Scoring guide

1. Data Strategy & Business Alignment

Vision, prioritization, executive ownership, and measurable value from data investments.

2. Data Governance & Operating Model

Framework, decision rights, accountability, and measured governance effectiveness.

3. Data Architecture & Integration

Current/target architecture, standards, authoritative sources, and technical debt.

4. Data Quality

Critical data elements, measured dimensions, rules, remediation, and reporting.

5. Master & Reference Data Management

Domains, authoritative sources, resolution, hierarchies, and trusted distribution.

6. Metadata, Catalog & Lineage

Catalog, business and technical metadata, lineage, automation, and discoverability.

7. Data Security, Privacy & Lifecycle

Classification, access control, protection, retention, and demonstrable compliance.

8. Analytics, BI & Semantic Management

Governed KPIs, semantic models, self-service, product lifecycle, and adoption.

9. Data Engineering, Platforms & Operations

Engineering standards, environments, CI/CD, observability, and platform resilience.

10. Data Culture, Literacy & AI Readiness

Literacy, data-driven decisions, and readiness of data for AI and agentic use cases.

1. Enterprise Architecture Strategy & Business Alignment

Documented EA strategy, business outcome linkage, target state, and investment roadmaps.

2. Architecture Governance & Decision Rights

Principles, decision rights, review bodies, exceptions, and measured governance effectiveness.

3. Business Architecture

Capability maps, value streams, gap analysis, and operating-model guidance.

4. Data & Information Architecture

Information architecture, authoritative sources, canonical models, and analytics/AI enablement.

5. Application & Solution Architecture

Application portfolio, solution standards, rationalization, and buy-versus-build governance.

6. Integration & Interoperability Architecture

API, event, and messaging standards with reusable services and governed interfaces.

7. Technology, Infrastructure & Cloud Architecture

Current/target technology architecture, cloud patterns, resilience, and lifecycle roadmaps.

8. Security, Risk & Resilience Architecture

Security-by-design patterns, risk evaluation, threat modeling, and remediation governance.

9. Architecture Portfolio, Standards & Lifecycle Management

Architecture repository, standards lifecycle, technical debt, and portfolio health metrics.

10. Architecture Operating Model, Talent & Transformation Enablement

Architecture roles, skills, collaboration, delivery integration, and measured EA value.

1. Data Quality Strategy & Governance

Approved strategy, policy, executive oversight, funding, and measured program delivery.

2. Ownership & Stewardship

Named owners and stewards with authority, cross-boundary accountability, and training.

3. Standards, Dimensions & Rules

Dimensions, critical data elements, business-readable rules, and calibrated thresholds.

4. Data Profiling & Assessment

Profiling coverage, baselines, SME validation, and quantified impact from findings.

5. Preventive Controls & Validation

Entry validation, in-pipeline controls, change control, quarantine, and release gates.

6. Monitoring, Metrics & Reporting

Scorecards, rule-linked metrics, detection frequency, dashboards, and alerting.

7. Issue Management & Root Cause

Single intake, consistent classification, tracked ownership, and root-cause discipline.

8. Remediation & Data Correction

Prioritized fixes, controlled corrections, upstream repair, and post-fix validation.

9. Metadata, Lineage & Data Lifecycle

Rule-to-metadata linkage, lineage impact analysis, lifecycle, and third-party data terms.

10. Technology, Automation & Continuous Improvement

Tooling, versioned rules, governed automation and AI, adoption, and improvement loops.

1. Governance Strategy & Business Alignment

Documented strategy, measurable outcomes, executive understanding, and a funded roadmap.

2. Governance Operating Model

Defined operating model, council cadence, escalation paths, and clear decision scope.

3. Leadership, Accountability & Stewardship

Sponsors, owners, stewards, shared accountability, and current role assignments.

4. Policies, Standards & Controls

Approved policies, implementable standards, embedded controls, exceptions, and enforcement.

5. Data Domains & Critical Data

Defined domains, identified critical data elements, and value/risk-based prioritization.

6. Metadata, Definitions & Data Lineage

Business glossary, term-to-data linkage, technical metadata, and end-to-end lineage.

7. Data Quality Governance

Quality rules for critical data, consistent dimensions, issue workflow, and reporting.

8. Privacy, Security, Risk & Compliance

Classification, least-privilege access, cross-functional alignment, retention, and risk.

9. Data Lifecycle, Architecture & Technology

Lifecycle governance, pre-implementation review, architecture standards, and tooling.

10. Adoption, Measurement & Continuous Improvement

Role-based education, change management, KPIs, and continuous improvement loops.

1. Cybersecurity Governance & Strategy

Govern — strategy, policy, accountability, executive oversight, and measurable security objectives.

2. Cybersecurity Risk & Compliance Management

Govern / Identify — risk process, ERM integration, regulatory mapping, and remediation tracking.

3. Asset, Configuration & Vulnerability Management

Identify — asset inventory, classification, secure baselines, and vulnerability remediation.

4. Identity & Access Management

Protect — centralized identity, least privilege, MFA, lifecycle access, and privileged controls.

5. Data Security & Privacy Protection

Protect — data classification, encryption, access enforcement, DLP, and privacy safeguards.

6. Infrastructure, Endpoint, Cloud & Application Security

Protect — endpoint, network, cloud, and application controls plus Zero Trust security architecture.

7. Security Monitoring, Detection & Threat Management

Detect — centralized logging, detection engineering, threat intelligence, and coverage.

8. Incident Response & Cyber Crisis Management

Respond — response plan, incident handling, exercises, communications, and lessons learned.

9. Business Continuity, Resilience & Disaster Recovery

Recover — service prioritization, RTO/RPO, immutable tested backups, and cyber resilience.

10. Third-Party, Human & Emerging Technology Security

Govern / Protect — third-party risk, contractual assurance, workforce awareness, and emerging technology risk.

1. AI Strategy, Portfolio & Business Value

Approved AI strategy, governed use-case portfolio, value metrics, and funding cadence.

2. Governance, Risk & Responsible AI

AI policies, system inventory, risk assessment, accountability, and responsible-AI controls.

3. Data, Knowledge & RAG Readiness

Governed sources, curated knowledge, standardized RAG practices, and traceability.

4. Model / LLM Selection, Engineering & Evaluation

Model selection criteria, versioned prompts, evaluation suites, and adversarial testing.

5. AI Architecture, Integration & Platform

Reference architecture, reusable patterns, environment controls, integration, and FinOps.

6. Security, Privacy & Resilience

Threat modeling, sensitive-data protection, least privilege, guardrails, and resilience.

7. Use-Case Delivery, Human Oversight & Agentic AI

Product ownership, governed pilots, human oversight, agent boundaries, and process redesign.

8. LLMOps, Monitoring & Incident Management

Versioning, production telemetry, drift and safety monitoring, incidents, and retirement.

9. Vendor, Legal & Third-Party Management

Provider due diligence, IP and licensing, regulatory mapping, portability, and change monitoring.

10. Workforce, Adoption & Continuous Improvement

AI literacy, specialized skills, embedded adoption, behavioral metrics, and improvement loops.

1. Governance & Strategic Alignment

Strategy-linked intake and prioritization, sponsor accountability, portfolio oversight, and stop/pivot discipline.

2. Integration & Lifecycle Management

Approved charters, integrated plans, stage gates, integrated change control, and formal closure.

3. Scope & Requirements Management

Documented outcomes and acceptance criteria, requirements validation, decomposition, traceability, and scope control.

4. Schedule & Dependency Management

Dependency-based schedules, defensible estimates, critical-path management, and objective progress measurement.

5. Cost & Financial Management

Complete budgets, documented estimates, baseline variance tracking, and value/TCO reassessment.

6. Resource & Team Management

Capacity and skills planning, confirmed commitments, RACI accountability, and knowledge transfer.

7. Risk, Issue & Change Management

Consistent risk scoring and ownership, actionable responses, issue escalation, and portfolio trend analysis.

8. Quality & Assurance

Defined quality measures, assurance and testing controls, root-cause analysis, and independent reviews.

9. Stakeholder & Communications Management

Stakeholder mapping, planned communications, forecast-based status reporting, feedback, and escalation paths.

10. Delivery, Adoption & Benefits Realization

Tailored delivery, operational readiness, adoption and change management, benefit ownership, and post-implementation review.

1. Strategy & Business Alignment

Business rationale, prioritized use cases, funded roadmap, measured benefits, and executive sponsorship.

2. Governance & Operating Model

Decision rights, governance forums, role accountability, enforced standards, and controlled federation.

3. Ontology Architecture & Modeling

Modeling principles, consistent method, shared upper concepts, governed identifiers, and modular design.

4. Vocabulary & Taxonomy Management

Authoritative controlled vocabularies, precise definitions, taxonomy design, term reconciliation, and localization.

5. Lifecycle & Change Management

Documented lifecycle, versioning, downstream impact analysis, repeatable releases, and managed deprecation.

6. Technology, Tools & Repository

Modeling tools, governed repository, query and reasoning support, automated pipelines, and platform resilience.

7. Integration & Interoperability

Semantic standards, governed mappings, semantically aligned contracts, external ontology reuse, and metadata ecosystem links.

8. Quality, Validation & Testing

Quality criteria, automated validation, competency-question testing, instance conformance, and independent review.

9. Security, Privacy & Compliance

Least-privilege access, sensitive concept protection, provenance, regulatory obligations, and inference risk control.

10. Adoption, Skills & Operations

Role-based enablement, active community, discoverability, operational monitoring, and grounded AI/knowledge-graph use.

1. Vendor Strategy & Governance

Documented strategy, policies, decision rights, executive accountability, vendor inventory, and measured outcomes.

2. Vendor Selection & Due Diligence

Documented requirements, consistent evaluation, due diligence validation, dependency risk, and defensible decisions.

3. Contract & Commercial Management

Standardized terms, clear obligations, lifecycle tracking, controlled changes, and value review before renewal.

4. Vendor Onboarding & Integration

Standard onboarding, documented operating expectations, controlled access provisioning, education, and verified readiness.

5. Performance & Service Level Management

Defined service levels, regular reviews, issue tracking, root-cause analysis, and performance-driven action.

6. Vendor Risk & Compliance

Risk tiering, periodic reassessment, compliance obligations, owned remediation, and consolidated risk reporting.

7. Third-Party Cybersecurity & Data Protection

Security requirements by sensitivity, assurance evidence, contractual controls, posture monitoring, and access revocation.

8. Relationship & Strategic Value Management

Relationship ownership, business reviews, segmented governance, innovation, and measured relationship health.

9. Financial Management & Optimization

Spend visibility, invoice validation, optimization analysis, fact-based negotiation, and measured savings.

10. Renewal, Exit & Continuity Management

Advance renewals, evidence-based decisions, exit and continuity planning, dependency analysis, and complete offboarding.

1. CI/CD Strategy & Governance

Documented strategy, defined standards, clear ownership, value-based prioritization, and measured governance adoption.

2. Source Control & Branching

Everything in version control, defined branching, mandatory peer review, governed repository controls, and short-lived branches.

3. Continuous Integration & Build Automation

Automatic build triggers, portable scripted builds, fast failure response, reproducible toolchains, and monitored build health.

4. Automated Testing & Quality Gates

Automated unit and higher-level tests, enforced quality gates, automated test data and environments, and test effectiveness tracking.

5. Security & Compliance Integration

Shift-left security in pipelines, automated scanning, vulnerability detection, blocking policy gates, and audit-ready evidence.

6. Artifact & Dependency Management

Versioned artifact repositories, immutable promotion, managed dependencies, provenance and signing, and end-to-end traceability.

7. Continuous Delivery & Deployment

Automated non-production and production deployments, standardized release controls, progressive delivery, and reliable rollback.

8. Environment & Infrastructure Management

Automated provisioning, infrastructure as code, version-controlled configuration, drift remediation, and rapid environment refresh.

9. Observability, Metrics & Feedback

Deployment-linked monitoring, change attribution, DORA metrics, bottleneck analysis, and production feedback loops.

10. Platform Engineering & Continuous Improvement

Golden paths and reusable templates, platform-as-product management, low-friction onboarding, measured DX, and continuous improvement.

1. Vision & Strategic Alignment

Documented strategy, executive vision, translation of objectives, refresh cadence, and shared understanding.

2. Business Value & Outcomes

Outcome-based selection, value hypotheses, traceability, pre-approval benefits, and realized-value measurement.

3. Data Operating Model & Governance

Decision rights, ownership and stewardship, centralization model, policy alignment, and cross-functional forums.

4. Data Domain & Product Strategy

Priority domains, defined owners and sources, data products, consumer-driven priorities, and cross-boundary governance.

5. Data Architecture & Platform Strategy

Target-state architecture, principle-led platform choices, complexity reduction, and non-functional fit.

6. Data Governance, Quality & Trust Strategy

Risk-based governance focus, critical data elements, metadata and lineage, regulatory integration, and trust metrics.

7. Analytics, AI & Decision Intelligence Strategy

Decision-support strategy, prioritization criteria, advanced use cases, responsible AI foundations, and workflow embedding.

8. Data Literacy, Talent & Culture

Required skills and roles, leadership reinforcement, persona-based literacy, gap closure, and supportive norms.

9. Investment, Funding & Value Management

Portfolio management, reuse-aware funding, cost transparency, sponsorship, and disciplined stop/redirect decisions.

10. Roadmap, Execution & Performance Measurement

Sequenced multi-horizon roadmap, balanced value delivery, target maturity, executive review, and adaptive replanning.