Last reviewed: October 2026
Framework details summarized for orientation, not legal advice. Check the publisher's current version before relying on it.
A reference view of the major data governance frameworks, the architectures most often paired with each, and their stated scope.
Information on this page is compiled from publicly available sources (DAMA International, EDM Council, ISO/IEC, NIST, ISACA, BCBS, GO FAIR, and vendor whitepapers). It is provided for informational and evaluation purposes only and should not be interpreted as legal, regulatory, or vendor-endorsed guidance.
EU AI Act, Regulation (EU) 2024/1689, in force 1 Aug 2024. Article 10 sets data and data-governance duties for high-risk AI. Check the official text for current application dates.
Certifiable AI management-system standard; pairs with ISO/IEC 27001 and NIST AI RMF.
NIST AI RMF 1.0 (NIST AI 100-1, Jan 2023) with the Generative AI Profile (NIST AI 600-1, Jul 2024): Govern, Map, Measure, Manage.
DORA, Regulation (EU) 2022/2554, applies from 17 Jan 2025: ICT risk management, incident reporting, resilience testing, register of ICT third-party providers.
EU Data Act, Regulation (EU) 2023/2854, applies from 12 Sep 2025: user access to connected-product data and cloud-switching rights.
The Data Management Body of Knowledge defines 11 knowledge areas (governance, architecture, modeling, storage, security, integration, documents, reference & master, DW/BI, metadata, quality). It is the lingua franca for governance programs.
DCAM is the EDM Council's capability assessment model for enterprise data management. Check the publisher for the current version and its components.
CDMC defines what good cloud data management looks like : ownership, classification, sovereignty, ethical use, and cross-border controls. It is becoming the de facto standard for cloud sensitive-data programs.
Provides directors with principles for the effective, efficient, and acceptable use of data. Pairs naturally with DAMA or DCAM as the operational layer.
Defines the characteristics of high-quality data and the syntax for master-data interchange. The MDM and DQ vendor community uses it as the conformance baseline.
A voluntary framework to help organizations identify, assess, and manage privacy risk. Strongest where governance and privacy must share a single control catalog.
APO14 : Managed Data : gives IT and audit a familiar control structure for data governance, useful when the program reports through CIO/CISO rather than CDO.
Sets 14 principles (governance, data architecture, accuracy, completeness, timeliness, adaptability) for risk data. The single biggest driver of automated lineage adoption in banking.
Originated to make scientific data machine-actionable. Increasingly adopted by enterprises that share data externally (regulators, consortia, partners).
| Framework | Origin | Primary focus | Maturity model | Industry fit | Certifiable? | Strengths | Trade-offs |
|---|---|---|---|---|---|---|---|
| EU AI Act | Regulation (EU) 2024/1689 | AI governance path; high-risk AI data governance | In force 1 Aug 2024; obligations phase in over time | Cross-industry AI governance | Regulatory obligations | Article 10 data and data-governance duties | Application dates vary by obligation; check EUR-Lex for the current text |
| ISO 42001 | ISO/IEC (2023) | AI management systems | Management-system conformance | Cross-industry AI governance | Certifiable AI management-system standard | Pairs with ISO/IEC 27001 and NIST AI RMF | Management-system scope |
| NIST AI RMF | NIST AI 100-1 (Jan 2023); NIST AI 600-1 (Jul 2024) | AI risk management | Govern, Map, Measure, Manage | Cross-industry AI governance | Risk-management framework | Generative AI Profile accompanies RMF 1.0 | Framework, not management-system certification |
| DORA | Regulation (EU) 2022/2554 | ICT risk management and operational resilience | Applies from 17 Jan 2025 | Financial services | Regulatory obligations | Incident reporting, resilience testing, third-party register | Financial-services regulatory scope |
| EU Data Act | Regulation (EU) 2023/2854 | Connected-product data access and cloud-switching rights | Applies from 12 Sep 2025 | Connected products and cloud services | Regulatory obligations | User data access and cloud-switching rights | Scope depends on data and service context |
| DAMA | DAMA International. Check the publisher for the latest edition. | Body of knowledge across 11 data management knowledge areas | No DAMA maturity model; commonly paired with DCAM or CMMI | Cross-industry, vendor-neutral | CDMP individual certification | Comprehensive vocabulary; widely adopted; vendor-neutral | Descriptive, not prescriptive; needs an operating model layer |
| DCAM | EDM Council. Check the publisher for the latest version. | Capability + maturity model for enterprise data management | Component and capability model | Banking, capital markets, insurance | DCAM authorized partner / assessor | Audit-grade evidence; board-ready scoring | Heaviest in financial services; assessment cost |
| CDMC | EDM Council (2021) | Cloud Data Management Capabilities : sensitive data in cloud | 6 components · 14 capabilities · 37 sub-capabilities · 14 key controls | Cross-industry; cloud-first programs | CDMC certified solution / assessor | Cloud-native; aligned to AWS/Azure/GCP/Snowflake/Databricks | Newer; thinner non-cloud coverage |
| ISO 38505 | ISO/IEC (2017+) | Board-level data governance principles (extends ISO 38500) | Principles, not levels | Cross-industry; board / corporate governance | Organizational alignment, no individual cert | Aligns data governance to corporate governance | High-level; needs a working framework underneath |
| ISO 8000 | ISO (multi-part, ongoing) | Data quality and master data exchange | Part-by-part conformance | Manufacturing, supply chain, MDM-heavy estates | Product conformance (e.g. ISO 8000-110) | Concrete DQ and master-data interchange rules | Narrower than enterprise governance frameworks |
| NIST | U.S. National Institute of Standards & Technology | NIST Privacy Framework 1.0 (2020); the v1.1 draft (Apr 2025) aligns it to CSF 2.0 and adds AI privacy-risk guidance | Implementation Tiers 1–4 | U.S. federal, public sector, privacy-critical | Self-attestation against profiles | Risk-based; integrates with NIST CSF 2.0 and 800-53 | Privacy lens; less coverage of stewardship workflow |
| COBIT | ISACA | IT governance with a managed-data process (APO14) | Process Capability Levels 0–5 | IT-led governance; audit shops | COBIT Foundation / Implementation | Maps directly to audit and IT control evidence | IT-centric framing; less business stewardship language |
| BCBS 239 | Basel Committee on Banking Supervision (2013); ECB Guide on risk data aggregation and risk reporting (May 2024) sets current EU supervisory expectations | Risk-data aggregation and reporting principles for G-SIBs | 14 principles, regulator-graded | Globally systemic banks (and increasingly D-SIBs) | Supervisory assessment, not certification | Forces end-to-end lineage and accuracy controls | Tightly scoped to risk reporting; banks only |
| FAIR | GO FAIR / Force11 (2016) | Findable, Accessible, Interoperable, Reusable data | Self-assessment maturity indicators | Research, life sciences, scientific data sharing | Maturity indicators, no formal cert | Strong metadata and reuse incentives | Less coverage of stewardship workflow and DQ |
Traditional enterprise governance (DAMA, DCAM, COBIT) is built for compliance and risk. Marketing frameworks are built to solve attribution friction, media waste, and identity signal loss. Today the center of gravity is shifting toward agentic governance: AI models do not just find errors, they fix them in-flight so that data is born clean.
| Dimension | General enterprise (Finance / IT) | Marketing & agency governance |
|---|---|---|
| Primary goal | Regulatory compliance and risk reduction | ROI recovery and attribution accuracy |
| Data velocity | Low to medium (batch) | High (real-time and streaming) |
| Key metric | Data accuracy score | Time-to-Trust (TTT) and audience freshness |
| Success factor | No audit findings | Reduction in media waste and lift in verified incremental ROI |
| Operating mode | Periodic stewardship and certification | Agentic governance: AI agents fix issues in-flight, data is born clean |
For a marketing agency, a framework is only useful if it accelerates a campaign launch. If governance feels like a brake, media teams will bypass it. The most successful agency models today are Agentic: governance is embedded in the tools so the data is born clean, not cleaned after the fact.
Hospitality and gaming operators sit on top of guest data spread across PMS, CRS, loyalty, POS, cage, and cashless systems, and are simultaneously accountable to payment-card, financial-crime, gaming-commission, privacy, and anti-trafficking regulators. The three groupings below cover the regulatory surface a modern operator must govern to today, cited to named publishers and current effective versions.
Content is informational only and should not be relied on as legal advice. Verify each instrument against its current effective version before use. Primary publishers cited: PCI Security Standards Council, FinCEN, US Treasury OFAC, European Data Protection Board, UK ICO, state attorneys general (CA, VA, CO, CT, UT, TX, OR), Office of the Privacy Commissioner of Canada, ANPD (Brazil), Nevada Gaming Control Board, New Jersey Division of Gaming Enforcement, National Indian Gaming Commission, American Gaming Association, American Hotel & Lodging Association (including HTNG), and OpenTravel Alliance.
Last checked Oct 2026
For hospitality and gaming, the governance target is the same guest identity moving across PMS, CRS, loyalty, POS, cage, and cashless surfaces. Any framework that does not carry lineage into the payment and gaming systems of record leaves a compliance gap the auditor will find.
Adjacent models that data governance programs frequently inherit from, report into, or are audited against. Most data programs end up touching several of these.
NIST Cybersecurity Framework 2.0 (Feb 2024) adds a Govern function.
NIS2 Directive (EU) 2022/2555, transposition deadline 17 Oct 2024: cybersecurity risk management and incident reporting for essential and important entities.
ISO/IEC 27001 specifies requirements for information security management systems. Check iso.org for the current edition.
COSO's Internal Control: Integrated Framework defines five components (control environment, risk assessment, control activities, information & communication, monitoring) used by virtually every U.S. public-company auditor. The companion ERM framework extends it to enterprise risk strategy.
COBIT organizes governance and management objectives for enterprise IT, with capability-level scoring. Its Managed Data objective (APO14) is the data-governance hook used by audit-led data programs.
ITIL is PeopleCert's reference for IT service management. Supports service desk, change, incident, and problem management.
CMMI provides appraised maturity ratings (1 Initial → 5 Optimizing) across practice areas.
The PMBOK Guide sets out project management principles, performance domains, and tailoring guidance.
PRINCE2 organizes projects around principles, practices, and processes with explicit business-case and stage-boundary controls. Strongest where governance, audit trail, and role clarity are non-negotiable.
TOGAF's Architecture Development Method (ADM) provides a repeatable cycle (Preliminary → Phases A–H) for building and governing enterprise architecture. Pairs naturally with the ArchiMate modeling language.
| Model | Origin | Primary focus | Scope |
|---|---|---|---|
| NIST CSF 2.0 | NIST (Feb 2024) | Cybersecurity governance and risk management | IT governance and security |
| NIS2 | Directive (EU) 2022/2555 | Cybersecurity risk management and incident reporting | Essential and important entities |
| ISO 27001 | ISO/IEC (2022) | Information security management systems | IT governance and security |
| COSO | Committee of Sponsoring Organizations of the Treadway Commission (1992, updated 2013/2017) | Internal control and enterprise risk management (ERM) | SOX compliance, financial reporting controls, board-level risk oversight |
| COBIT | ISACA. Check the publisher for the latest version. | Enterprise governance and management of information & technology (EGIT) | Aligning IT to business goals, audit-ready IT control evidence, CIO/CISO operating model |
| ITIL | PeopleCert. Check the publisher for the latest version. | IT service management (ITSM) and value-stream practices | Service desk, change/incident/problem management, service-value chain operations |
| CMMI | CMMI Institute (ISACA). Check the publisher for the latest version. | Process maturity and capability improvement | Benchmarking process maturity (levels 1–5) for development, services, supplier mgmt, and data |
| PMBOK | PMBOK Guide (PMI), current edition. Check the publisher for the latest version. | Project management principles, performance domains, and tailoring | Predictive, hybrid, and adaptive project delivery; PMP-certified practitioners |
| PRINCE2 | PeopleCert. Check the publisher for the latest version. | Structured, stage-gated project management method | UK public sector, EU programs, and regulated environments needing formal governance |
| TOGAF | The Open Group (TOGAF 10, 2022) | Enterprise architecture framework and method (ADM) | Establishing an EA capability; aligning business, data, application, and technology architectures |
Each architecture below is a delivery pattern, not a framework : but every program ultimately runs on one or more of them. The framework tags show where each pattern is most defensible.
Centralized, schema-on-write analytical store. Strong governance via conformed dimensions and slowly changing dimensions.
Schema-on-read object storage for raw, semi-structured, and unstructured data. Requires layered governance to avoid swamps.
Open table formats over object storage with ACID, time travel, and unified BI/ML. The default cloud target.
Domain-oriented, decentralized ownership with data products, federated governance, and self-serve platform.
Active-metadata-driven architecture that automates discovery, integration, and policy enforcement across estates.
Central master record hub with synchronized spokes for customer, product, supplier, and reference data.
Append-only event backbone enabling real-time integration, audit-grade lineage, and timely risk reporting.
Logical access layer that queries data in place across systems : minimizes movement, eases sovereignty.
| Architecture | Best-fit frameworks | Best-fit IT governance |
|---|---|---|
| Data Warehouse (Inmon / Kimball) | DAMA-DMBOK2 · ISO 8000 · COBIT 2019 | COBIT · COSO · CMMI |
| Data Lake | DAMA-DMBOK2 · CDMC | COBIT · CMMI |
| Data Lakehouse (Delta / Iceberg / Hudi) | CDMC · DCAM · DAMA-DMBOK2 | COBIT · TOGAF · CMMI |
| Data Mesh | DAMA-DMBOK2 · DCAM · ISO/IEC 38505 | TOGAF · COBIT · ITIL |
| Data Fabric | DCAM · CDMC · DAMA-DMBOK2 | TOGAF · COBIT |
| Hub-and-spoke MDM | ISO 8000 · DAMA-DMBOK2 | COBIT · CMMI · PRINCE2 |
| Event-driven / Streaming (Kafka, CDC) | BCBS 239 · DAMA-DMBOK2 | COBIT · ITIL · TOGAF |
| Federated / Virtualized Query | FAIR · CDMC · ISO/IEC 38505 | TOGAF · COBIT |
The framework summaries, comparison table, and architecture mappings on this page were assembled from publicly available sources and are intended for informational and evaluation purposes only. They are not legal, regulatory, certification, or vendor-endorsed guidance. Always validate framework selection against your own counsel and regulators.
