EDM Council DCAM (Data Management Capability Assessment Model): EDM Council DCAM – Tutorial (about 60 minutes)

The Data Management Capability Assessment Model (DCAM) is an industry framework that describes what a well-run enterprise data management function looks like and gives you a way to score how close your organisation is to it. It is published by the EDM Council, which now trades as the EDM Association, and it is used by chief data officers, data governance leads, data owners, architects, risk and audit teams and the consultants who support them. After this tutorial you will be able to explain how DCAM is organised, read and apply its six-level scoring scale, plan a simple assessment, and turn the findings into an improvement roadmap that business leaders will understand.

Free tutorial · about 60 minutes · 7 lessons · 4 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current edition is DCAM v3, announced by the EDM Council on 30 June 2025 and described on the owner's DCAM page as the newest version. DCAM v3 has 8 core components, 34 required capabilities and 101 sub-capabilities. Compared with the previous edition it merges the architecture capabilities into one component, adds a new component called Business Data Knowledge, and strengthens guidance for AI, cloud-native data platforms, privacy, security and regulatory alignment. The first version of DCAM appeared in 2014, and DCAM v2, released in digital, online form, followed in 2019. The owner body was formed in May 2005 as the EDM Council; in 2025 it rebranded as the EDM Association and acquired the Object Management Group (OMG). The website and trademark notices still use the EDM Council name, and DCAM is a registered trademark of EDM Council. DCAM is a member framework: the full model is available to member firms, while training, certification of individuals and assessments are offered through the Association and its Authorized Partners. There is no third-party certification of an organisation against DCAM; organisational achievement is recognised through the Association's Data Excellence Program. Verified 2026-10-29 against the EDM Association DCAM page, the DCAM v3 launch announcement, the About page and the Data Excellence Program page. Because DCAM is maintained by its members, check the owner's page for a newer version before relying on the numbers above.

Who it is for: data governance and data management professionals, data owners and stewards, enterprise and data architects, data quality analysts, analytics and AI leads, risk, compliance and internal audit staff, and project or programme managers who have been asked to "run a DCAM assessment" or to improve data management maturity.

Prerequisites: none. A general idea of how an organisation creates and uses data (systems, reports, analytics, regulatory reporting) helps. Every DCAM term is explained when it first appears.

By the end of this tutorial:

You will be able to explain why DCAM exists, who owns it and what problem a capability assessment model solves.
You will be able to name the eight DCAM v3 components and describe what each one covers and how they are grouped.
You will be able to describe how a sub-capability is written up and use the six-level scale from Not Initiated to Enhanced.
You will be able to plan and run a basic DCAM assessment: scope, people, evidence, scoring, calibration and reporting.
You will be able to turn assessment results into a prioritised, business-aligned improvement roadmap.
You will be able to explain the options for independent assessment, individual certification and organisational recognition.
You will be able to position DCAM next to DAMA-DMBOK, CDMC, BCBS 239 and ISO data standards.

Lesson 1 – Origins, purpose and scope

Why a data management model was needed

Most large organisations already have plenty of data. What they often lack is the ability to manage it deliberately: to know which data matters most, who is accountable for it, where it comes from, whether it is good enough for its purpose and how it is protected. Without those abilities, every new report, regulatory submission or analytics project starts by cleaning and reconciling the same data again. Costs rise, trust falls and leaders begin to doubt the numbers they are given.

Financial services felt this pain early. After the global financial crisis, banks and their supervisors realised that many firms could not quickly and reliably aggregate their risk exposures across business lines. Regulators raised expectations for data governance, lineage and data quality, and firms needed a shared language to describe what "good" data management actually means. The EDM Council, a non-profit trade association formed in 2005 by firms interested in enterprise data management, gathered practitioners from its member organisations to write down that shared view. The result, first released in 2014, was DCAM.

What DCAM is

DCAM is a capability model. A capability is something an organisation is able to do repeatedly and reliably, such as "define and approve a data management strategy" or "measure the quality of critical data". DCAM lists the capabilities that a sustainable data management function needs, explains the purpose of each one, suggests the evidence that would show it is in place, and gives scoring guidance so that different assessors reach similar conclusions. Because it is written as a set of capabilities rather than a set of mandatory controls, it can be applied in any industry and with any technology. Today the Association describes DCAM as relevant well beyond banking, and its benchmark studies have covered many industries since 2020.

DCAM is also an assessment model. It is not only a description of good practice; it is designed to be scored. Organisations use it to establish a baseline, to compare business units or data domains with each other, to compare themselves with industry peers, and to measure progress year on year.

What DCAM is not

It is not a law or regulation. Nobody is legally required to use DCAM, although some firms use it to demonstrate to supervisors and auditors that their data management is structured and evidenced.
It is not a technology standard. It does not tell you which database, catalogue or data quality tool to buy. It cares about whether capabilities exist and work, not how they are implemented.
It is not an ISO-style management system standard with "shall" requirements and certification bodies. It is an industry framework owned by a membership association.
It is not a body of knowledge or textbook. It assumes you will use other sources (for example DAMA-DMBOK) to learn techniques in depth.

Scope of DCAM v3

DCAM v3 covers the full span of enterprise data management: why the organisation manages data (strategy and business case), how the work is organised and paid for (programme and funding), how data is designed and described (architecture and business data knowledge), how fitness for purpose is ensured (data quality), who decides and how decisions are enforced (governance), how data management is run day to day with risk in mind (operations, risk and control) and how data is turned into value (analytics). The v3 update added explicit guidance for AI deployment, cloud-native data ecosystems and modern data pipelines, which reflects how much of today's data work happens in cloud platforms and machine learning pipelines.

Lesson 2 – Key concepts and vocabulary

DCAM uses a compact vocabulary. Learning it first makes the rest of the model easy to read. Some of these terms are DCAM-specific; others are general data management terms that DCAM relies on.

EDM Association – the current trading name of the EDM Council, the non-profit, member-driven trade association that develops and maintains DCAM, CDMC and other frameworks.
Component – one of the eight top-level areas of DCAM v3, such as Data Quality Management or Analytics Management. Components are numbered 1.0 to 8.0.
Capability – an ability the organisation needs within a component, for example a documented data management strategy. DCAM v3 has 34 capabilities, numbered within their component (1.1, 1.2 and so on).
Sub-capability – the smallest scorable unit of DCAM. Each capability breaks down into sub-capabilities (101 in total), and each sub-capability has its own description, objectives, questions, example evidence and scoring guidance.
Data Strategy (DS) – the business-level statement of how the organisation intends to use data to meet its goals. It answers "what do we want data to do for us?"
Data Management Strategy (DMS) – the plan for how the data management function will deliver what the data strategy needs: priorities, target state, scope and roadmap. DCAM treats the DMS as a collaborative product of business, technology and operations stakeholders.
Data Management Program (DMP) – the organised, funded and staffed effort that executes the data management strategy, usually led by a Chief Data Officer (CDO) or an Office of Data Management.
Business case – the explanation, in business terms, of the costs, benefits and risks that justify investment in data management. DCAM expects it to be explicit and maintained, not a one-off slide.
Data domain – a logical grouping of data with a common business meaning and owner, such as customer, product, finance or claims. Assessments are often scoped by domain.
Critical data element (CDE) – a general industry term for a data item whose errors would materially affect decisions, reporting or customers. Many DCAM programmes start their governance and quality work with CDEs.
Business Data Knowledge – the DCAM v3 component about understanding what data means in business terms: definitions, glossaries, metadata, lineage and context that let people find and correctly use data.
Data control environment – the combination of processes, controls, monitoring and accountabilities that keeps data management working as intended and manages data risk. In v3 the closest home for this topic is the DM Operations, Risk & Control component.
Evidence artefact – a business document or record (a strategy approved by its stakeholders, a funding decision, a glossary, a data quality dashboard, meeting minutes) that an assessor can inspect to confirm that a capability really exists.
Authorized Partner – a consulting firm approved by the EDM Association to use DCAM in client assessments and engagements.
Benchmark – the Association's recurring industry study, aligned to the DCAM structure, that lets organisations compare their maturity with peers.
Data Excellence Program – the Association's recognition programme for member organisations that continuously improve their data management, with badge levels renewed every year.

Two general words need care. Maturity in DCAM means how established, repeatable and embedded a capability is, not how old or large the organisation is. Data management means the whole set of disciplines that make data trustworthy and usable, not only database administration.

Lesson 3 – Structure of the model

The eight components of DCAM v3

The EDM Association presents DCAM v3 as a set of rings around a core. The inner ring is the foundation, the middle ring is execution, a further ring represents collaboration, and the outer ring is application. The grouping matters: it tells you which capabilities everything else depends on and where value is finally realised.

Figure 1 – The eight DCAM v3 components grouped into foundation, execution, collaboration and application layers.

Here is what each component is about, in plain words.

1.0 Data Strategy, Data Management Strategy and Business Case. Does the organisation know why it manages data? This component looks for a data strategy tied to business objectives, a data management strategy that turns it into priorities and a target state, and a business case that justifies the work.
2.0 Data Management Program and Funding. Is there an organised programme with a mandate, a leader, an operating model, defined roles and sustainable funding? Many organisations have enthusiasm but no stable funding model; this component exposes that.
3.0 Architecture – Business, Data and Technology. In v3 the previously separate architecture capabilities are consolidated. This component asks whether business processes, data models and technology platforms are designed so that data can be identified, integrated, moved and reused in a controlled way, including in cloud environments.
4.0 Business Data Knowledge. New in v3. Do people understand what data means? It covers business definitions, glossaries, metadata, lineage and context, so that data can be found, interpreted and trusted.
5.0 Data Quality Management. Is data fit for its intended purpose? It covers defining quality expectations, measuring and monitoring quality, managing issues and fixing root causes.
6.0 Governance – Data and Data Management Program. Who makes decisions about data and about the programme itself, and how are those decisions enforced? It covers policies, standards, ownership, stewardship, decision bodies and escalation.
7.0 DM Operations, Risk and Control. Does data management run day to day with collaboration across teams, and are data risks identified and controlled? It covers operating processes, the control environment, and alignment with privacy, security and regulatory requirements.
8.0 Analytics Management. Are analytics, including AI and machine learning, governed and managed so that they create value responsibly? It covers how analytics work is organised, how models and their data are managed, and how analytics adoption and literacy are supported.

From component to sub-capability

Each component contains capabilities, and each capability contains sub-capabilities. The sub-capability is where the real work happens: it is the unit you score, the unit you collect evidence for and the unit you improve. The owner's illustration of a sub-capability shows a consistent layout, which you can paraphrase as follows.

Description – what the sub-capability is and why it matters.
Objectives – the outcomes it should achieve.
Advice – guidance written from an audit perspective about what a reviewer will expect to see.
Questions – challenge questions an assessor asks to test whether the sub-capability really exists.
Artefacts – examples of evidence that would demonstrate adherence.
Scoring guidance – a short description of what the sub-capability looks like at each of the six levels.

Figure 2 – How DCAM decomposes into components, capabilities and scorable sub-capabilities, each with its own guidance.

Numbering follows the hierarchy. For example, the owner's sample page shows sub-capability 1.2.2, Data Management Strategy: component 1.0, its second capability, and that capability's second sub-capability. When you report results you can therefore roll scores up from sub-capability to capability to component, and drill down again when someone asks "why is governance scored so low?"

The six levels of the scoring scale

DCAM scores every sub-capability on a six-level scale. The level names are part of the public description of the model; the descriptions below are a paraphrase.

Figure 3 – The six DCAM scoring levels, with the large step between Developmental and Defined.

Not Initiated – nothing formal exists; work is ad hoc and depends on individuals.
Conceptual – the need is recognised and people are discussing or planning how to meet it.
Developmental – work is underway; stakeholders are engaged and the capability is being built, but it is not yet complete or approved.
Defined – the capability is established, documented and verified or approved by the stakeholders directly involved.
Achieved – the capability is adopted and understood across the organisation in scope, and compliance with it is enforced.
Enhanced – the capability is fully integrated into business-as-usual operations and is regularly reviewed and improved.

The owner's material describes the jump from level 3 to level 4 as crossing the capability chasm. Below the chasm, a capability is still a project: it lives in plans, drafts and pilot teams. Above it, the capability has been formally defined and accepted by the people who must use it. Organisations can stall at Developmental because building something is easier than getting it agreed, funded and used. Recognising the chasm helps you explain to sponsors why the last step to Defined often needs more effort than the first three steps.

Three things the scorer looks at

The EDM Association describes a scoring matrix with three dimensions that assessors consider when choosing a level.

Engagement – are the right people, with the right authority, actually participating?
Process – how established, structured and repeatable are the processes behind the capability?
Evidence – are there business artefacts that can be audited to confirm the capability statement?

A useful habit is to ask all three questions for every sub-capability. A beautifully written policy (evidence) that nobody owns (engagement) and that is applied differently by every team (process) should not score as if all three were in place.

Lesson 4 – How it works in practice

Roles

DCAM does not dictate an organisation chart, but successful programmes tend to involve the same set of roles.

An executive sponsor, often the Chief Data Officer, who owns the data management strategy and secures funding and attention.
A DCAM lead or assessment manager who plans the assessment, trains participants and keeps the scoring consistent.
Component or capability owners who are accountable for improving a part of the model, for example the head of data quality for component 5.0.
Data owners and data stewards in the business who make and apply decisions about specific data domains.
Architects, engineers and platform teams who provide evidence about architecture, metadata, lineage and controls.
Risk, compliance and internal audit, who use the results and sometimes challenge the scores.
Optionally, an Authorized Partner who facilitates, independently assesses or benchmarks the organisation.

The assessment and improvement cycle

Organisations use DCAM in a repeating cycle rather than as a single audit. The cycle below is a common way to structure it; DCAM itself provides the content and scoring, while the organisation chooses the exact steps.

Figure 4 – A typical DCAM cycle: scope, train, evidence, score, calibrate, plan, improve and reassess.

Set purpose, sponsor and scope. Decide why you are assessing (baseline, regulatory confidence, AI readiness, investment case) and what is in scope: the whole enterprise, selected business units, or selected data domains. Agree who sponsors the work and who will see the results.
Train participants. People who score must understand the model and the level definitions. Without training, a "4" in one team means something different from a "4" in another.
Collect evidence. For each sub-capability, gather the artefacts that show what exists: approved documents, minutes, dashboards, catalogues, issue logs, funding records. Evidence collection often reveals that things people believe exist were never formally approved.
Score in workshops. Bring together the stakeholders for each component, walk through the challenge questions, look at the evidence and agree a level for each sub-capability, considering engagement, process and evidence.
Calibrate and validate. Compare scores across workshops and domains, challenge outliers and check that the same evidence produces the same level. An independent reviewer or Authorized Partner can add objectivity here.
Analyse gaps. Agree a target level for each capability that reflects business need. Not everything must be Enhanced. Compare current and target scores and identify the gaps that create the most risk or block the most value.
Agree a roadmap. Group the gaps into initiatives, respect dependencies (foundation before execution), assign owners and funding, and link each initiative to a business outcome.
Deliver improvements. Execute the initiatives through the data management programme, producing the artefacts and behaviours that later count as evidence.
Reassess and benchmark. Repeat the assessment, typically every year, to measure progress and compare with peers using the Association's benchmark.

Setting targets sensibly

A common question is "what score should we aim for?" DCAM does not set a mandatory target. A sensible approach is to define the level each capability needs to support the organisation's strategy and risk appetite. A bank subject to strict risk data aggregation expectations may need its governance, lineage and control capabilities at Achieved or higher for its risk data, while a smaller company may decide that Defined is enough for most capabilities in the first two years. Targets should be agreed with the sponsor before scoring starts, so that the assessment is not seen as a way to justify a predetermined budget.

Typical artefacts that a DCAM programme produces

An approved data strategy and data management strategy with a target state and roadmap.
A data management programme charter, operating model, role descriptions and funding model.
Policies and standards for data ownership, quality, metadata, architecture and retention.
Business glossaries, data catalogues and lineage for priority data.
Data quality rules, measurements, thresholds, dashboards and an issue management process.
Governance forums with terms of reference, decision logs and escalation paths.
Control inventories and data risk assessments aligned with privacy, security and regulatory obligations.
An analytics and AI management approach covering model inventory, data sourcing and responsible use.

Using DCAM for AI readiness

The v3 update reflects a practical observation: AI projects expose weak data foundations very quickly. A model trained on poorly defined, low-quality or ungoverned data produces unreliable results, and the problem surfaces only after money has been spent. The Association's 2026 benchmark announcement made the same point, warning that many organisations start AI work before their data foundations are ready. Teams therefore use DCAM to ask, before scaling AI: do we know what our data means (Business Data Knowledge), is it fit for purpose (Data Quality Management), who decides how it may be used (Governance), are the risks controlled (Operations, Risk and Control), and are analytics themselves managed (Analytics Management)?

Lesson 5 – Assessment, certification and compliance

Ways to assess

The EDM Association describes three main ways to assess data management maturity with DCAM.

Self-assessment. The organisation's own trained staff run the assessment. It is the cheapest option and builds internal understanding, but it risks optimism bias and inconsistent scoring unless it is carefully calibrated.
Partner-led assessment. A DCAM Authorized Partner facilitates or performs the assessment. Organisations choose this for objectivity, experience across many clients and credibility with boards and supervisors. One bank's published case study, for example, credits its independent external assessor with introducing objective challenge.
Benchmarking. The Association runs a recurring global benchmark aligned with the DCAM structure. Its 2026 edition was the fifth and drew on more than 435 organisations in over 50 countries. Benchmark results help you see whether a score is unusual or typical for your industry.

Certification of people

Individuals can take DCAM training, offered as live virtual classes and on-demand e-learning, and earn a professional DCAM certification from the Association. At the time of writing the Association schedules two-day live DCAM courses several times a year in different regions. Individual certification shows that a person understands the model; it says nothing about the maturity of their employer.

Recognition of organisations

There is no formal certificate that an organisation "complies with DCAM", and there is no accredited audit scheme of the kind used for ISO management system standards. Instead the Association runs the Data Excellence Program, which it explicitly describes as a recognition programme rather than a certification. In outline:

Participation is open to member organisations, and assessments are based on DCAM.
To enter, an organisation needs DCAM-trained and certified staff, or a DCAM assessment carried out (or committed to) by an Authorized or Certified Partner.
A partner completes an independent DCAM assessment and a capability improvement plan, and represents that the programme's requirements are met.
Recognition is shown as badges: the base Data Excellence Program badge, then Gold, Platinum and Diamond. Badges are renewed annually.

Published case studies show how this is used: one bank describes reaching the Gold level as a founding participant, and a pharmaceutical company describes achieving the Diamond badge after several years of DCAM assessments.

DCAM and regulatory compliance

DCAM itself is voluntary. However, many of the topics it scores, such as data ownership, lineage, data quality controls and governance evidence, are the same topics supervisors and auditors ask about under regulations and supervisory principles like BCBS 239 for banks, or privacy laws that require organisations to know where personal data is and how it is used. A well-evidenced DCAM assessment can therefore support compliance conversations, but it does not replace a regulator's own review, and a high DCAM score is not legal proof of compliance with any specific rule.

Making scores credible

The value of an assessment depends on whether people believe it. Credibility comes from consistent definitions (trained assessors), traceable evidence for every score, calibration across teams, independent challenge where stakes are high, and stable scope from one year to the next so that progress is genuine and not an artefact of measuring something different.

Lesson 6 – Worked example

Harbour Mutual is a fictional mid-sized insurer with about 4,000 employees, motor and home insurance lines, and a growing pricing analytics team that wants to use machine learning. Its regulator has asked questions about the quality of data used in solvency reporting, and the board wants to know whether the company is ready to scale AI. The company is already an EDM Association member, which gives it access to the DCAM framework, so the new Chief Data Officer, Amara, decides to use DCAM to create an objective baseline. All scores below are illustrative.

Step 1 – Purpose, scope and sponsor

Amara agrees two goals with the chief executive: reduce the risk of errors in regulatory reporting, and establish whether data foundations can support AI in pricing. The scope is the whole enterprise for components 1.0, 2.0 and 6.0, plus two data domains, policy and claims, for the remaining components. The chief financial officer becomes co-sponsor because finance owns regulatory reporting.

Step 2 – Training and preparation

Twelve people attend DCAM training: the data management team, two architects, the head of actuarial data, a claims operations manager and a member of internal audit. Amara asks the internal auditor to act as a neutral calibrator rather than a scorer.

Step 3 – Evidence collection

Over four weeks the team gathers evidence for each sub-capability. They find a data strategy slide deck that the executive committee saw but never formally approved, a draft data governance policy, a business glossary maintained by one claims analyst in a spreadsheet, data quality checks that exist only inside the reporting tool, and no documented lineage for solvency figures. The pricing team has a model inventory but no agreed rules on which data sources models may use.

Step 4 – Scoring workshops

For each component, the owners and stakeholders meet, read the challenge questions, review the evidence and agree levels. Some summarised results:

Component	Illustrative score	Main reason
1.0 Data Strategy, DMS and Business Case	Conceptual	Strategy discussed but not approved; no business case
2.0 DM Program and Funding	Developmental	Team exists; funding is year-to-year project money
3.0 Architecture	Developmental	Target data architecture drafted for cloud migration
4.0 Business Data Knowledge	Conceptual	Glossary informal; no lineage for regulatory data
5.0 Data Quality Management	Developmental	Checks exist but are hidden in tools and unowned
6.0 Governance	Developmental	Draft policy; council meets but decisions are not logged
7.0 DM Operations, Risk and Control	Conceptual	No inventory of data controls or data risks
8.0 Analytics Management	Developmental	Model inventory exists; data sourcing rules missing

Step 5 – Calibration

The internal auditor notices that the claims domain scored data quality as Defined, while the policy domain scored a similar situation as Developmental. In the calibration session the claims team admits that their quality rules have never been approved by the data owner. Using the engagement and evidence dimensions, the score is lowered to Developmental. This one correction makes the rest of the results more trusted.

Step 6 – Gap analysis and targets

With the sponsors, Amara sets two-year targets: Defined for components 1.0, 2.0 and 6.0 across the enterprise; Defined for Business Data Knowledge and Data Quality Management in the policy and claims domains; Achieved for data quality and lineage on the specific data items used in solvency reporting; and Defined for Analytics Management before any pricing model goes live. She explains the capability chasm to the board: most components are just below it, so the next step is about approval, adoption and funding rather than more drafting.

Step 7 – Roadmap

Quarter 1: get the data strategy and data management strategy approved by the executive committee, with a business case linking data work to reporting risk and pricing value. Move the programme to a recurring budget line.
Quarter 2: approve the governance policy, appoint data owners for policy and claims data, start logging governance decisions, and identify the critical data elements in solvency reporting.
Quarters 3–4: move the glossary into a catalogue, document lineage for the critical data elements, extract data quality rules from the reporting tool into an owned, monitored rule set, and create an inventory of data controls.
Year 2: agree data sourcing and approval rules for pricing models, extend governance and quality to further domains, and run a partner-led reassessment.

Step 8 – Reassessment

Twelve months later Harbour Mutual reassesses with the same scope. Strategy, programme funding and governance have crossed the chasm to Defined; lineage and quality for solvency data have reached Defined, with Achieved targeted for the following year. Because scope and method stayed the same, the board trusts that the improvement is real. Amara then engages an Authorized Partner for an independent assessment, which would also let the company enter the Association's Data Excellence Program.

What the example teaches

Scope and purpose come first, and they shape everything else.
Evidence often tells a different story from people's beliefs.
Calibration is where consistency and credibility are won.
Targets follow business need and risk, not a wish for top scores everywhere.
Foundation components (strategy, programme, funding) unlock progress in execution components.

Lesson 7 – Relationship to other standards and frameworks

DCAM is one of several frameworks that data professionals meet. They are complementary more often than they are competitors. The table compares DCAM with five frequently used neighbours.

Framework	Owner	Nature	How it relates to DCAM
DCAM v3	EDM Association (EDM Council)	Capability assessment model, 8 components, six-level scoring	Measures how mature enterprise data management is and guides improvement
DAMA-DMBOK	DAMA International	Body of knowledge describing data management knowledge areas, with data governance at the centre	Teaches techniques in depth; DCAM assesses whether capabilities are in place. Many teams learn from DMBOK and score with DCAM
CDMC (Cloud Data Management Capabilities)	EDM Association (EDM Council)	Framework of capabilities and 14 key controls for sensitive data in cloud, multi-cloud and hybrid environments	Assumes DCAM-level foundations and focuses on cloud controls; unlike DCAM it offers a formal certification assessment by an Authorized Partner
BCBS 239	Basel Committee on Banking Supervision	14 supervisory principles (2013) for risk data aggregation and risk reporting in banks	A regulatory expectation; banks often use DCAM evidence on governance, lineage and quality to show progress against it
ISO 8000 series	ISO	International standards on data quality and master data	Gives detailed data quality concepts and processes that can support DCAM component 5.0
ISO/IEC 38505-1	ISO/IEC	Applies IT governance principles to the governance of data by governing bodies	Speaks to boards about oversight of data; DCAM operationalises governance in the data programme

DCAM and DAMA-DMBOK

The most common question is how DCAM differs from DAMA-DMBOK. DMBOK is a reference book: it explains what data modelling, metadata management, data quality or data security involve and which techniques exist. DCAM is an assessment model: it asks whether your organisation has the strategy, programme, governance and operational capabilities to do those things reliably, and scores the answer. Organisations can use DMBOK to design solutions to the gaps a DCAM assessment reveals.

DCAM and CDMC

Both come from the same owner. DCAM covers data management in general; CDMC zooms in on controlling sensitive data in the cloud, with 14 key controls first published in 2021. CDMC assumes that strong data management foundations already exist; the Association advises adding a DCAM assessment when an organisation is unsure about those foundations, but it does not make DCAM a formal prerequisite. An organisation migrating regulated data to a cloud platform might use DCAM to assess its overall programme and CDMC to test whether its cloud environment enforces controls such as classification, entitlements and lineage.

DCAM and management system standards

ISO management system standards such as ISO/IEC 27001 for information security or ISO/IEC 42001 for AI management systems specify requirements that an organisation can be certified against by an accredited body. DCAM works differently: it is a maturity scale owned by an industry association. The two approaches fit together. Data ownership, classification and lineage scored in DCAM support security and AI governance controls, and an AI management system benefits from the data quality and analytics management capabilities DCAM measures.

Choosing what to use

A practical rule of thumb: use regulations and supervisory principles to understand what you must achieve, use DCAM to measure where you are and plan the route, use bodies of knowledge and ISO technical standards to learn how to build specific capabilities, and use certification schemes where external assurance is required.

Common pitfalls and best practices

Pitfalls

Treating the score as the goal. Teams that chase higher numbers start producing documents for the assessor instead of changing how data is managed. Scores then rise while trust in data does not.
Scoring without evidence. Workshops that rely on opinion produce optimistic, inconsistent results. Every level should be backed by artefacts an independent reviewer could inspect.
Skipping the foundation. Jumping straight to tools, catalogues or quality dashboards without an approved strategy, mandate and funding leaves execution capabilities stuck below the chasm.
Changing scope between assessments. Comparing a two-domain baseline with an enterprise-wide reassessment makes progress impossible to interpret.
Aiming for Enhanced everywhere. Uniform top targets waste money; target levels should reflect business need and risk.
Running DCAM as an IT project. Without business data owners and executive sponsors, engagement stays low and capabilities never become business as usual.

Best practices

Start with purpose. Tie the assessment to concrete outcomes such as reporting accuracy, regulatory confidence or AI readiness, and agree targets before scoring.
Train before you score. Make sure everyone who scores understands the six levels and the engagement, process and evidence dimensions.
Calibrate across teams. Use a neutral calibrator, compare similar situations and adjust outliers; consider an Authorized Partner when results will be used externally.
Prioritise by value and dependency. Fix foundation gaps first and focus on the data that matters most, such as critical data elements.
Reassess regularly with stable scope. Annual reassessment with the same scope and method makes progress visible and credible.
Communicate in business language. Present results as risks reduced and value enabled, not just as numbers on a scale.

Summary and key takeaways

DCAM is the EDM Association's capability assessment model for enterprise data management; the current edition is DCAM v3, announced in June 2025.
DCAM v3 has 8 components, 34 capabilities and 101 sub-capabilities, grouped into foundation, execution, collaboration and application layers.
Every sub-capability comes with a description, objectives, audit-oriented advice, challenge questions, example evidence and scoring guidance.
Scores use six levels: Not Initiated, Conceptual, Developmental, Defined, Achieved and Enhanced; the step from Developmental to Defined is the capability chasm.
Good scoring considers engagement, process and evidence together, and is calibrated across teams.
Assessments can be self-run, partner-led or benchmarked; individuals can be certified, while organisations are recognised through the Data Excellence Program rather than certified.
DCAM complements DAMA-DMBOK, CDMC, BCBS 239 and ISO data standards rather than replacing them.
The real value lies in the improvement roadmap and the repeated cycle, not in a single score.

Reflection questions

Think of your own organisation. Which DCAM component would most likely score lowest today, and what evidence would you look for to confirm it?
Pick one important data domain you work with. What would it take to move its data quality capability from Developmental to Defined, and who would have to approve it?
How would you explain the difference between a high DCAM score and actual compliance with a regulation to a sceptical board member?
If your sponsor wants every capability at Enhanced within one year, how would you argue for more realistic, risk-based targets?
Before your organisation scales an AI use case, which three DCAM components would you check first, and why?