How to Build a Data Governance Plan and Roadmap

A data governance plan is a short document that says where your data governance stands today, which data domains you will govern first, what you will deliver in the next ninety days, how the program grows over a year, and which metrics will show it is working. The method is the same for a 20-person company and a 2,000-person one: run a maturity assessment against a five-level model, score your candidate domains and pick two or three, plan the first ninety days around visible quick wins, extend to a year-one roadmap, and report a small set of metrics every quarter. This guide gives you the model, the scoring sheet, both roadmaps and the metrics set.

Start with a data governance maturity assessment

You cannot plan a route without knowing the starting point. A data governance assessment scores the organization against a maturity model on each governance capability, so the plan targets the next level rather than an ideal end state. The five-level data governance maturity model below is the one we use; it follows the familiar capability-maturity pattern.

Level	Name	What it looks like
1	Ad hoc	No named owners. Definitions live in people’s heads and in individual spreadsheets. Quality problems are discovered by customers or auditors. Access is granted by habit.
2	Aware	Leadership recognizes the problem. Some owners are named informally. A glossary or policy draft exists but is not approved or used. Quality is fixed in reports, not at the source.
3	Defined	An approved policy, named owners and stewards for the critical domains, a published glossary, quality rules for critical data elements, a council that meets on a schedule, and a catalog (tool or workbook) for the main datasets.
4	Managed	Quality is measured automatically against thresholds and reported. Issues have root causes and owners. Classification and access reviews run on a calendar. Lineage exists for key reports. Metrics are reported to leadership each quarter.
5	Optimized	Governance is embedded in system design and change processes. New datasets and AI use cases are onboarded through a standard path. Quality and usage data drive investment decisions. The program is reviewed and improved annually.

Score each of these capabilities separately from 1 to 5, because organizations are rarely at one level across the board:

• Ownership and roles (sponsor, council, owners, stewards, custodians)
• Policy and standards (governance policy, classification, retention, quality standards)
• Definitions and metadata (glossary, catalog, lineage)
• Data quality (rules, measurement, issue management, root-cause fixing)
• Security, privacy and lifecycle (classification applied, access reviews, retention enforced)
• Tooling (fit, adoption, automation)
• Culture and adoption (do people use the glossary, report issues, attend the council)

Gather the evidence through interviews with the people who produce and consume the most important data, a system and dataset inventory, a sample quality check on ten to twenty critical fields, and a review of whatever policies and documentation exist. Write a one-page findings summary with the score per capability and the three problems that cost the most. A 20-person company can do this in a week with one person; a 2,000-person company usually takes three to four weeks with a small team. The target for the first year is the next level up on each capability, not level 5.

Choose critical data domains

The single most common planning mistake is to scope governance across every domain at once. The plan should name two or three domains for the first ninety days and defer the rest explicitly. Score each candidate domain on the five criteria below (1 is low, 3 is high) and pick the highest totals.

Criterion	Question	Scoring guide
Business impact	How much revenue, cost or decision-making depends on this data?	3 if it drives board reporting, pricing or core operations
Current pain	How often do reports disagree, duplicates appear or people chase definitions?	3 if there is a recurring, named complaint
Regulatory and contractual exposure	Does a law, regulator, auditor or customer contract require control of this data?	3 for personal, health, payment or contractually confidential data
Analytics and AI demand	Is a planned dashboard, model or AI use case waiting on this data?	3 if a funded project depends on it
Feasibility	Is there an obvious owner and a system of record?	3 if both exist; 1 if the data lives in spreadsheets with no clear owner

In most organizations, customer, product (or service) and finance score highest, with employee or patient data close behind where regulation applies. A 20-person professional services firm might pick client and project data. A 2,000-person manufacturer might pick customer, material master and supplier. Record the scores in the plan so the deferred domains know why they wait and when they will be revisited.

The 90-day data governance roadmap

The first ninety days have one purpose: a visible result in the chosen domains, plus the operating rhythm that keeps the program running afterward. This is the data governance implementation plan we use, with the scale adjusted per organization.

Weeks	Activities	Deliverables
1 to 2	Confirm sponsor; run the maturity assessment interviews and inventory; score candidate domains	Findings summary, maturity scores, domain selection, named owners for the chosen domains
3 to 4	Draft the policy and the classification standard; agree the operating model and RACI; set the council cadence	Two-to-four-page policy (draft), RACI, council charter and calendar
5 to 6	Definition workshops per domain; identify critical data elements; write glossary entries	Glossary for the chosen domains (twenty to fifty terms), critical data element list
7 to 8	Write quality rules per critical element; measure once; log defects with root causes	Quality rules and thresholds, first scorecard, issue log
9 to 10	Fix the worst defects at the source (validation, process change, cleanup); classify the chosen datasets; catalog them with owners	Remediated defects, classification labels applied, first catalog entries (tool or workbook)
11 to 12	Rebuild one argued-about report on governed definitions; approve the policy; hold the first full council meeting	One trusted report, approved policy, decision log started
13	Baseline the metrics; agree the next two domains; present results to leadership	Metrics baseline, year-one roadmap, leadership briefing

For a 20-person company, compress the same sequence: the assessment is a week, the workshops are two meetings, the policy is two pages, and the council is a thirty-minute monthly review. For a 2,000-person company, run the sequence in parallel per domain with a steward leading each, and expect the tool decision (Purview, Collibra, Alation, Atlan, OpenMetadata or similar) to land in weeks 9 to 13 rather than earlier. Our comparison of data governance tools is written for that decision point. The habits that keep the program alive after week 13 are covered in our data governance best practices guide.

The year-one data governance roadmap

After the first ninety days, the data governance program grows by adding domains and depth, one quarter at a time. The plan should show this on a single page.

Quarter	Focus	Typical milestones
Q1	The 90-day start	Two or three domains governed; policy approved; council running; metrics baselined
Q2	Expand and tool	Two more domains onboarded; retention schedule approved; catalog tool selected and populated with the critical datasets; stewards trained; access reviews started for restricted data
Q3	Automate and connect	Quality checks automated and scheduled; lineage captured for the top reports; issue workflow in the ticketing or catalog tool; master data design for the domain with the worst duplicates, if needed
Q4	Prove and renew	Audit or questionnaire answered from governance records; AI-readiness review of governed domains; annual policy review; year-two roadmap and budget approved

Keep three things constant across the year: the council cadence, the quarterly metrics report, and the rule that no new domain starts until it has a named owner. The data governance framework document is updated at the end of each quarter so it always describes the program as it actually runs.

Metrics that keep the data governance plan funded

Data governance metrics do two jobs: they tell the council what to fix next, and they tell leadership the program is worth its budget. Choose six to eight, baseline them in week 13, and report them on one page each quarter alongside the business outcomes they support.

Metric	Baseline at day 90	Direction over year one
Quality score per critical data element	Measured once for the chosen domains	Rising toward the agreed thresholds; measured monthly
Open defects and median age	First issue log count	Age falling; root causes recorded on every closed issue
Domains with named owner and steward	The two or three chosen domains	Growing by two domains a quarter
Glossary and catalog coverage of critical data	Chosen domains only	All critical data elements defined and cataloged by year end
Catalog usage	Zero or a workbook	Searches and views rising after the tool is adopted
Data-related audit and questionnaire findings	Last audit or questionnaire	Falling; answers drawn from governance records rather than memory
Time to answer a data question	Sampled from recent requests	Falling as definitions and lineage are published
Business outcome linked to governance	Named at planning time	Examples: fewer reconciliation hours at month end, AI pilot cleared to use governed data, duplicate customer rate falling

Report direction and examples, not just numbers. A council that can say “the AI pilot was cleared because customer data is now owned, classified and measured” has made the case for year two better than any percentage.

Where PS3G fits

PS3G provides data governance consulting and implementation for organizations of every size. The maturity assessment, domain selection and 90-day roadmap above are the first phase of every engagement, delivered as a fixed-scope project with a written plan at the end of the assessment. We then run the ninety days with your owners and stewards, help choose and implement the catalog and quality tooling that fits your stack, and either hand over the operating rhythm or run it under a managed-services agreement. Because we build and run our own regulated software products, our plans are shaped by what a governance program costs to operate, not only by what it looks like on a slide.

Related reading

• Data Governance Best Practices: 12 That Actually Stick
• Data Governance Framework: Components, Examples and a Starter Template
• Data Governance Tools Compared: Purview, Collibra, Alation, Atlan
• Data governance consulting and implementation services

Frequently asked questions

What should a data governance plan include?

A data governance plan should include the maturity assessment results, the selected critical data domains and why they were chosen, the named sponsor and owners, the 90-day roadmap with deliverables, the year-one roadmap by quarter, the metrics that will be reported and their baselines, the operating model and council cadence, and the budget and tooling decisions with their timing. It should fit in a few pages plus appendices.

How do you assess data governance maturity?

Score each governance capability (roles, policy, definitions and metadata, quality, security and lifecycle, tooling, adoption) from 1 to 5 against a maturity model, using interviews, a dataset inventory, a sample quality check and a document review as evidence. Report the score per capability rather than a single average, and set the year-one target as the next level up on each, not the top level.

How long does a data governance roadmap cover?

Plan ninety days in detail and a year at the level of quarterly milestones. Beyond a year, list intentions rather than commitments, because domain priorities, systems and regulations change. Revisit the roadmap at each quarterly review and rewrite it at the annual policy review, carrying the metrics forward so progress is visible from one year to the next.

Which data domains should we govern first?

Score candidate domains on business impact, current pain, regulatory and contractual exposure, analytics and AI demand, and feasibility, then pick the two or three with the highest totals. Customer, product and finance usually come first; employee, patient or supplier data follow where regulation or duplicates make them urgent. Defer the rest explicitly, with a date to revisit them.

Can a small company follow the same roadmap?

Yes, compressed. A 20-person company runs the assessment in a week, picks two domains, writes a two-page policy, holds two definition workshops, checks ten quality rules monthly and reviews everything in thirty minutes a month. The year-one roadmap adds one domain a quarter and decides on a tool only if the shared workbook stops working. The sequence and the metrics are the same.