🔐 Data Security · China Assessment Scheme

The DSMM Data Security Maturity Guide

DSMM does not ask "have you bought a firewall". It asks whether data can be held secure from collection through destruction. Put five levels, four capability dimensions and six lifecycle stages on one line, and the weak spot shows up at a glance.

The Short Answer

If you only remember three sentences, remember these three:

One, DSMM assesses "whether data can be held secure at each stage of its lifecycle". It does not look at how long your list of security products is. It looks at whether you have a lawful basis when collecting, whether the channel is controlled when transmitting, whether classification and grading are right when storing, whether permissions are contained when processing, whether approval was gone through when exchanging, and whether deletion is complete when destroying. Each of these six matters needs an accountable owner, a policy, a technical means and a record.

Two, DSMM and DCMM are not the same thing. DCMM governs "how well data is managed" — strategy, governance, architecture, quality and standards as one set — and cares about whether data can be put to use and used accurately. DSMM governs "whether data can be held secure" and watches only the security line. One is about managing well, the other about holding secure: different perspectives, combinable in practice, and neither substitutes for the other.

Three, DSMM and ISO 27001 are not the same thing either. ISO 27001 is information security management system certification under an international standard. It takes the organisation-level ISMS perspective, and the outcome is certified or not certified. DSMM is a domestic data security capability assessment. It takes the perspective of the data itself, and the outcome is reaching a certain level. Carrying a set of ISO 27001 system documents over will not support DSMM's on-site verification.

In one line: DSMM turns "how good is our data security" from a self-evaluation into a ruler that can be compared externally and checked stage by stage. Its value lies in showing which cell the weak spot falls into, not merely in giving a level.

Certification Overview

This table sets the basic coordinates first: who assesses, what is assessed, how many levels there are, and how the result is used.

Item	Assessment system	Assessment object	Levels	Reference notes
DSMM data security capability maturity assessment	An assessment system in the domestic data security field, implemented by qualified assessment bodies	The data security capability of the enterprise (organisation), assessed at each stage of the data lifecycle	Level 1 to Level 5, five levels in total	The level result is issued by the assessment body; the certificate has a validity period, subject to current rules
What the assessment covers	Developed within the same system	Six data lifecycle stages: collection, transmission, storage, processing, exchange, destruction; four capability dimensions: organisation, policy, technology, personnel	Each stage and each dimension is rated before an overall conclusion is formed	Clauses and scoring rules are subject to the current version of the standard and the requirements of the assessment body
Common acceptance scenarios	Supervisory authorities, tender issuers, group headquarters, partners	Evidence of data security compliance, industry regulatory inspection, government and enterprise project bidding	Subject to the requirements of the accepting party in force at the time	The acceptance criteria are subject to the tender documents and regulatory requirements
Relationship with DCMM	Two independent systems that can be combined	DCMM assesses data management capability as a whole; DSMM focuses on data security capability	Each is rated independently	They cannot substitute for each other
Relationship with ISO 27001	Domestic assessment system vs international standard certification	DSMM assesses data lifecycle security; ISO 27001 assesses the information security management system	ISO 27001 is a certification and has no maturity levels	They cannot substitute for each other

What DSMM Actually Assesses

People who work in security easily fall into a habit: putting their energy into equipment and platforms. Buy situational awareness, database audit, bastion hosts and encryption appliances, and the system feels built. DSMM asks differently — it does not ask "which devices do you have", it asks "when data reaches this stage, who is responsible, under what rules, with what means, and what record is left behind".

Capability is the combination of the four questions. Equipment answers only the third. An on-site assessment typically runs like this: first check whether your policies state the requirement for a given stage, then pick a real data flow and keep asking — who approved this data, which channel did it travel, which table did it land in, who can query it, is there a log of those queries, and what happens to it at expiry. If one or two of the four questions cannot be answered, that cell cannot be pushed up.

So the landing point of DSMM is not document completeness but how verifiable the capability is in real business. Documents are a necessary condition, not a sufficient one. If the file says "sensitive data leaving the repository requires approval" while the system cannot show a single approval flow, that item effectively does not exist in the assessment.

Looked at from another angle, DSMM is useful beyond the result. The six stages × four dimensions it provides form a practical self-check grid: fill each cell with "who manages it, on what basis, with what tool, and what happened last year", and the weak spots surface by themselves. Many enterprises discover after a gap analysis that the money went into the processing stage while the exchange and destruction cells are nearly empty — yet data leakage and data residue largely go wrong in those two cells.

How the Five Levels Are Divided

The five levels are one continuous slope, not five labels you can pick at will. A higher level usually presupposes that the lower level has landed, and applying while skipping levels is very hard to sustain in practice.

Level	Name	Typical state	Practical meaning
Level 1	Informal execution	Security actions rely on individual experience and ad hoc response; there are no written requirements and no fixed accountable owner	A starting marker with limited external persuasive weight
Level 2	Planned and tracked	Key stages begin to have policies and accountable owners, and actions can be tracked, but cross-departmental coordination is unstable	There is a foundation, yet it still struggles to meet the majority of external requirements
Level 3	Well defined	Policies form a system and cover all six stages; responsibilities, processes and records close the loop, and work can be executed as defined	The watershed where the system genuinely runs; the majority of enterprises treat it as the realistic target
Level 4	Quantitatively controlled	Quantifiable indicators are used to measure the effectiveness of security capability, and process control and early warning can be based on data	Requires accumulated indicators and historical data to support it
Level 5	Continuously improving	The improvement mechanism is routine, and capability allocation can be adjusted proactively as risks change	Only a minority of organisations reach it; not suitable as a short-term target

On the target level: do not start by asking "which level can we get"; start by asking "which level does the accepting party require". Some tender documents name a specific level, some only require an assessment result, and others look at a gap analysis report. Set the target wrong and the investment will be either too low or too high — both are a waste.

The Six Data Lifecycle Stages: the Real Battleground

The six stages form a chain, and a chain is only as strong as its weakest link. Storage encryption can be as strict as you like, but if the exchange stage sends files over a chat app, the whole chain breaks. Walking stage by stage through a gap analysis is far more useful than talking vaguely about "raising security awareness".

Stage	The question it cares about	What it usually looks like inside an enterprise
Collection	Where the data comes from, whether there is a lawful basis, and whether only the necessary part is collected	Lawfulness of source, authorisation and notice, necessity of the collection scope, management of collection interfaces and channels
Transmission	Whether data on the move can be seen, altered or intercepted	Channel encryption, boundary control, internal/external network and third-party links, transmission audit
Storage	Where data sits, whether it is classified and graded, who can reach it, and how long it is kept	Classification and grading, storage encryption, access control, backup and disaster recovery, retention period management
Processing	Who is using it, to what extent, and whether operations leave a trace	Permission and role management, masking and de-identification, operation audit, isolation of development and test environments
Exchange	Who receives the data, on what basis, and whether it can still be controlled once handed over	Approval for sharing and external provision, interface and API control, third-party agreements, flow records
Destruction	Whether deletion is complete once the data is no longer used, and how media are disposed of	Deletion and archiving at expiry, disposal of retired media and devices, destruction records and supervision

One point is often overlooked: the destruction stage carries no small weight in the assessment, yet inside the enterprise it is permanently unclaimed. Device retirement usually runs through the asset process, not the data process; when a cloud resource is released, snapshots and backups remain. Being unable to answer "how were the hard drives retired last quarter handled" during an assessment is not rare.

The Four Capability Dimensions: Taking Each Stage Apart

Looking at a stage alone only tells you "what has to be done"; adding the dimensions tells you "what it takes to get it done". In the same stage, a gap in any one of the four dimensions produces a completely different symptom: it may be that nobody is accountable, that there are no rules, that there are no tools, or that people do not know how to use them.

Dimension	The question it cares about	Typical symptom when it is missing
Organisation	Who is accountable, who decides, how departments coordinate	Security work all falls on the IT department; business and data owners are absent and are only sought out after an incident
Policy	On what rules work is done, how processes run, how records are kept	Only one master document exists and stage-level detail is missing; policies exist without matching forms and ledgers
Technology	With what means the requirements land, and whether monitoring and traceability are possible	Tools are scattered and unsystematic, logs are dispersed, and no complete trail can be assembled after an incident
Personnel	Who holds permissions, whether they can use the tools, whether awareness keeps up	Permissions are never revoked, training is a formality, and frontline staff do not know which data must not be sent out

Six stages times four dimensions is a grid. In real projects the cells are never even — usually two or three cells are visibly collapsed, and those points are often the actual bottleneck in the rating. Piling resources onto the cells that are already done well is a very low-return play. Fill the collapsed cells first, then talk about overall improvement.

A reminder: the four dimensions are not four departments. The organisation dimension is about where responsibility lands, not how good the org chart looks; the policy dimension is about whether it can be executed, not how thick the documents are.

Who Can Assess, and How It Works

DSMM is implemented by qualified assessment bodies, which conduct the assessment and issue the level result. The certificate has a validity period; the specific number of years and the re-assessment arrangements are subject to current rules. When choosing a body, an enterprise should focus on two things: whether the qualification scope covers the level and industry you intend to apply for, and whether the assessment team genuinely understands your business scenario. We do not list specific bodies here; the qualification information published for the current period governs.

Set the scope and target

Clarify what the accepting party requires, which systems and data the assessment covers, and whether the target level is realistic

Gap analysis

Go cell by cell through six stages times four dimensions and find where responsibility, policy, tools or records are missing

Fill mechanisms, not files

Get the missing actions actually running: name accountable owners, hold regular meetings, build ledgers, deploy the necessary technical means

Assemble the evidence

Organise policies, processes, approval records, log screenshots and drill and remediation records by stage into a chain

On-site assessment

Document review, personnel interviews and system sampling are cross-checked to verify that paper requirements and actual operation agree

✓

Result and improvement

After obtaining the level result, close the gaps against the assessment findings and leave headroom for the next re-assessment

On timeline and cost: these depend on the target level, the scope covered, the data volume, the existing foundation and the body's scheduling, subject to the assessment of the body. Any claim that gives a fixed number deserves caution — for the same Level 3, an enterprise that has run classification and grading and a permission system for two years and one starting from zero differ by an order of magnitude in workload.

Which Enterprises It Suits

The test is direct: is there an external scenario asking "to what degree is your data security capability". If there is not, sorting out internal classification, grading and permissions first is more practical than obtaining a level.

Data Security Law and Personal Information Protection Law compliance

Enterprises processing large volumes of personal information or important data need structured material that can explain "what we have done". The six DSMM stages map exactly onto that explanatory logic. Specific compliance obligations are subject to laws, regulations and regulatory requirements.

Industry regulatory inspection

In heavily regulated industries such as finance, healthcare, telecom and automotive data, inspections often require self-evidence of data security capability. With a third-party assessment result, communication costs drop noticeably.

Government and enterprise project bidding

Tender documents write data security capability as a qualification condition or a scoring item. Such demand is clear and the milestones are defined, which makes it a common trigger. The acceptance criteria are subject to the tender documents.

External sharing and data cooperation

When exchanging data with partners, opening interfaces or doing joint modelling, the other side will run security due diligence. An assessment result is a ready-made answer that reduces back-and-forth questioning.

Group security performance assessment

The group brings data security into the assessment of its subsidiaries and needs a relatively uniform yardstick. Level results make horizontal comparison easy and help headquarters identify weaker units.

Not recommended to start yet

Enterprises with little data, no personal information processing and no external acceptance requirement are better off doing basic asset inventory and permission consolidation first. Certifying for the sake of certifying gives a poor return on investment.

Relationship with DCMM and ISO 27001

These three names are often asked about together, yet they answer three different questions. Discussing them as one thing will certainly produce the wrong budget.

System	What it assesses	Nature	Typical use scenario	Can they substitute for each other
DSMM	Data security capability, focused on protection of data at the six lifecycle stages	An assessment system in the domestic data security field, in five levels	Evidence of data security compliance, regulatory inspection, government and enterprise bidding	No
DCMM	Data management capability as a whole, covering strategy, governance, architecture, quality and standards	An assessment system in the domestic data management field, in five levels	Bidding on data projects, data asset capitalisation, group digitalisation performance assessment	No; it cannot replace the security perspective
ISO 27001	The information security management system, covering the organisation's information security risk management	An international standard certification; the result is pass or fail	Cross-border cooperation, overseas customer due diligence, proof of information security level	No; it cannot replace the data perspective

DSMM and DCMM: holding secure and managing well

DCMM assesses "data management capability as a whole". Data security is one of its eight capability domains, and only one; DSMM takes that single domain apart and drills into six stages and four dimensions. One covers a wide area, the other drills deep.

The two can be combined. A common path is to use DCMM first to lay the foundations of governance structure, standards and quality, then use DSMM to deepen the security line. Conversely, doing DSMM without DCMM easily produces a situation where "security is managed in fine detail, but data definitions remain chaotic"; doing DCMM without DSMM leaves the security domain as the part that regularly loses points in an assessment.

DSMM and ISO 27001: the data perspective and the system perspective

ISO 27001 takes the organisation-level ISMS perspective: how the risk management system is built, operated and continually improved, and the result is "certified". DSMM takes the perspective of the data: whether data can be held secure as it passes through each stage, and the result is "reaching a certain level".

Enterprises that have done ISO 27001 start with an advantage: the policy framework, the risk assessment method, and the habits of internal audit and management review are already in place. But carrying documents across does not work — ISO 27001 organises its controls by risk domain while DSMM organises them by data stage, so the two coordinate systems have to be realigned once.

Further reading: for a side-by-side comparison when choosing between management system schemes, see How to choose between ITSS, CMMI, DCMM and CSMM; for the implementation path of DSMM, see the DSMM assessment practice guide; on the data management side, see the DCMM guide; on the information security side, see ISO 27001 and the CCRC information security service qualification.

Common Pitfalls

Pitfall	How it shows up	How to avoid it
Treating it as "buying a certificate"	Only materials are prepared and no mechanism is built, so the on-site interview cannot answer questions about a concrete data flow	Build the operating mechanism before talking about documents; evidence must trace back to a date and an accountable person
Piling up technology without policy	Plenty of tools were bought, but the rules cannot be explained and nobody reads the logs	Every technical means must map to one policy and one accountable person, otherwise it counts as not deployed
Running the assessment before classification and grading	No one knows which data is important data and which is personal information, so the whole chain has no starting point	Do the asset inventory and classification and grading first; they are the shared prerequisite of all six stages
Carrying ISO 27001 documents straight over	Controls do not map onto data stages, and two vocabularies collide during interviews	Rewrite along the data flow as the main line and map the existing controls into it
Covering only the storage stage	Encryption and permissions are very detailed, while exchange and destruction are nearly empty	Self-check cell by cell across the six stages, with emphasis on external provision and media disposal
Setting a target level detached from reality	Pushing for Level 4 without quantified indicators, and patching materials repeatedly	Consolidate Level 3 and get the system running smoothly first; discuss an upgrade after one to two years of indicator accumulation
Business departments absent	Everything is done by the IT department, and the business side does not know which category of data it holds	Bring business, legal and HR in at project kick-off and name the data owner of each stage
Mechanisms stall after certification	Regular meetings stop, permissions are not revoked, ledgers are no longer updated, and the system has dispersed by re-assessment	Embed the assessment requirements in the annual performance assessment; validity is subject to current rules

Key Information

Name of the system	DSMM (Data Security Capability Maturity)
Nature of the system	An assessment system in the domestic data security field, not an international certification
Assessment object	The data security capability of the enterprise (organisation), assessed at each stage of the data lifecycle
Level structure	Level 1 Informal execution, Level 2 Planned and tracked, Level 3 Well defined, Level 4 Quantitatively controlled, Level 5 Continuously improving
Data lifecycle	Collection, transmission, storage, processing, exchange, destruction — six stages in total
Capability dimensions	Organisation, policy, technology, personnel — four dimensions in total
Implementing party	Qualified assessment bodies; the qualification scope is subject to the information published for the current period
Form of result	A level result issued by the assessment body; the certificate has a validity period, subject to current rules
Realistic target	The majority of enterprises target Level 3; Levels 1 and 2 carry limited external persuasive weight
Common drivers	Compliance with the Data Security Law and the Personal Information Protection Law, industry regulatory inspection, government and enterprise project bidding
Related systems	DCMM assesses data management as a whole; ISO 27001 is information security management system certification. The three can be combined and are not interchangeable
Cost and timeline	Subject to the assessment of the body; varies with the target level, the scope covered and the existing foundation
Basis of the clauses	The specific requirements of the stages, dimensions and levels are subject to the current version of the standard

FAQs

What exactly is the difference between DSMM and DCMM? Do we need both?

The difference is in the perspective. DCMM assesses data management capability as a whole, covering eight capability domains — data strategy, data governance, data architecture, data application, data security, data quality, data standards and data lifecycle — and answers "is data managed well". DSMM focuses on data security capability, breaking that line into six lifecycle stages and four capability dimensions, and answers "can data be held secure". Whether to do both depends on the acceptance scenario: if the tender issuer wants a data management capability level, do DCMM; if it wants proof of data security capability, do DSMM. The two can be combined but cannot substitute for each other; with a limited budget, do the one that corresponds to the hard threshold first. Cost and timeline are subject to the assessment of the body.

With ISO 27001 in place, do we still need DSMM?

The two serve different purposes and usually cannot substitute for each other. ISO 27001 is information security management system certification under an international standard and the result is being certified; DSMM is a domestic data security capability assessment and the result is reaching a certain level. In scenarios such as cross-border cooperation and overseas customer due diligence, the other side usually looks at ISO 27001; in domestic regulatory inspection and government and enterprise bidding, it may look at a DSMM level or at data security capability material. Enterprises that have done ISO 27001 have a foundation in policy framework and risk assessment method, but the controls are organised by risk domain and have to be realigned by data stage — carrying the documents across will not pass on-site verification.

At which level do enterprises usually start with DSMM? Can we apply directly for a higher level?

The majority of enterprises target Level 3, because it is the watershed between "the system genuinely runs" and "the system is still pushed by people". Level 1 is informal execution and Level 2 is planned and tracked; those two levels mark a state more than anything else, and carry limited persuasive weight in external acceptance scenarios. Whether a higher level can be applied for directly depends on whether all six stages have policies, accountable owners and operating records; Level 4 and above also need quantifiable indicators and historical data. We suggest doing the gap analysis first and setting the target afterwards, rather than fixing the level and then assembling materials. The acceptance rules are subject to the requirements of the assessment body in force at the time.

Does a DSMM certificate have a validity period? What happens at expiry?

Yes, it has a validity period; the specific number of years and the re-assessment arrangements are subject to current rules. What needs thinking through in advance is this: the validity period tests "continued operation", not "exchange the certificate at expiry". If the responsible department is dissolved after certification, permissions are no longer revoked, exchange approval becomes a formality and ledgers stop being updated, the re-assessment will be visibly difficult. The steadier approach is to embed the assessment requirements in the annual security performance assessment and internal audit, so that records accumulate naturally in daily work instead of being patched together in one round before expiry.

Locate the weak cell first, then talk about investment

Tell us your industry, your data volume and your acceptance scenario, and we will help you judge whether the target level is realistic and which of the six stages are the real bottleneck

📞 Free Assessment