Data Strategy Maturity: What to Assess and How to Act on the Result
A maturity assessment describes where an organisation stands. It does not say where it should stand or what to do first. Those are decisions, and the assessment is only useful if someone makes them.
A data maturity assessment compares an organisation’s current practice with a graded description of better practice, area by area. Done well, it gives leaders an agreed picture of strengths and weaknesses. What it does not give them is a plan. An assessment that ends with a level and a chart has stopped one step short of being useful. That is how the exercise comes to produce a number and no change in priorities.
This article covers what a maturity assessment can and cannot establish, how to choose what to assess and who should do the scoring, when a short snapshot is enough, and how to turn the result into a ranked list of improvements. It draws on two public frameworks, written for the UK and US governments, because both are published in full and both say unusually clearly how their results are meant to be used.
What a maturity assessment measures
The UK government’s framework defines data maturity as an organisation’s “capability, effectiveness and readiness to use data”1. The three words are worth separating. Capability is what the organisation can do. Effectiveness is whether doing it achieves anything. Readiness is whether it could take on more. An assessment that measures only the first will rate an organisation highly for owning tools it does not use.
Maturity models share a form. The research literature describes them as a sequence of levels that form an anticipated or desired path from an initial state to maturity, used to assess the present position, to guide improvement and to track progress2. Five levels follow that form in the UK framework, named Beginning, Emerging, Learning, Developing and Mastering, applied across ten topics1.
The framework is firm about what comes out at the end: “A maturity assessment does not generate a single ‘score’, rather it provides a matrix view of maturity across the topics and themes”1. An organisation can expect to be strong in some areas and weak in others, and the pattern is the finding. Averaging it away to report that the organisation is “a 2.6” discards the information the exercise was run to obtain.
What it cannot tell you
A review of maturity models in the academic literature gives a compact account of their limits. The authors note that such models have been criticised since they first appeared, on the grounds that they “oversimplify reality and lack empirical foundation”, and that they neglect the possibility of more than one route to maturity2. Four consequences matter to anyone commissioning an assessment.
The top level is not the target. A model describes what advanced practice looks like. It does not establish that every organisation needs it everywhere. The US Federal Data Strategy’s governance playbook says so directly: “It may be fine to decide that a moderate level of maturity is acceptable in some areas at a particular time”3.
Description is not prescription. The same academic review distinguishes three uses of a maturity model: descriptive, to assess the present; prescriptive, to say what to improve and how; and comparative, to benchmark. Applying that distinction to ten published models in a neighbouring field, the authors found that the principles for descriptive use were adequately met and that “the design principles for a prescriptive use, however, are hardly met”2. That finding concerns business process management models, not data models, and it should not be stretched. It does describe a pattern worth checking in any instrument: a model can be good at saying where an organisation is and offer little on what to do about it.
Self-assessment flatters. People scoring their own area have reasons to be generous, and people with a budget request pending have reasons to be severe. This is treated in the UK guidance as a design problem to be managed: validation “is particularly important for self assessment, where users may need additional assurance that potential bias has been mitigated”4.
Evidence of activity is not evidence of maturity. A policy may exist and be ignored. On this the UK guidance is explicit: “the existence of documentation is not in itself proof of a particular maturity level”4.
None of this argues against assessing. It argues for treating the result as an input to a decision and for being clear, before starting, about which decision that is.
Choose what to assess
The dimensions of an assessment determine what it can find. Two public approaches show the range.
Two public approaches to assessing data maturity
| UK Data Maturity Assessment for Government | US Federal Data Strategy | |
|---|---|---|
| What it provides | A complete framework: ten topics, six themes and five levels, set out row by row | A requirement to assess and guidance on how; the choice of model is left to each agency |
| Areas covered | Engaging with others; skills and knowledge; systems; knowing the data you have; making decisions with data; ethics; managing data; protecting data; setting data direction; taking responsibility for data | Governance, management, culture, systems and tools, analytics, staff skills and capacity, resource capacity, and compliance with law and policy |
| Output | A matrix across topics and themes, explicitly not a single score | A baseline, a desired level for each area and a list of priority improvements |
| Intended use | Prioritising resources against the organisation’s ambitions and responsibilities | Informing investment decisions and prioritising subsequent actions |
The first column is drawn from the UK framework1 and the second from the US playbook3. The two differ in how much they prescribe and agree on what the result is for.
Three points help in choosing or adapting a model.
Cover direction as well as mechanics. An assessment confined to quality, metadata and tooling will miss whether the organisation knows what it wants from data. The UK framework gives a topic to “setting your data direction”, which asks, among other things, how far data strategy is linked to organisational strategy1. For an assessment of strategy maturity, that topic and the one on taking responsibility for data carry most of the weight. The links between those areas and the rest of governance are set out in what data governance is and what a working programme contains.
Fit the instrument to the capacity available. The US playbook advises agencies to “select a model that balances the information they need and the resources they have for assessment”3. An instrument too detailed to complete produces no result at all.
Do not trim away the uncomfortable parts. Departments are allowed by the UK guidance to work with a subset of the full framework, provided it still covers all ten topics, and adds a warning: “Take care to not eliminate rows because they may return a low maturity score”4.
Decide who scores
Who takes part shapes the answer as much as the questions do.
A scoring group drawn only from the data function will describe the data function. The UK guidance asks for a wider set of contributors: experts and those responsible for particular activities and systems, and also “non-experts or non-technical colleagues who may be the users of data outputs”4. People who depend on data see failures that its producers do not.
Each judgement should rest on something that can be checked. That may be a document, a log or an audit report, read with the caution already noted that a document shows intent and not practice. Where scorers disagree, the disagreement is information. A two-level gap between how a central team and a business unit rate the same area tells leaders more than the average of the two.
Someone senior has to own the exercise and what follows from it. Departments are asked by the UK guidance to assign accountability for the assessment to a named senior officer, who may or may not be a data specialist4. Without that, the result belongs to the team that ran it, and that team cannot act on most of it.
Snapshot or full assessment
A full assessment is a substantial piece of work. The UK framework has 97 rows1, and its own guidance sets about fifty as the floor for a first, reduced version4. That effort is justified in some circumstances and wasted in others.
A short snapshot, ten or so questions answered by a small group, is enough when the purpose is to open a conversation: to show an executive team that views differ, to find which two or three areas deserve a closer look, or to give a new data leader an early reading. It is a way of deciding where to spend the effort of a proper assessment. The first 90 days as a data leader discusses that early use.
A full assessment is warranted when the result will carry weight: when it will inform a multi-year investment, set a baseline against which progress will be reported, or be compared across business units. Those uses need evidence, a wider group of contributors and validation.
For departments doing this for the first time, the UK guidance takes a middle course and recommends “a carefully targeted assessment of a strategically important area of your organisation”4. Assessing one important part thoroughly teaches more, sooner, than assessing everything thinly.
The Data Maturity Quick Scorecard is the snapshot form: a short self-assessment for a first reading. The Data Strategy Maturity Assessment is the fuller instrument, with dimensions, level descriptions and a structure for recording evidence.
Turn the result into a ranked list
This is the step where an assessment can stall, and it is the one both public frameworks insist on.
Set a target for each area. The US playbook’s checklist asks agencies to “identify the desired level of maturity for each area assessed” before comparing it with the assessed level3. The target comes from what the organisation is trying to do. An area that supports a current priority may need to be strong. An area that supports nothing in the plan can stay where it is.
Rank the gaps by consequence. A large gap in an area that matters little ranks below a small gap in an area on which a major commitment depends. The UK framework frames this as a question of risk: areas of low maturity “that present a risk to the delivery of organisational priorities can be identified and resolved”1. The priorities are the organisation’s, taken from its strategy, so an assessment cannot be acted on without one. What a data strategy is and the decisions it has to make describes where those priorities are set.
Name what must be protected. Improvement is half of the output. The guidance asks for recommendations on “which areas of higher maturity should be prioritised for monitoring or maintenance” as well as on those to improve4. A strength that a critical service depends on is a risk if nobody is assigned to keep it.
Turn the top of the list into funded work. Three or four improvements with an owner, a cost and a date will do more than fifteen recommendations. The US playbook describes the intended use as informing “investment decisions” and prioritising “subsequent actions”3. Ordering those actions, and deciding which foundations come before which visible results, is the subject of from data strategy to roadmap.
One question is offered in the UK guidance as the test of the whole exercise: “Are we capable, effective and ready to use data to achieve our strategic goals, meet performance targets and prepare for the future?”4. If the assessment has not helped leaders answer it, the list has not been written yet.
Repeat it, and compare with care
An assessment is most informative the second time. The US playbook says it “should be repeated periodically, as determined by the agency, to measure progress and prioritize next steps”3. Repetition needs the same instrument, the same scope and broadly the same method, or the change measured will be a change in the measuring.
Comparison between organisations needs more caution. The National Audit Office reported in 2023 that the UK assessment was being trialled with 11 organisations and was intended to “enable future benchmarking work” across government5. Benchmarking has value when the instrument and the method are common. Where each organisation has adapted the model and scored itself, a difference between two results may reflect two approaches to scoring.
There is also a specific readiness question that a general assessment will not answer. Whether an organisation’s data and platforms can support machine learning and generative AI is a narrower test with its own criteria, addressed in is your data platform ready for AI workloads.
Sources
- Central Digital and Data Office (UK Government). Data Maturity Assessment for Government: Framework. 27 March 2023.
- Röglinger, M., Pöppelbuß, J. and Becker, J. Maturity models in business process management. Business Process Management Journal, 18(2). 2012.
- Federal Data Strategy (United States Government). Federal Data Strategy Data Governance Playbook. July 2020.
- Central Digital and Data Office (UK Government). Delivering the Data Maturity Assessment: objectives and resources. 27 March 2023.
- National Audit Office (UK). Digital transformation in government: addressing the barriers to efficiency (HC 1171). 10 March 2023.
This article is general professional information. It is not legal or regulatory advice.