EDM Council DCAM - Data Management Capability Assessment Model

Evidence request list. 27 controls, 27 carrying auditor artefact guidance. Generated from the compliance knowledge graph on 11 September 2026. Published by The Art of Service.

DCAM Component 1: Data Management Strategy

DCAM-1.1

Data Management Strategy

A data management strategy is defined, documented and approved by senior leadership, aligned to business strategy and objectives.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-1.2

Data Management Roadmap

A roadmap translating the data management strategy into prioritised initiatives and milestones is established and maintained.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-1.3

Stakeholder Alignment

Stakeholders across business and technology are engaged and aligned to the data management strategy and their roles within it.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM Component 2: Business Case and Funding Model

DCAM-2.1

Business Case

A business case for the data management program is developed, articulating value, costs and benefits.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-2.2

Funding Model and Sustainment

A funding model is established and sustained to resource the data management program over time.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-2.3

Education, Communication and Change Management

Education, communication and change-management activities are conducted to embed data management across the organisation.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM Component 3: Data Management Program

DCAM-3.1

Data Management Program Operating Model

A data management program with a defined operating model, structure, roles and responsibilities is established.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-3.2

Program Routines and Processes

Routines and processes for running the data management program (planning, prioritisation, reporting) are defined and operated.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-3.3

Program Performance Management

The performance of the data management program is measured and managed against defined objectives and metrics.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM Component 4: Data Governance

DCAM-4.1

Data Governance Operating Model

A data governance operating model with governance bodies, decision rights and escalation paths is established and operated.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-4.2

Data Policies and Standards

Data policies and standards are defined, approved, published and enforced across the organisation.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-4.3

Data Ownership and Stewardship

Data ownership and stewardship roles are assigned and active for data domains and critical data.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-4.4

Critical Data Element Identification

Critical data elements are identified, documented and prioritised for governance and quality management.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM Component 5: Data Architecture

DCAM-5.1

Data Architecture and Models

A data architecture (conceptual, logical and physical data models) is defined, maintained and aligned to business needs.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-5.2

Data Lineage and Flows

Data lineage and data flows are documented and maintained across the data supply chain.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-5.3

Reference and Master Data

Reference and master data are defined, governed and managed to ensure consistency across the organisation.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM Component 6: Technology Architecture

DCAM-6.1

Technology Architecture for Data

A technology architecture supporting the data architecture (platforms, integration, storage) is defined and governed.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-6.2

Data Platforms and Tooling

Data platforms and tooling are provisioned, managed and aligned to the data management capabilities they support.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-6.3

Metadata Management

Metadata is captured, managed and made available (business, technical and operational metadata) to support data management.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM Component 7: Data Quality Management

DCAM-7.1

Data Quality Strategy

A data quality strategy and framework defining dimensions, roles and processes is established.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-7.2

Data Quality Measurement and Profiling

Data quality is measured and profiled against defined dimensions and rules, with results monitored and reported.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-7.3

Data Quality Remediation

Data quality issues are triaged, prioritised and remediated through a defined remediation process.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM Component 8: Data Operations and Control Environment

DCAM-8.1

Data Operations

Data operations (ingestion, processing, provisioning, monitoring) are managed through defined operational processes.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-8.2

Data Control Environment and Risk

A data control environment is established with controls and risk management over data processes and outcomes.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-8.3

Information Security and Privacy

Information security and privacy requirements are integrated into data management (protection, access, privacy of data).

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM-8.4

Data Lifecycle Management

Data is managed across its lifecycle (creation, use, retention, archiving and disposal) under defined policy.

Artefacts an auditor will ask for

Documented capability evidence and artefacts for this DCAM capability
Maturity assessment scoring against the DCAM rubric

Where this commonly fails

Capability not established / not evidenced
No maturity assessment of the capability

DCAM: Capability Maturity Assessment

DCAM-MAT

Capability Maturity Assessment

Data management capabilities are assessed against the DCAM maturity scale (e.g. not initiated through enhanced), with scores used to target improvement.

Artefacts an auditor will ask for

DCAM maturity assessment scores by capability
Improvement plan derived from the assessment

Where this commonly fails

No maturity baseline / assessment

Assembled from the framework’s own control set, so this list is regenerated rather than written and stays current as the graph does. See the EDM Council DCAM - Data Management Capability Assessment Model framework page.