Scope
Name the business decisions and workloads the assessment must serve.
Done when: Every domain in scope has a named owner who will defend the score.
Data Management Maturity Model (DMM)
Data Management Maturity Model
An honest score of how well data is managed, from reactive fixes to a managed data estate.
The business problem
Everyone agrees data matters. Nobody agrees where to start.
Data initiatives start in many places at once, so effort spreads thin and maturity never moves.
What you hear inside the organisation
We are asked for an NDMO maturity score.
We started governance three times.
Is our gap people, process or technology?
We need a plan the board will fund.
Who it serves and what changes
Your teams, before and after the Data Management Maturity Model
Client teams and what they need
Chief data office
A baseline and target level
Data stewards
Clear roles and routines
IT
Priorities for platform spend
Executive sponsor
Progress they can report
The outcome you get
- A maturity score per domain, aligned with NDMO
- Ranked gaps and quick wins
- A sequenced improvement roadmap
- A repeatable way to measure progress
A worked example
A semi-government company preparing for NDMO review
The problem we saw
Governance had started several times. Each effort produced documents, and the maturity score did not move.
How the framework solved it
We scored each domain on evidence, picked the few gaps that unlock the most, and sequenced them into a funded roadmap.
The business result
The company shows measurable progress at each review and the board funds the next step with confidence.
Illustrative example based on common client situations.
In short
What is the Data Management Maturity Model?
Data Management Maturity Model (DMM): An honest score of how well data is managed, from reactive fixes to a managed data estate.
Organisations rarely disagree that data management is weak; they disagree about where.
- How it moves
- Each step closes with a check before the next begins
- Owned by
- Run by data governance with each domain owner; scores signed by the chief data officer or equivalent.
- You keep
- Scored maturity radar, Prioritised gap register, Reusable test set
How it works
How the Data Management Maturity Model works
Maturity is measured per domain, never as one number. A single average hides the domain that is actually blocking the programme.
Evidence
Collect proof from the systems themselves, catalogues, tests, logs, policies in force.
Done when: No score rests on a questionnaire answer alone.
Score
Place each domain on L1–L5 with the gap statement that justifies the level.
Done when: Each level carries a written reason a sceptical reader could challenge.
Prioritise
Rank gaps by the workload they block, not by how far they are from level five.
Done when: Every priority names the workload it unblocks.
Re-score
Repeat the same tests each quarter so movement is comparable, not reframed.
Done when: The new score is produced by the original test set.
Is it right for you?
Is the Data Management Maturity Model right for you?
A strong fit if
- You report to NDMO or plan to
- Data efforts feel scattered
- You need a funded data programme
Probably not yet if
- You have a recent, trusted assessment and an active roadmap
- You need a single technical fix
Free assessment
Discuss the Data Management Maturity Model with our team
A working session with our senior team. We review what fits your situation, what does not, and where to start.
A focused conversation
We listen to your situation and goals.
Fit review
Which parts of this framework apply to you, and which do not.
A written view
Clear next steps, whether or not you work with us.
Go deeper
Applying the Data Management Maturity Model in practice
Open only the part you need: how it starts, what your team keeps, maturity levels, sector rules and the evidence a reviewer will ask for.
Organisations rarely disagree that data management is weak; they disagree about where. DMM scores governance, architecture, quality, metadata, master data, integration, security and literacy against evidence, so the investment argument stops being an opinion.
Version
v1.0
Last reviewed
August 2026
Family
Data & Analytics Operating System
How this was developed: Built from delivery practice on Saudi and international engagements, then reconciled clause by clause against the published standards below. Revised when a standard is updated or a gate proves unworkable in the field.
Scored maturity radar
Eight domains, five levels, one evidence reference per score.
Prioritised gap register
Each gap tied to the workload it blocks, with an owner and a date.
Reusable test set
The same checks re-run each quarter so movement is comparable.
Banking & finance
Metadata and lineage carry the most weight; regulatory reporting fails first when they are weak.
- Who reviews it
- SAMA, plus PDPL and NCA controls
- Systems in scope
- Core banking, cards, KYC and AML systems, credit bureau feeds, the general ledger
- Where it lands first
- KYC and AML review, credit decisioning support, complaint and dispute handling
1
Scope
- Scope note
- Domain owner list
2
Evidence
- Evidence pack per domain
- Sampling log
3
Score
- Maturity radar
- Gap statements
4
Prioritise
- Prioritised gap register
- Investment case
5
Re-score
- Quarterly delta report
- Test set version
Maturity is measured per domain, never as one number. A single average hides the domain that is actually blocking the programme.
Stage
Exit gate
Artefacts
1
Scope
Name the business decisions and workloads the assessment must serve.
Exit gate
Every domain in scope has a named owner who will defend the score.
Artefacts
- Scope note
- Domain owner list
2
Evidence
Collect proof from the systems themselves, catalogues, tests, logs, policies in force.
Exit gate
No score rests on a questionnaire answer alone.
Artefacts
- Evidence pack per domain
- Sampling log
3
Score
Place each domain on L1–L5 with the gap statement that justifies the level.
Exit gate
Each level carries a written reason a sceptical reader could challenge.
Artefacts
- Maturity radar
- Gap statements
4
Prioritise
Rank gaps by the workload they block, not by how far they are from level five.
Exit gate
Every priority names the workload it unblocks.
Artefacts
- Prioritised gap register
- Investment case
5
Re-score
Repeat the same tests each quarter so movement is comparable, not reframed.
Exit gate
The new score is produced by the original test set.
Artefacts
- Quarterly delta report
- Test set version
Standard
What this framework satisfies
DAMA / DCAM
Knowledge areas mapped one to one onto the eight scored domains.
NDMO
National data management domains evidenced per specification.
PDPL
Security and privacy domains scored against lawful basis and retention practice.
NIST AI RMF
Supplies the Map function with the data-capability inputs behind AI risk decisions.
Self-declared scores
Teams rate themselves at level four and the first audit disagrees. Score only what evidence supports.
Chasing level five everywhere
Maturity is not the goal; the unblocked workload is. Lift only the domains that block it.
A one-off baseline
A score with no re-test date becomes a slide. Fix the quarter and the test set on day one.
Data management self-assessment
Tick only what you could evidence today, from a system rather than a statement.
0%Unevidenced0/10
Most statements have no artefact behind them. Start with one domain and produce the evidence before widening scope.
Scoring is deterministic and runs entirely in your browser. Nothing is stored or sent.
Built on
- 1
DAMA-DMBOK and EDM Council DCAM
Data management knowledge areas and capability assessment.
- 2
NDMO data management and personal data protection standards
National Data Management Office specifications and domains.
- 3
Personal Data Protection Law (PDPL) and its implementing regulations
Lawful basis, subject rights, transfer and retention.
- 4
NIST AI Risk Management Framework 1.0 and Generative AI Profile
National Institute of Standards and Technology, Govern, Map, Measure, Manage.
Citations describe the parts of each standard the framework answers. Bilytica is not an accreditation or certification body.
In Saudi Arabia
The data layer, as NDMO reads it
Most AI programmes in Saudi Arabia stall underneath the model. These frameworks work on that layer, against the control set the national office actually assesses.
AuthorityWhat it requiresWhat we buildWhat you keep
NDMO data management controls
Owners, policies and measurable maturity across every data management domain.
Baseline assessment, then control-by-control remediation with dates and owners.
Maturity baseline and a re-assessment on the same control set.
SDAIA, PDPL
Classification and retention applied to personal data wherever it is copied.
Classification enforced in the platform, so a copy inherits the rules of its source.
Lineage view showing classification travelling with the data.
ZATCA, for invoicing and transactional data
Invoice and transaction records reconcile to the filed position.
Reconciliation checks run as data quality rules, with exceptions routed to an owner.
Reconciliation report and an exception log with resolution times.
Where it runs
Registers, lineage and quality evidence live in your environment inside Saudi Arabia and stay yours.
Arabic, as it is spoken here
Business glossaries are maintained in Arabic and English together, with Arabic as the governing definition.
FAQ
Frequently Asked Questions
How is this different from an AI readiness assessment?
Readiness asks whether a specific AI workload can proceed. DMM scores the data capability itself, which is what readiness keeps failing on.
Can we score ourselves?
Yes, and the test set is designed to be handed over. The discipline is that every score points at an artefact.
Does it replace DAMA-DMBOK?
No. It is a scoring and sequencing layer on top of it, with the NDMO domains folded in for Saudi assessments.
Where this connects
Rest of the library
DFFData Foundation FrameworkAIRMAI Readiness ModelVALUEAI Value FrameworkTRUSTAI Assurance FrameworkDELIVERAI Delivery FrameworkAGENTAgent Operations FrameworkSOVEREIGNSovereign AI FrameworkDPAData Platform Architecture FrameworkDQFData Quality & Observability FrameworkDECIDEAnalytics & Decision FrameworkDGOVData Governance Operating ModelSDCFSaudi Data Compliance FrameworkAQSArabic Quality StandardKSA-READYIn-country Deployment Framework
Topic cluster
Explore the topic cluster
Curated links across our Saudi hubs, sector pages and long-form blog research.