampled at random, and then maps those actions onto different maturity levels.
So the landing point of the assessment is not "have you ever written a data governance plan", but "does this plan have a corresponding organisation, budget, regular meeting and performance assessment, and has it actually driven anything in the past period". Assessment bodies typically cross-verify through document review, personnel interviews and system sampling: is the process written in the documents the same process the business staff describe?
This also explains why some enterprises produce very thick materials and still get held down a level: the documents were "written out", not "run out". Data management maturity is essentially an organisational state, and documents are only the shadow of that state. A shadow can be drawn in advance, but one question on site exposes it.
Looked at from another angle, DCMM is useful beyond the certificate. It provides a shared language: the business department says "the data is wrong", the IT department says "the source is not governed", and management hears two unrelated sentences. Once aligned through the capability domains, those arguments turn into concrete to-do items — which domain lacks a policy, which domain lacks indicators, which domain lacks an accountable owner.
How the Five Levels Are Divided
The five levels are one continuous slope, not five labels you can pick at will. Skipping levels is very hard to sustain in practice, because the requirements of a higher level usually presuppose that the lower level has landed.
| Level | Name | Typical state | Practical meaning |
|---|---|---|---|
| Level 1 | Initial | Data management is largely reactive; policies and fixed accountable owners are missing, and problems are solved through ad hoc coordination | A starting marker with limited external persuasive weight |
| Level 2 | Managed | Policies and posts begin to be established and key data activities have owners, but cross-departmental coordination is unstable | There is a foundation, yet it still struggles to meet the threshold of the majority of tenders |
| Level 3 | Robust | Policies form a system and are running; the eight capability domains have relatively complete mechanisms and cross-departmental coordination is routine | The realistic target for the majority of enterprises, and a common acceptance threshold |
| Level 4 | Quantitatively Managed | Quantifiable indicators are used to measure the effectiveness of data management, and process control can be based on data | Requires accumulated indicators and historical data to support it |
| Level 5 | Optimizing | Continuous improvement mechanisms are mature and data capability forms a loop with business innovation | Only a minority of organisations reach it; not suitable as a short-term target |
The Eight Capability Domains: A Self-Check List
The eight capability domains are not eight departments but eight viewpoints. The same enterprise, viewed from these eight angles, will show different problems. When doing a gap analysis, going domain by domain against the list is far more useful than saying vaguely "our data management is poor".
| Capability domain | The question it cares about | What it usually looks like inside an enterprise |
|---|---|---|
| Data Strategy | Should data be managed as an asset, and are the goals and the path clear | Data positioning and goals, implementation path, organisational and resource support |
| Data Governance | Who is accountable, how decisions are made, how performance is assessed | Governance organisation, policy system, division of responsibilities, assessment and communication mechanisms |
| Data Architecture | Where data sits, how it flows, how it is shared | Data models, data distribution, integration and sharing methods |
| Data Application | What data is used for and how the value shows up | Data analytics applications, external data services, value conversion paths |
| Data Security | Has classification and grading been done, and do permissions and audit keep up | Security policy, classification and grading, access control, audit and emergency response |
| Data Quality | Is the data accurate and complete, and how are problems closed out | Quality rules, monitoring mechanisms, problem detection and remediation loop |
| Data Standards | Are definitions unified, and is the same indicator the same calculation | Business terminology, master data, indicator and coding standards |
| Data Lifecycle | From creation to archiving and destruction, is every stage owned | Stage-by-stage management of collection, storage, use, sharing, archiving and destruction |
There is a small trick when self-checking: first look at "is there a person" and "is there a record", then look at "is it done well". Many enterprises stall below Level 3 not because the method is wrong, but because certain domains sit permanently in a state of "someone manages it ad hoc, but no fixed records exist". The assessment wants a traceable chain of evidence, and results produced ad hoc leave no trace behind.
Who Can Assess, and How It Works
DCMM is implemented by qualified assessment bodies, which conduct the assessment and issue the level result. When choosing, an enterprise should focus on two things: whether the body's qualification scope covers the level and industry you intend to apply for, and whether the assessment team genuinely understands your business scenario. We do not list specific bodies here; the qualification information published for the current period governs.
Set the level and scope
Determine the target level in line with the acceptance scenario, and define the organisational and business scope the assessment covers
Gap analysis
Go item by item through the eight capability domains and identify where policies, records or indicators are missing
Fill mechanisms, not files
Get the missing actions actually running, and produce meeting, ledger, inspection and remediation records
Assemble the evidence
Organise policies, processes, records, system screenshots and indicator data by domain into a chain of evidence
On-site assessment
Document review, personnel interviews and system sampling are cross-checked to verify that materials and operation agree
Result and improvement
After obtaining the level result, keep improving against the assessment findings and leave headroom for the next re-assessment
Which Enterprises It Suits
Not every enterprise needs DCMM. The test is simple: is there an external scenario asking "how well is your data managed"? If not, solving your internal data problems first is more practical than obtaining a level.
Bidding on government and state-owned enterprise data projects
The tender documents make the data management capability level a qualification condition or a scoring item. Such demand is clear and the milestones are defined, which makes it the commonest trigger. The specific acceptance criteria are subject to the tender documents.
Preparing for data asset capitalisation
For data to be recognised as an asset, ownership, quality and the management process must be explained clearly. The eight DCMM capability domains map exactly onto that explanatory logic and reduce communication cost with auditors and valuers.
Group digitalisation performance assessment
The group brings data management into the assessment of its subsidiaries and needs a relatively uniform yardstick. DCMM level results make horizontal comparison easy and help headquarters identify weaker units.
Data governance will not move
It has been pushed internally for years and business departments still cooperate reluctantly. Using an external assessment to build consensus and pressure is often more effective than an internal circular — this is the real motive for a good number of enterprises.
About to build a data platform or master data
Assessing before deploying systems avoids "the system is built but the standards are not set". The standards and responsibility allocation produced by the assessment are themselves the prerequisite input for system construction.
Not recommended to start yet
Enterprises with little data, no clear data application scenario and no external acceptance requirement are better off doing basic governance first. Certifying for the sake of certifying gives a poor return on investment.
Relationship with DSMM and ISO 27001
These three names are often asked about together, yet they answer three different questions. Discussing them as one thing easily leads to a wrong budget.
| System | What it assesses | Nature | Typical use scenario | Can they substitute for each other |
|---|---|---|---|---|
| DCMM | Data management capability as a whole, covering the eight capability domains | An assessment system in the domestic data management field, in five levels | Bidding on data projects, data asset capitalisation, group digitalisation performance assessment | No |
| DSMM | Data security capability, focused on protection of data at each stage | A domestic data security capability maturity model | Dedicated data security programmes, external demonstration of security capability | No; it cannot replace DCMM's governance perspective |
| ISO 27001 | The information security management system, covering the organisation's information security risk management | An international standard certification; the result is pass or fail | Demonstrating information security management externally, cross-border cooperation and tendering | No; it cannot replace DCMM's data management perspective |
DCMM and DSMM: the whole and the specialism
DCMM assesses "data management capability as a whole", while DSMM specialises in "data security capability". One covers a wide area, the other drills deep. They can be combined: use DCMM first to lay the foundations of governance structure, standards and quality, then use DSMM to deepen the security line.
Conversely, doing DSMM without DCMM easily produces a situation where "security is managed in fine detail, but data definitions remain chaotic"; doing DCMM without DSMM leaves the security domain as the part that regularly loses points in an assessment.
DCMM and ISO 27001: domestic assessment and international certification
ISO 27001 is information security management system certification under an international standard, and the result is "certified"; DCMM is a data management capability assessment under a domestic system, and the result is "reaching a certain level". The two use different frames of reference, and one set of documents cannot satisfy the requirements of the other.
If an enterprise needs both, it is advisable to proceed in sequence rather than launching them at the same time — the documentation system, the interviewees and the responsible departments overlap heavily, and running both together will exhaust the team. The order depends on the requirements of customers and tender issuers: satisfy the hard threshold first.
Common Pitfalls
| Pitfall | How it shows up | How to avoid it |
|---|---|---|
| Treating it as "buying a certificate" | Only materials are prepared and no mechanism is built, so the on-site interview cannot be answered | Build the operating mechanism before talking about documents; the chain of evidence must trace back to a date and an accountable person |
| Going straight for Level 4 | No quantified indicators and no historical data, and the target is set too high | Consolidate Level 3 first and accumulate indicators for one to two years before discussing an upgrade |
| Business departments absent | Everything is done by the IT and information departments, and the business definitions do not match during interviews | Bring business, finance and legal in at project kick-off and name the owner of each domain |
| Materials and reality disconnected | The policies are comprehensive, but no corresponding record can be found in the systems | Use "can the system be queried, is the ledger updated" as the acceptance criterion |
| Confusing DCMM with DSMM | Assuming that doing data security means doing data management | Self-check against the eight capability domains; security is only one of them |
| Ignoring the certificate validity period | The mechanisms stop after certification and the system has dispersed by re-assessment | Embed the assessment requirements in the annual performance assessment; validity is subject to current rules |
| Expecting one certificate to settle capitalisation | Assuming that having a level means the data asset can be recognised | Capitalisation involves ownership, measurement and audit; the level is only one piece of supporting evidence of management discipline |
Key Information
| Name of the system | DCMM (Data Management Capability Maturity assessment) |
| Nature of the system | An assessment system in the domestic data management field, not an international certification |
| Assessment object | The data management capability of the enterprise (organisation) as a whole |
| Level structure | Level 1 Initial, Level 2 Managed, Level 3 Robust, Level 4 Quantitatively Managed, Level 5 Optimizing |
| Capability domains | Data Strategy, Data Governance, Data Architecture, Data Application, Data Security, Data Quality, Data Standards, Data Lifecycle |
| Implementing party | Qualified assessment bodies; the qualification scope is subject to the information published for the current period |
| Form of result | A level result issued by the assessment body; the certificate has a validity period, subject to current rules |
| Realistic target | The majority of enterprises target Level 3; Levels 1 and 2 carry limited external acceptance value |
| Common drivers | Bidding on government and state-owned enterprise data projects, data asset capitalisation, group digitalisation performance assessment |
| Related systems | DSMM assesses data security specifically; ISO 27001 is information security management system certification. The three can be combined but are not interchangeable |
| Cost and timeline | Subject to the assessment of the body; varies with the target level, the scope covered and the existing foundation |
| Basis of the clauses | The specific requirements of the capability domains and levels are subject to the current version of the standard |
FAQs
At which level do enterprises usually start with DCMM? Can we apply directly for Level 3?
Do we need both DCMM and DSMM?
Does a DCMM certificate have a validity period? What happens at expiry?
With a DCMM level, do we still need ISO 27001?
Decide which level to aim for before discussing investment
Tell us your industry, your current data situation and your acceptance scenario, and we will help you judge whether the target level is realistic and which capability domains the gaps concentrate in
📞 Free Assessment