governance.meridian.edu — Public Data Governance Portal
Roles & Responsibilities Matrix — full reference
Esc
No matches — try another term.
Data Governance
A framework for higher education

Turning institutional data into a strategic asset.

Data governance is the framework of roles, standards, and processes that ensures institutional data is accurate, secure, accessible, and relevant — enabling informed, strategic and operational decision-making across the university.

5
defined components that operationalize governance
6
governance roles, from strategy to execution
7
guiding principles for every governance decision
Start here

Where would you like to begin?

This site explains the framework and shows how to apply it. Jump to what's most relevant to you.

How to use this resource

General to higher education — not specific to your campus

Everything here describes data governance at the level of higher education as a sector: the shared concepts, roles, and practices common across institutions. It is meant to build a common understanding and vocabulary — a starting point, not a rulebook.

Your institution has its own policies, systems, authorities, and local context that determine how data is actually handled. Always consult your campus data governance experts — your data governance office, privacy office, and counsel — before acting on anything you read here. Where this guidance and your local rules differ, your local rules govern.

For leadership · Executive summary

The case for data governance

Every consequential decision this institution makes — who we admit, where we spend, how we retain students, what we tell accreditors — rests on data. Governance is what makes that data trustworthy. Without it, leaders are deciding on numbers no one can fully stand behind.

This is a short brief for sponsors and funders. Hand it to a president, provost, CFO, or CIO who needs the why in two minutes.

The cost of doing nothing

Ungoverned data isn't free — the cost is just hidden, paid in staff time, risk, and bad decisions.

Conflicting numbers

Three offices report three enrollment figures to the board. Leaders lose confidence, and time is wasted reconciling instead of deciding.

Compliance exposure

FERPA, GLBA, and state breach laws carry real penalties and reputational damage. Unowned data is unmanaged risk.

Wasted effort

Analysts spend more time finding and cleaning data than using it. The same report gets rebuilt five different ways.

Stalled AI & analytics

Predictive models and dashboards are only as good as their data. Without governance, AI investments underdeliver — or backfire.

What governance delivers

Funded governance pays back across mission, risk, and efficiency.

Better decisions

One trusted source of truth, so leadership debates strategy — not whose number is right.

Lower risk

Clear ownership, classification, and access controls that hold up to an audit or an incident.

Efficiency

Less rework and faster reporting — accreditation and IPEDS cycles stop being fire drills.

AI-ready

Governed, well-defined data is the precondition for analytics and AI that leadership can actually trust.

Student success

Reliable data underpins retention, equity analysis, and the interventions that help students finish.

Public trust

Demonstrable stewardship of student and donor data protects the institution's reputation.

What we're asking leadership for
  • 1Visible sponsorship — an executive sponsor who signals this matters.
  • 2A mandate — authority for a governance committee to set policy and resolve disputes.
  • 3Modest resourcing — stewards' time and a catalog tool, not a new department.
  • 4Patience for phases — value in a year, maturity over two to three.
Why now

Enrollment pressure, tighter accountability, new privacy and AI regulation, and rising cyber risk all raise the stakes on data — at the same moment.

Governance is cheaper to build deliberately now than to retrofit after an incident, a failed audit, or an AI misstep. The cost of waiting compounds.

Pair this brief with the Implementation roadmap (the phased plan) and Metrics & KPIs (how we'll show progress) when you take it to leadership.

The case · Myths & objections

The pushback you'll hear — answered

Every governance program meets the same handful of objections. They're worth taking seriously: most contain a grain of truth about programs done badly. Here's the honest answer to each — the version you can say in a meeting.

Notice the pattern: nearly every objection assumes governance means control. It doesn't. It means clarity about who decides — and that's what makes work faster, not slower.

The objection
“We already have IT security — isn't that enough?”
The reality
Security protects the container; governance decides what belongs inside it, who may use it, and whether it's even correct. A lock on the vault doesn't tell you what should be in the vault — or which records are wrong.
The objection
“Governance will slow everyone down.”
The reality
Done well it speeds work: shared definitions end the “whose number is right?” debates, and pre-approved access paths cut the back-and-forth. The real drag comes from absent governance — rework, reconciliation, and waiting.
The objection
“This is just bureaucracy and more committees.”
The reality
Only if you let it. Proportionality keeps it light — the smallest workable structure is the goal, and ceremony scales only with risk. A single steward and a one-page policy is still real governance.
The objection
“We're too small and under-resourced for this.”
The reality
Then you most need the lean version. Governance scales down as well as up — you don't need a department, you need clear ownership of a few critical data assets and a short list of rules people actually follow.
The objection
“We tried this before and it failed.”
The reality
Most failures were top-down, control-first rollouts with no early wins to show. Leading with role clarity and visible value — not policy enforcement — is the deliberate fix this framework is built around.
The objection
“That's IT's job — or the data team's.”
The reality
Governance is decision rights, not plumbing. The people who own the meaning of the data — the registrar, finance, advancement — must hold the authority. IT operates the systems; it can't decide what a field means or who may see it.
The pattern behind the pushback

Every objection above assumes governance is about control — more rules, more gatekeeping, more meetings. Reframe it as clarity about who decides, sized to the risk, and each objection answers itself. That reframing is the whole strategy of this framework.

01 — Foundation

What the governance program stands on

Before any project applies governance, three things are fixed: the goals it serves, the objectives it pursues, and the principles every decision is measured against.

Goal 01
Set clear standards to improve data access, accuracy, and security.
Goal 02
Maximize data value while reducing risk and operational cost.
Goal 03
Empower staff, faculty, and students to use data effectively.

Six objectives

The measurable aims the program advances.

{{ o.n }}
{{ o.name }}
{{ o.desc }}

Eight principles

The lens every governance decision is weighed against.

{{ p.name }}
{{ p.desc }}
Foundation · A guiding principle

Govern in proportion to context

There is no single correct amount of governance. A liberal-arts college of 2,000 and an R1 research university with a medical center need very different programs. Proportionality means scaling governance to fit the institution — its size, mission, risk, capability, and resources — rather than imposing one rigid model and hoping it sticks.

Over-govern, and the program collapses under its own ceremony: committees no one attends, policies no one reads. Under-govern, and risk goes unmanaged. Proportionality is how you find the level an institution will actually sustain.

What to weigh

Six dimensions calibrate how much structure a program needs. Weigh them honestly before adding any committee, policy, or control.

Scale & complexity
Headcount, number of units, and how decentralized decisions already are. More moving parts need more coordination.
Data sensitivity & risk
How much regulated or high-stakes data you hold — student records, health, research, financial. Risk drives the floor.
Regulatory exposure
The laws, accreditors, and funders you answer to — FERPA, HIPAA, GDPR, grant terms. More obligations, more formality.
Capability & maturity
The skills, tooling, and governance habits already in place. Start where you are; don't write rules you can't operate.
Resourcing & sponsorship
Staff time, budget, and executive backing you can realistically commit. Ambition must match what's funded.
Mission & strategy
What the data is actually for. Govern most heavily where data serves the institution's core priorities.

How a program scales

The same five components appear at every size — what changes is their weight. The right level is rarely the most elaborate one; it's the heaviest one you can keep running.

Lean
Small or just starting

A small college, a single division, or a program in its first year.

· One steering group, meeting quarterly
· A short, plain-language policy set
· Classification & access basics
· A spreadsheet catalog; volunteer stewards
Standard
Mid-size & maturing

A regional university with several schools and a growing data team.

· Standing committee + named stewards per domain
· A RACI and core policy library
· A real catalog tool with definitions
· Quality thresholds on critical data
Comprehensive
Large or research-intensive

An R1 system with a medical center, research data, and many funders.

· Council + domain sub-committees
· A dedicated governance office
· Automated lineage & cataloging
· Formal exceptions, audit & risk integration

Before you add a control, ask

Three questions keep a program proportional as it grows. If a proposed rule fails them, it's ceremony, not governance.

Q1
What risk or decision does this control actually serve — and how large is it?
Q2
Can we operate it with the people, time, and tools we have today?
Q3
Is the burden it adds smaller than the harm it prevents?
One hard limit

Proportionality is not a license to under-govern. Risk sets the floor. A small college still owes a single student record FERPA-grade protection, and one research dataset under HIPAA carries the same obligation whether you have a governance office or a single coordinator. Scale the ceremony — the committees, the cadence, the tooling — never the safeguards on your most sensitive data.

Foundation · Boundaries

How data governance meets the rest

Data governance never operates alone. It shares borders with IT, security, privacy, risk, research, and more. Drawing those borders clearly prevents the two failures that quietly sink programs: gaps, where no one owns a decision, and turf wars, where everyone does.

A simple rule keeps the lines straight: data governance owns the data itself — its meaning, classification, ownership, and access policy. Neighboring domains own the systems it runs on, the uses it's put to, the risk it carries, or the people it concerns. Most friction is a boundary that was never drawn.

The neighboring domains

Each owns its own territory and shares a seam with data governance. The seam is where a handoff has to be explicit.

IT & technology governance
Owns
The systems, architecture, and infrastructure data lives on, and the technology portfolio.
The seam
Data governance sets the rules for the data; IT builds and runs the platforms that enforce them. Requirements flow down, implementation flows back up.
Information security
Owns
Threats, technical controls, identity, monitoring, and the capacity to respond to incidents.
The seam
Governance classifies an asset and decides who may use it; security enforces protection that matches the class. They share access management and incident response.
Privacy
Owns
Lawful, ethical use of personal data — consent, purpose limits, and individual rights under FERPA, GDPR, and the like.
The seam
Privacy governs personal data; governance governs all of it. On personal data they fuse: privacy sets the purpose, governance operationalizes it in classification and access.
Enterprise risk & compliance
Owns
The institution's risk register, regulatory adherence, and internal audit — reporting to leadership and the board.
The seam
Data risk is one line in enterprise risk. Governance supplies the data-related risks and control evidence; ERM prioritizes, escalates, and reports them upward.
Research governance
Owns
IRB and research ethics, sponsored-program terms, research integrity, and research data management plans.
The seam
Protocol- and funder-bound data keeps its own authority. Governance offers shared infrastructure, definitions, and standards without overriding IRB or grant conditions.
Records & AI governance
Owns
Retention schedules, archives, and public-records duties; and, increasingly, responsible-AI and model-risk oversight.
The seam
Records sets how long data is kept and when it's destroyed; AI governs the models. Both run on data governance's classification, quality, and lineage as their input.

Three ways a boundary works

Every shared border resolves into one of three relationships. Naming which one applies is what turns an argument into a workflow.

Define & operate
One domain sets the rule, another carries it out. Governance defines classification and access policy; IT and security operate the controls that deliver it.
Shared territory
Two domains genuinely overlap — personal data, for instance. Name a single accountable lead and make the other a required consult, in writing.
Escalation
Some matters roll upward. A data issue with institutional stakes becomes an enterprise-risk item and, ultimately, a board concern.
The common thread

Data governance is the common thread between these domains — the shared vocabulary and the table where their claims on data are reconciled. Give every shared boundary one accountable owner in the RACI. Where data governance isn't the lead, it's the consult; where it is, it convenes the others. That single discipline is what closes the gaps without starting the turf wars.

Foundation · A special case

Research data plays by different rules

Research data is the single feature that most distinguishes a university from any other organization — and the place standard data governance most often gets it wrong. It carries authorities your governance program does not control: an IRB, a funder, an export regime, a principal investigator. Treat it like administrative data and you will either break the law or break the research.

The right posture is humility about the boundary: data governance provides the shared infrastructure and standards, and steps back where research-specific authority takes over. This page draws that line.

Why it's different

Four traits set research data apart from the student, financial, and HR data the rest of the framework addresses.

Contested ownership
The PI feels it's theirs; the institution holds the legal and ethical obligations. Ownership is rarely as obvious as it is for enrollment or payroll data.
External authority
An IRB approves its use; a funder dictates how it's shared and kept; export rules can restrict who may even see it. These override internal policy.
A duty to share
Most data governance defaults to restriction; research increasingly carries a mandate to open data (FAIR, funder policies) — in tension with confidentiality.
Long, portable lifecycle
It outlives projects, follows researchers between institutions, and faces retention mandates measured in years or decades after a grant closes.

Where the line falls

Data governance does not govern research data — it supports it. The split is clean once named.

Research authority decides
· Whether and how human-subjects data may be used (IRB)
· What consent permits — transfer, reuse, sharing
· Funder terms: retention, open-access, data-sharing plans
· Export-control and security limits on access
Data governance still provides
· Shared, secure storage & infrastructure to build on
· Classification & handling standards for sensitive data
· Catalog, definitions & metadata practices
· A retention & disposal backbone the mandates plug into

The research-data lifecycle

Governance attention shifts at each stage — and the handoffs are where data is lost, leaked, or stranded.

01 · Plan
Proposal & DMP
The data-management plan is written into the grant. Classification and storage are decided before any data exists.
02 · Collect
Active research
IRB consent governs use; access is least-privilege; sensitive data sits in approved, secured environments.
03 · Share
Publish & deposit
FAIR and funder mandates push toward open deposit — de-identified, with a data-use agreement where needed.
04 · Retain
Keep or destroy
Funder and policy schedules dictate retention for years after close; secure disposal follows on the clock.
The governing rule

When research authority and data governance disagree, research authority wins — the IRB, the funder agreement, and export law are not yours to override. Your job is to make compliance easy: governed infrastructure, clear classification, and a retention backbone the researchers can simply plug into.

Foundation · A key distinction

Governance is not data management

The two are constantly confused, and the confusion is costly. Governance decides the rules; management carries them out. Governance is about authority and accountability — who may decide what; management is about execution — the hands-on work of moving, storing, and securing data.

A simple test: if the question is "who is allowed to decide?" that's governance. If it's "how do we make it happen?" that's management.

Data governance
Decision rights & accountability

The "what" and "who". Sets policy, standards, definitions, and ownership — and holds people accountable to them.

· Setting data policy and standards
· Approving definitions and classifications
· Assigning ownership and decision rights
· Resolving disputes and granting exceptions
Owned by: Committee, Trustees, Stewards
Data management
Execution & operations

The "how". The technical and operational work that delivers data according to governance's rules.

· Building pipelines and integrations
· Storing, modeling, and securing data
· Provisioning access that's been approved
· Running quality checks and backups
Owned by: Custodians, IT, data engineering

How they relate

They're two halves of one system. Governance sets direction; management executes; results and friction flow back to refine the rules. Neither works alone — governance without management is shelfware; management without governance is inconsistent and risky.

Governance sets the rules
Policy, standards, definitions, and ownership give management a clear target to build toward.
Management executes them
Engineering and operations implement the controls, pipelines, and access that the rules require.
Results feed back
Metrics, incidents, and friction from operations inform the next revision of policy and standards.
In the DMBoK picture

In the DAMA-DMBoK model, governance sits at the hub of the wheel and the management disciplines — storage, security, integration, quality, metadata — are the spokes. This framework's five components are how that hub is operationalized; the management disciplines are where Custodians do the work.

02 — The machinery

Five defined components

These are the operational building blocks a project draws on. Every step of applying governance maps back to one or more of them.

These five mirror the components common to data-governance programs across higher education — spanning governance roles, metadata & cataloging, data access & security, data quality, and enabling technology. They align with widely cited data-governance decision domains and the role structure (trustees, stewards, custodians) reflected in sector guidance such as the EDUCAUSE data-governance work.

Where do laws & regulations fit?
FERPA GLBA HIPAA

Compliance isn't a sixth component — it's a cross-cutting concern threaded through the five. The bridge is data classification: you classify data by sensitivity, the classification determines which laws apply, and those requirements flow into access, controls, and audit.

{{ c.comp }}
{{ c.role }}

It's also anchored in the foundation — the Compliance & Auditing objective and the Security & Compliance principle — and accountable to the Data Trustee, with Advisory Teams confirming compliance before launch.

{{ cd.n }} {{ cd.tag }}

{{ cd.name }}

{{ cd.summary }}

{{ cd.detail }}

{{ s.heading }}

{{ s.intro }}

{{ it.t }} {{ it.tag }}
{{ it.d }}
Who owns it

{{ cd.ownership }}

Representative, not definitive

These roles are a representative model — campuses may add, rename, or combine roles to run the program in a way that fits their organization and structure. What matters is that two sets of core roles are accounted for; how they're staffed and titled is a local choice:

Accountability & execution roles
The roles accountable for data and those who execute on it day to day — Trustees, Stewards, and Custodians across each domain.
Program governance & support roles
The roles that govern and support the data governance program itself — the Committee, the Work Group, and the advisory/operational support that keep the program running.
04 — Governance structure

Where does governance live?

Before roles can be filled, an institution has to decide how to structure the program — including whether to fold it into existing IT governance or stand it up another way. Drawn from how higher-education institutions actually organize, four options recur, each trading control for autonomy differently.

Most programs blend these and shift over time — many also go hybrid, centralizing governance for high-risk data (student PII, FERPA-protected records) while decentralizing low-risk data.

{{ m.name }}

{{ m.sits }}
More controlMore autonomy

{{ m.def }}

How it works
{{ m.how }}
Best when
{{ m.bestWhen }}
Watch-outs
{{ m.watch }}
Where this framework lands

This framework is built as a federated model with IT-governance sponsorship.

A data governance committee provides oversight and executive backing, a Data Governance Work Group coordinates shared standards in the absence of a standing office, and Data Trustees own data within each domain. A program can begin embedded in IT governance and mature toward a standing Data Governance Office as it scales.

Participation · Everyone's role

Governance is everyone who touches data

The named roles — Trustees, Stewards, Custodians — set and run the program. But every faculty member, administrator, student worker, and analyst who creates, uses, or shares data is a data citizen. The best policy fails if the person with the spreadsheet doesn't follow it.

End users don't need a title or training certificate to participate. They need to know a handful of everyday responsibilities — and where to go when a decision is above their pay grade.

Every data citizen's responsibilities

Six habits that make governance real at the point where data is actually handled.

Know what you're handling

Recognize the classification of the data in front of you — and treat Confidential and Restricted data accordingly.

Use the source of truth

Pull from governed, authoritative sources — not a personal copy from three months ago — and use agreed definitions.

Share responsibly

Share through approved access, not by emailing files. Don't paste sensitive data into external tools or AI services.

Protect access

Keep credentials secure, request only the access you need, and speak up when you can see more than you should.

Flag problems

Report inaccurate data, and report suspected exposure immediately. Spotting issues early is the whole point of having many eyes.

Ask when unsure

When a decision is bigger than the task in front of you, escalate to the domain Steward instead of guessing.

A spectrum of participation

Governance isn't a department — it's a continuum from setting the rules to following them. Everyone sits somewhere on it.

Who
Their part in governance
Governance Committee
Sets direction, policy, and the escalation authority.
Trustees & Stewards
Own domains, definitions, and quality; approve access and use.
Custodians / IT
Operate systems and enforce the controls the rules require.
Data citizens (everyone else)
Create, use, and share data responsibly — the front line where policy meets practice.
For everyday decisions

Most data choices never become a project. The two-minute task loop turns these six responsibilities into a quick, repeatable call anyone can make.

05 — Maturity assessment

How mature is your governance?

Maturity is a ladder, not a switch. This five-level scale is adapted from the Capability Maturity Model and Stanford's higher-education data-governance maturity model — moving from ad hoc practice to continuous improvement.

Rate your institution on each dimension below to see an overall level and where to focus next. Your ratings are saved on this device.

{{ l.n }} {{ l.name }}
{{ l.tag }}

{{ l.desc }}

Rate your institution

{{ d.name }} {{ d.maps }}
{{ d.desc }}
{{ d.curLabel }}
1 = Initial · 5 = Optimizing {{ matCompletedLabel }}
Your overall maturity
{{ matOverallNum }} {{ matOverallName }}
{{ matOverallTag }} · weighted score {{ matScoreLabel }}

{{ matOverallDesc }}

To advance toward {{ matNextName }}
{{ matAdvanceText }}
Where to focus — open the relevant section
By dimension
{{ d.name }}{{ d.curLabel }}
Rate the dimensions above to see your level

Pick a level from 1 (Initial) to 5 (Optimizing) for each dimension. Your overall maturity and a focus for the next level appear here.

Grounded in the Capability Maturity Model (CMMI), Stanford University's Data Governance Maturity Model (2011) for higher education, and the DAMA-DMBoK reference framework — which places data governance at the hub of the data-management disciplines this assessment samples.

06 — Metrics & outcomes

How do we know it's working?

Governance earns its keep when it changes outcomes. Track a small, balanced set of measures across five pillars — each with a leading indicator (effort, early signal) and a lagging indicator (realized result).

Start narrow: one leading and one lagging metric per pillar gives leadership a view of both activity and impact without drowning stewards in reporting.

Leading — measures effort and early signals you can act on now (training done, assets catalogued).
Lagging — measures realized results that confirm impact (incidents, decision latency).
01 Data Quality
Is the data fit for use?
  • Data accuracy rate
    % of records passing validation rules across core systems
  • Completeness
    % of required fields populated in SIS, LMS and CRM
  • Duplicate record rate
    Duplicate student/staff records per 10,000
  • Issue time-to-resolution
    Average days to close a data quality defect
  • Timeliness / freshness
    % of datasets refreshed within their defined SLA
02 Maturity & Adoption
Is governance taking hold?
  • Domains with assigned stewards
    % of critical data domains with a named owner/steward
  • Assets catalogued
    % of data assets in the catalog with a glossary definition
  • Policy coverage
    % of domains with current, approved policies
  • Maturity score
    Periodic level (1–5) per dimension from the assessment
  • Steward engagement
    Active stewards / assigned, plus meeting attendance
03 Compliance & Risk
Are we protecting the institution?
  • FERPA / GDPR compliance rate
    Audits passed; findings closed on time
  • Privacy incidents
    Number of breaches and mean time to contain
  • Access recertification
    % of access reviews completed on schedule
  • Retention coverage
    % of systems with documented retention/disposal schedules
  • Time-to-revoke access
    Avg. time to remove access on role change or departure
04 Access & Literacy
Can people use data safely?
  • Time-to-provision access
    Average turnaround on access requests
  • Excess access remediated
    Orphaned or over-privileged accounts found and removed
  • Literacy training completion
    % of staff completing data governance training
  • Self-service adoption
    Governed self-service reports vs. ad-hoc requests to IT
05 Outcomes & Value
What changed for the institution?
  • Manual data requests
    Reduction in ad-hoc requests to IR/IT over time
  • Decision latency
    Time from data request to insight delivered
  • Single source of truth
    % of official reports drawn from governed sources
  • Outcomes enabled
    Faster accreditation reporting; better retention forecasts
  • Accreditation / IPEDS cycle time
    Time to compile reports and the resubmission/error rate
Starter scorecard

One leading + one lagging metric per pillar

The minimum viable dashboard the governance committee can review quarterly — effort on the left, impact on the right.

Pillar
Leading
Lagging
Data Quality
Validation pass rate
Duplicate record rate
Maturity & Adoption
Assets catalogued
Maturity score
Compliance & Risk
Access recertification on time
Privacy incidents
Access & Literacy
Training completion
Self-service adoption
Outcomes & Value
Decision latency
Reduction in manual requests

Targets should be set per institution against a baseline — a metric without a baseline and a threshold is just a number. Review leading indicators monthly with stewards and lagging indicators quarterly with the governance committee.

Reference — Glossary

One vocabulary, shared by everyone

Good governance starts with shared definitions. These are the terms used across this site and in day-to-day practice. Press ⌘K anywhere to look one up.

{{ versionStamp }}

{{ g.group }}

{{ t.term }}
{{ t.def }}
Use cases · Governance in action

See the framework at work, at every level

The same governance framework scales from a campus-wide initiative, to a single project, down to an everyday task. Pick a level to browse worked examples — each one opens the full walkthrough.

{{ ucCountLabel }}
{{ c.levelLabel }}
{{ c.area }}

{{ c.title }}

{{ c.summary }}

{{ c.domains }} {{ c.cta }}
Learn & practice · Capability

From data literacy to fluency

Governance sets the rules; capability is whether people can actually work within them. That capability isn't one thing — it grows along a path from literacy (you can read and question data) through competency (you can do your role's data work correctly) to fluency (you reason and lead with data as second nature).

Not everyone needs fluency, and that's the point: the target level depends on the role. A faculty member needs literacy; a Steward needs domain competency; an analyst or data leader needs fluency. Naming the target is what makes training purposeful rather than generic.

The progression

Three stages, each building on the one before. People move up as their responsibilities grow.

Stage 1 · Foundation
Literacy

Can read, interpret, and question data — and knows the rules that apply to it.

Looks like: reads a report critically, knows a classification tier, asks where a number came from, follows policy.
Stage 2 · Role-ready
Competency

Can perform the data work their role requires, correctly and independently.

Looks like: a Steward writes a sound definition; a Custodian configures controls; an analyst builds a governed report.
Stage 3 · Second nature
Fluency

Reasons and leads with data instinctively — and helps others do the same.

Looks like: frames decisions around evidence, spots when data is being misused, mentors and sets standards.

Literacy is the floor for everyone who touches institutional data. Competency and fluency are reached by role — and they're a moving target as tools (and AI) change what "using data well" means.

Target capability by role

What level each role should reach, and the specific competencies that define it. Set these as expectations, then train toward them.

Role
Target level
Core competencies to build
Everyone / data citizen
Literacy
Recognize classification, use the source of truth, share safely, know when to ask.
Data Steward
Domain competency
Author definitions, judge data quality, manage metadata, decide appropriate use.
Data Trustee
Competency + judgment
Weigh risk, interpret policy, make accountable decisions about their domain.
Custodian / IT
Technical competency
Implement controls to classification, maintain lineage and logs, secure systems.
Analyst / IR
Fluency
Reason with data, choose methods soundly, communicate insight, spot misuse.
Leaders / Committee
Fluency (decision)
Ask the right questions of data, set evidence expectations, model the culture.
How capability gets built

This is the target; role training is how you reach it, and the scenarios are where it's rehearsed. Capability is also a maturity dimension — "Culture & Literacy" — so you can track it as the program grows.

Training · Learn your role

Training for every governance role

Six roles carry the framework. Each module covers what the role is accountable for, the do’s and don’ts that matter most, a get-started path, step-by-step playbooks, worked scenarios from the use-case library, and a scored knowledge check. Pick a role to begin.

{{ trainProgressLabel }}
{{ c.num }} {{ c.tier }}

{{ c.name }}

{{ c.mission }}

Start training → {{ c.statusLabel }}
{{ trainDetail.num }} {{ trainDetail.tier }}

{{ trainDetail.name }}

{{ trainDetail.mission }}

What it takes

The knowledge, skills, and abilities that make someone effective in this role.

Knowledge
{{ i.text }}
Skills
{{ i.text }}
Abilities
{{ i.text }}
Your authority

{{ trainDetail.authority }}

You escalate to

{{ trainDetail.escalates }}

You work with

{{ trainDetail.partners }}

Core responsibilities

{{ r.text }}
✓  Do
{{ d.text }}
✕  Don’t
{{ d.text }}

Common pitfalls

Where this role most often goes wrong — and the cost.

{{ p.m }}
{{ p.c }}

Handoffs

Most governance failures happen at the seams between roles.

↓  What you should receive
{{ h.text }}
↑  What you owe the next role
{{ h.text }}

Through your lens

The same use cases from the library, seen from where you sit.

{{ s.level }} {{ s.title }}

{{ s.lens }}

Your first 90 days

A practical path for someone newly stepping into this role.

First 30 days
{{ i.text }}
By 60 days
{{ i.text }}
By 90 days
{{ i.text }}

Tools & artifacts you’ll use

The parts of the framework this role works in most. Tap to open.

Step-by-step playbooks

The core procedures this role runs, broken into concrete steps.

{{ p.title }}
{{ s.n }} {{ s.text }}

Knowledge check

Answer all questions correctly to complete this module.

✓ Module completed — {{ quizScoreLabel }}
{{ q.n }} {{ q.q }}
{{ q.resultLabel }}

{{ q.explain }}

Apply to a project · Step 1 of 2

Start with the questions to ask

Before any tooling or access, applying governance to a new initiative starts with a conversation. Work through these questions for each of the five components — beginning with the first one every effort shares: what data are we governing? Pick a project below to see every question answered for a real initiative.

Apply the checklist to
{{ clProjectName }}
{{ clProjectNote }}
Overall progress{{ overallLabel }}
{{ g.tag }}

{{ g.name }}

{{ g.progressLabel }}

{{ g.intro }}

{{ it.q }}
This project {{ it.answer }}
Apply to a project · Step 2 of 2

Follow the governance lifecycle

With the checklist answered, this is the repeatable lifecycle every initiative follows. Each step calls on the components and roles from the framework. Follow one initiative through all seven steps — then switch to a multi-domain initiative to see what changes when the data crosses boundaries.

The starter is a ready-to-fill checklist and RACI skeleton for the selected initiative — open it in any editor and assign owners.

{{ b.label }}

{{ exTitle }}

{{ exBlurb }}

{{ s.n }}

{{ s.name }}

{{ s.what }}

In this initiative

{{ s.detail }}

Component {{ s.comp }} Role {{ s.role }} Principle {{ s.principle }}
The difference a boundary makes

A single-domain project runs the lifecycle within one chain of accountability. The moment data crosses domains, the same seven steps still apply — but the Data Governance Work Group coordinates shared standards, a combined RACI, and cross-domain escalation so no element falls through the seams.

Apply to a task · Everyday decisions

Govern the small stuff, not just the big launches

Most data decisions never become a project. A spreadsheet lands in your inbox, someone asks for a one-off export, a duplicate record turns up. The same framework still applies — compressed into a two-minute call. This is governance at the size of a single task, where it most often quietly breaks.

Initiative level

A new system, a data warehouse, a CRM rollout. Planned, sponsored, runs the full lifecycle over weeks or months.

Task level

A single request, a one-off export, a quality fix. Ad-hoc, unsponsored, decided in minutes — the same components, roles, and rules at a smaller scale.

The two-minute loop — run it for any task
1
Classify
What data is this — Public, Internal, Confidential, or Restricted?
2
Find the owner
Whose domain is it? Identify the Trustee and the Steward.
3
Check the rule
What do the catalog and policy already say about it?
4
Route the call
Steward for day-to-day; Trustee for the real decision.
5
Record it
Log the decision so it's auditable later.

Common situations, answered

Pick a situation to see the governed call — its classification, who decides, the rule, and exactly what to do.

Restricted Confidential Internal Public
{{ g.cat }}
{{ taskDetail.cat }}

{{ taskDetail.q }}

{{ taskDetail.situation }}

{{ taskDetail.verdictMark }} {{ taskDetail.verdictLabel }}
Classification
{{ taskDetail.className }}
{{ taskDetail.classDesc }}
Routes to
{{ taskDetail.routeWhy }}
Component
The rule

{{ taskDetail.rule }}

Do this
{{ s.n }} {{ s.text }}
Log {{ taskDetail.log }}
One framework, two scales

A project stands governance up deliberately; a task applies it in the moment. Same components, same roles, same rules — the only thing that changes is the size of the decision. Govern the tasks well and the projects mostly take care of themselves.

Put it to work · Decision wizard

What should I do with this data?

Answer three quick questions about a dataset and get its classification tier, how to handle it, and who to ask. This turns the classification rules into a thirty-second decision you can make at your desk.

Guidance only — the Data Trustee for the domain makes the final call and records it in the catalog. When two answers point in different directions, the higher tier wins.

{{ q.n }} {{ q.prompt }}
{{ q.help }}
This data should be classified
{{ wizardResultTag }}
{{ wizardResultName }}
How to handle it
{{ wizardResultHandling }}
Who to ask
{{ wizardResultAsk }}
Your result appears here
Answer all three questions on the left and the recommended classification, handling, and contact will show up.
{{ wizardProgressLabel }}
Combining data?

A combined dataset takes the highest classification of any field it contains — aggregating Internal data can produce a Confidential result. Re-run this when you merge sources. See the full Data classification reference for the complete handling rules per tier.

Live example · The public portal

A public record of how data is governed

This is what the framework looks like in the open: a public Data Governance Portal listing the institution's major data initiatives. Each one has a public governance record — its purpose, domains, roles, classification, and how the five components were applied.

Open any initiative to see its public record, then sign in (top-right of the portal) to reveal the staff-only artifacts behind each component — the RACI charts, catalog entries, access policies, quality rules, and controls registers.

Emerging · AI

Governing data in the age of AI

AI doesn't replace data governance — it raises the stakes. A model is only as trustworthy as the governed data behind it, and a system that acts on data autonomously needs every component of the framework working. The same five components apply; AI just stretches each one.

Governance doesn't move to a new home for AI — it reaches into the model lifecycle: the data a model learns from, the data it can touch at run time, and the actions it's allowed to take.

What makes AI different

Traditional systems are deterministic and legible: a report runs the same query every time, and you can read exactly what it did. AI breaks those assumptions — six properties demand consideration that conventional data systems never required.

Opacity
You can't read why it decided

A SQL report is fully inspectable; a model's reasoning is not. Governance must require explainability, documented limits, and human review where decisions affect people.

Non-determinism
Same input, different output

Traditional systems are reproducible; generative models may not be. Governance needs versioning, logging of inputs and outputs, and testing against drift rather than a one-time sign-off.

Speed & scale
Mistakes compound instantly

A model can act on thousands of records in seconds. A small error or bias propagates faster than any human process can catch — so controls must be preventive and monitored, not just after-the-fact.

Emergent behavior
It does things no one specified

Unlike coded logic, models can produce capabilities and failures nobody designed — hallucinations, unexpected inferences. Governance must enumerate allowed actions and bound what the system may do.

Bias & fairness
It learns our past inequities

A model trained on historical data can encode and amplify existing bias — high-stakes in admissions, advising, or aid. Governance must monitor for disparate impact across student populations.

Data leakage & reuse
Inputs can resurface as outputs

Data fed to a model may be memorized, embedded, or used for training elsewhere — re-identifying individuals or exposing protected records. Governance must control what data reaches a model and where it goes.

How the five components apply to AI

Each component you already know extends naturally to models and the data that feeds them.

{{ c.n }} {{ c.name }}

{{ c.ai }}

Worked example · Agentic AI

A Student Success "copilot" that acts on its own

Picture an AI agent that reviews early-alert signals each morning and drafts advisor outreach — pulling from Student Records, Financial Aid, and Advising on its own. Agentic AI doesn't just answer; it reads data and takes actions autonomously, often across domains. That's exactly where governance has to be tightest.

Governance treats the agent like a powerful new Data Custodian — it executes, under bounded and delegated authority — while a human stays accountable for everything it does.

{{ s.n }}
{{ s.t }}
{{ s.d }}
Component · {{ s.comp }}
The line that doesn't move

An agent can be delegated authority to act — but, exactly like a human Steward or Custodian, accountability stays with the Data Trustee. The framework doesn't change for AI; it's what makes acting through AI safe.

Reference · Data classification

Four tiers, one handling rule each

Every data element carries a classification. The tier sets who may see it, how it must be stored and shared, and what happens if it's exposed. When in doubt, classify up — the higher tier always wins.

Classification is assigned by the Data Trustee for a domain and recorded in the catalog alongside each asset.

Public
Tier 1 · No harm if released
Examples
Course catalog, published enrollment totals, directory of programs, press releases.
Handling
Open access. No restrictions on storage or sharing. Still owned and quality-checked.
Internal
Tier 2 · For institutional use
Examples
Operational dashboards, internal procedures, unpublished analyses, org charts.
Handling
Accessible to employees with a business need. Not for public release. Internal systems only.
Confidential
Tier 3 · Protected by law/policy
Examples
Student records (FERPA), grades, financial aid data, personnel files, donor records.
Handling
Role-based access, logged. Encrypt in transit and at rest. No sharing without authorization.
Restricted
Tier 4 · Severe harm if exposed
Examples
SSNs, bank/payment data, health records (HIPAA), security credentials, research under contract.
Handling
Explicit named approval, MFA, full audit. Minimum-necessary use. Breach triggers mandatory notification.
Rule of thumb

A combined dataset takes the highest classification of any field it contains. Aggregating Internal data can produce Confidential results — re-classify when you combine sources.

Reference · Policy & document library

The artifacts the framework refers to

Every policy has a named owner and a review cadence. A policy without a current review date is treated as out of date.

Data Governance PolicyCurrent

The charter: scope, authority, roles, and how decisions are made.

Owner: Governance Committee · Reviewed annually
Data Classification PolicyCurrent

The four tiers and the handling rules for each. See the classification reference.

Owner: CISO + Data Trustees · Reviewed annually
Access & Authorization PolicyCurrent

Who may request access, who approves it, and how it's reviewed and revoked.

Owner: Data Trustees · Reviewed annually
Data Retention & Disposal ScheduleIn review

How long each record type is kept and how it's securely destroyed.

Owner: Records Mgmt + Legal · Reviewed every 2 yrs
Privacy Notice (FERPA/GDPR)Current

What data the institution collects, why, and the rights individuals have.

Owner: Privacy Office · Reviewed annually
Acceptable Use & AI GuidelinesIn review

Rules for using institutional data, including in AI tools and models.

Owner: Governance Committee · Reviewed annually
Reference · Laws & regulations

The regulatory landscape governance must satisfy

A university holds student, employee, financial, health, and research data — each with its own rules. Governance doesn't replace these obligations; it's how the institution meets them consistently.

Orientation only — not legal advice. Your Office of General Counsel and Privacy Office determine what applies and how.

Student data & records
FERPA
Protects student education records; governs disclosure, consent, and the right to inspect and amend.
Clery Act
Requires disclosure of campus crime statistics and security data; ties to incident records.
Title IX
Sex-discrimination data for students and employees; sensitive case records with strict access.
Privacy & consumer protection
GDPR
EU/EEA data subjects — intl. students, study-abroad, recruiting. Consent, rights, 72-hour breach notice.
CCPA / CPRA & state privacy laws
State comprehensive privacy rights (CA, VA, CO, and growing). Access, deletion, and opt-out duties.
State breach-notification laws
Nearly every state mandates notice to affected residents after a breach; deadlines vary.
Financial data
GLBA Safeguards Rule
Student financial-aid data — mandates an information-security program and incident response.
PCI DSS
Payment-card data (tuition, events, bookstore). Contractual standard enforced by card brands.
Red Flags Rule (FACTA)
Identity-theft prevention for covered accounts such as student loans and payment plans.
Health data
HIPAA
Protected health info in clinics/covered components. Privacy, Security, and Breach Notification rules.
FERPA / HIPAA boundary
Student treatment records are usually FERPA, not HIPAA — the line must be set explicitly per system.
Employment & hiring (HR data)
Title VII, ADEA & EEOC recordkeeping
Non-discrimination in hiring/employment; required retention of applicant and personnel records.
ADA
Disability & accommodation records must be kept confidential and stored separately from personnel files.
FLSA & FMLA
Wage/hour and medical-leave records — retention duties and confidentiality of medical information.
IRCA / Form I-9
Employment-eligibility verification; strict retention and limited-access requirements.
State employment-privacy laws
Background-check, SSN-handling, and personnel-file access rules that vary by state.
Research data
Common Rule (45 CFR 46)
Human-subjects research — IRB oversight, informed consent, and protection of subject data.
Export controls (EAR / ITAR)
Restricted technical/research data — access limits by nationality and secure handling.
Funder data requirements (NIH / NSF)
Data-management, sharing, and retention obligations attached to federal grants.
Accessibility & IT
Section 508 / ADA Title II
Data reports, dashboards, and systems must be accessible to people with disabilities.
WCAG 2.1 (standard)
The technical benchmark institutions adopt to meet accessibility obligations.
AI regulation
EU AI Act
EU law with extraterritorial reach — can apply to a US institution when an AI system's output is used in the EU, when it's put into service for people in the EU, or via an EU entity/program. Classifies AI for admissions, assessment, and proctoring as high-risk.
US state AI & automated-decision laws
A growing patchwork (e.g. Colorado AI Act, automated-decision provisions in state privacy laws) governing high-risk and consequential automated decisions.
NIST AI Risk Management Framework
Voluntary US framework — the practical reference for trustworthy-AI controls and the basis most institutions map to.

Does the EU AI Act apply to US higher ed? Not as a blanket rule — but it reaches US institutions situationally (EU-used output, EU learners, EU operations) much like GDPR, and education uses are largely high-risk under it. Treat it as both a possible obligation for global programs and a de facto benchmark. Counsel determines scope per system; this is orientation, not legal advice.

How governance uses this

Each law maps to a classification tier, a retention rule, and an accountable Trustee. When you classify data and assign ownership, you're operationalizing these obligations — which is why the catalog records the governing regulation for sensitive domains.

Get help · Requests & intake

The front door

Four standard requests cover almost everything people need from governance. Each routes to the right steward and follows a defined turnaround.

Request data access

Ask to see or use a dataset, report, or system you don't yet have rights to.

You'll provide: dataset, purpose, duration
Routes to: Data Trustee + Steward
Turnaround: 3 business days
Report a data issue

Flag inaccurate, missing, duplicated, or out-of-date data.

You'll provide: where you saw it, what's wrong
Routes to: Data Steward
Turnaround: Triaged in 2 business days
Propose a data product

Request a new report, dashboard, integration, or dataset.

You'll provide: use case, audience, sources
Routes to: Work Group
Turnaround: Reviewed at next intake cycle
Request an exception

Ask for a time-bound exception to a policy when a real need can't be met otherwise.

You'll provide: policy, reason, mitigations
Routes to: Governance Committee
Turnaround: Decision in 10 business days
Not sure which one?
Start with "Report a data issue" — a steward will route you.
Operate · Incident response

If data is exposed, move in this order

A data incident is any unauthorized access, loss, or disclosure. Speed matters most in the first hours — contain first, investigate second.

Suspected incident? Notify the Privacy Office and CISO immediately — do not wait until you're sure.

Aligned with established frameworks

This playbook maps the institution's data-governance roles onto the standard incident lifecycle from NIST SP 800-61 (Computer Security Incident Handling) and the NIST Cybersecurity Framework functions — so a data incident is handled exactly like a security incident, with governance owning the data side.

NIST SP 800-61 NIST CSF · Detect → Respond → Recover FERPA / GDPR breach rules This framework · Roles & Components
1
Detect & report
Anyone who notices a possible incident reports it at once to the Privacy Office and CISO. Note the time, system, and what you observed. No blame for reporting.
NIST CSF · Detect Framework · Roles + Governance Technology (monitoring)
2
Contain
Stop the exposure — revoke access, disable the account, isolate the system. Preserve evidence; don't delete logs. The CISO leads.
NIST 800-61 · Containment & Eradication Framework · Access Lifecycle · led by CISO / Custodian
3
Assess scope
Determine what data, whose, and how much — and its classification tier. Restricted or Confidential data drives legal notification timelines.
NIST 800-61 · Analysis Framework · Data Classification + Catalog · Steward + Trustee
4
Notify
Legal and the Privacy Office determine who must be told and by when — affected individuals, regulators, leadership — per FERPA/GDPR and state law.
NIST CSF · Respond (Communications) · FERPA / GDPR Framework · Data Trustee accountable · Privacy + Legal
5
Review & improve
A blameless post-incident review identifies the root cause and feeds fixes back into standards, access rules, and training. Logged for the committee.
NIST 800-61 · Post-Incident Activity · CSF Recover Framework · Continuous Improvement · Governance Committee

Grounded in NIST SP 800-61r2 (Computer Security Incident Handling Guide) and the NIST Cybersecurity Framework. Notification obligations follow FERPA, GDPR where applicable, and state breach-notification law — your Privacy Office and Legal counsel set the binding timelines.

Applicable laws & obligations · breach

What drives the notification clock

Which laws apply depends on whose data and what kind. Confirm the binding set with Legal — this is orientation, not legal advice.

FERPA
Student education records. Disclosure handling and the duty to address compromised records.
GDPR · 72 hrs
EU/EEA data subjects (intl. students & staff). Regulator notice within 72 hours of awareness.
GLBA Safeguards Rule
Student financial-aid data. Security program and incident-response obligations.
State breach-notification laws
Notice to affected residents (e.g. CCPA/CPRA in CA). Deadlines vary by state.
HIPAA
Only where a clinic/covered component is involved. Breach notification rule applies.
PCI DSS
Payment-card data. Contractual, not law — card brands & acquirer set reporting.
Plan · Implementation roadmap

Governance is a journey, in four phases

You don't stand up governance all at once. Each phase delivers value while building toward the next. Most institutions spend 12–24 months reaching steady state.

Phase 1 · Q1–Q2
Establish
  • Charter the committee & name Trustees
  • Adopt core policies
  • Define classification tiers
  • Pick one pilot domain
Phase 2 · Q3–Q4
Operationalize
  • Assign Stewards per domain
  • Stand up the data catalog
  • Launch request & intake process
  • Begin steward training
Phase 3 · Year 2 H1
Scale
  • Roll out to remaining domains
  • Automate access reviews
  • Publish the KPI scorecard
  • Run first maturity assessment
Phase 4 · Year 2 H2+
Optimize
  • Continuous improvement loop
  • Governance embedded in projects
  • Extend to AI & new sources
  • Benchmark & raise targets
Get help · FAQ

Quick answers

Do I need approval to share a spreadsheet with a colleague?

If it contains Confidential or Restricted data, yes — share through governed access, not by emailing a file. Internal and Public data can be shared with a business need.

Who decides what data means?

The Data Steward for that domain owns the definition, recorded in the glossary. One agreed meaning, used everywhere.

Can I use institutional data in an AI tool?

Only governed, appropriately-classified data, and never paste Confidential or Restricted data into external AI services. See AI & governance.

My report disagrees with someone else's. Who's right?

Check whether both pull from a governed source of truth. If definitions differ, raise it with the Steward — reconciling these is exactly what governance is for.

How do I get access to a dataset?

Submit a data access request with your purpose. The Trustee and Steward approve based on business need. See Requests & intake.

Isn't this just more bureaucracy?

Governance scales to risk. Low-risk everyday work uses lightweight task triage; only high-stakes data and projects get the full process.

Get help · Who do I ask?

Match your question to a role

Governance is people, not just policy. Here's who owns what — fill in the names for your institution.

Governance Committee
Policy, exceptions, escalations

Sets direction and resolves cross-domain disputes. Ask them about policy changes and exception requests.

Data Trustee
Accountable for a data domain

Senior owner (e.g. Registrar, CFO). Ask about access approvals and classification for their domain.

Data Steward
Day-to-day data owner

Your first call for definitions, data quality issues, and how a dataset should be used.

Privacy Office
FERPA, GDPR, consent

Ask about privacy rights, consent, and report suspected incidents here first.

CISO / Security
Protection & incidents

Owns technical safeguards and leads incident containment. Report security concerns immediately.

Institutional Research
Official reporting & analysis

Source of official metrics for accreditation and external reporting. Ask about authoritative numbers.

Context · Why higher ed

Why data governance is uniquely hard in higher education

Universities aren't corporations. Authority is shared, data is scattered across decades of systems, and the culture prizes autonomy. A governance framework that ignores this context fails on contact — these are the realities it has to work within.

Naming the obstacles up front is what separates a framework that's adopted from one that sits on a shelf.

Shared, decentralized governance

Faculty senates, deans, and administrative units hold real autonomy. No single executive can simply mandate data practices — governance must be earned through legitimacy, not imposed.

Decades of siloed systems

SIS, LMS, advancement, finance, HR, and research systems were bought independently over many years. The same student exists in a dozen systems under different IDs and definitions.

Many roles for one person

A person can be a student, employee, alum, and research subject at once. Governing identity and consent across those roles is a problem few other sectors face.

High-stakes, sensitive data

Education records, health, financial aid, and research data carry strict legal protection and real consequences for students when mishandled.

Mounting accountability pressure

Enrollment decline, accreditation, outcomes reporting, and public scrutiny all demand trustworthy data — fast. Governance is now an operational necessity, not a nicety.

Thin resources, competing priorities

Few institutions have dedicated governance staff. The framework has to scale to risk and deliver value early, or it loses the attention it needs to survive.

The design implication

Because authority is shared and resources are thin, this framework leads with legitimacy and value, not control: clear roles, lightweight task-level triage, and quick wins that earn the credibility to govern the high-stakes work. That's a deliberate response to the higher-ed context — not an accident.

Context · Operating models

Centralized, federated, or decentralized?

There's no single right structure — only the right fit for your institution's size, culture, and risk. The three models trade control against autonomy in different ways.

Centralized
One office owns governance

A Data Governance Office sets and enforces standards for every domain. One accountable authority.

Strengths: consistency, clear authority, easier compliance.
Watch for: bottlenecks, distance from domain expertise.
Best when: high regulatory risk, smaller or single-campus institutions.
Federated
Shared standards, local execution

A central body sets common standards; domains and units govern their own data within them. The common middle ground.

Strengths: balances consistency with local ownership and buy-in.
Watch for: ambiguity over who decides what; needs strong coordination.
Best when: large, complex, or multi-college universities.
Decentralized
Each unit governs itself

Units set their own practices with little central coordination — often the de facto starting state, rarely a deliberate choice.

Strengths: maximum local autonomy and speed.
Watch for: inconsistent definitions, duplicated effort, compliance gaps.
Best when: rarely ideal — usually the baseline to mature away from.
How to choose

Match the model to your regulatory risk, institutional size, and culture. Most universities land on federated; smaller or highly-regulated institutions lean centralized. Whichever you pick, name it explicitly — the worst model is an accidental one. The public portal on this site demonstrates a centralized office in practice.

Sector reference · Data domains

The data domains of a university

Governance starts by naming the domains and their systems of record. Every domain needs a Trustee; every critical element should trace to one authoritative source.

The grouping below follows the CAUDIT Higher Education Reference Models (HERM) — an internationally adopted reference model that organizes a university's capabilities and information around its mission: the academic mission (learning, research, engagement) and the enabling functions that support it.

Learning & TeachingAcademic mission

Everything from prospect to alumnus — the student record at the core of the institution.

{{ d }}
ResearchAcademic mission

The full research lifecycle — funding, ethics, outputs, and the data they generate.

{{ d }}
EngagementAcademic mission

The institution's relationships beyond the classroom — alumni, donors, partners, and community.

{{ d }}
Enabling functionsSupporting the mission

The corporate and administrative domains every organization shares, plus the ones specific to running a campus.

{{ d }}

Systems of record & ownership

For the core administrative domains, the authoritative source and typical Trustee — the starting point for assigning accountability.

Domain
System of record
Typical Trustee
Sensitivity
Student & academic
Student Information System (SIS)
Registrar
Confidential (FERPA)
Enrollment & admissions
Admissions CRM
VP Enrollment
Restricted
Finance
ERP / General Ledger
CFO / Budget Director
Confidential
Human resources
HRIS / Payroll
CHRO
Restricted
Advancement & alumni
Advancement CRM
VP Advancement
Confidential
Research
Grants & IRB systems
VP Research
Restricted (varies)
Facilities
Space & asset systems
AVP Facilities
Internal
Health & wellness
EHR / clinic systems
Director, Health Services
Restricted (HIPAA)
IT & identity
IAM / directory
CIO / CISO
Restricted

Domain groupings follow the CAUDIT Higher Education Reference Models (HERM); Trustees and sensitivity tiers are typical defaults — confirm yours. The hardest data lives at the seams between domains (a student who is also an employee, an alum who was a research subject), which is why cross-domain ownership is defined explicitly in the framework.

Sector reference · Data standards

The standards that make data interoperable

Higher ed has shared data standards for reporting and system interoperability. Adopting them is how governed data moves between systems and out to the sector without re-mapping every time.

IPEDS
Federal reporting definitions (NCES) — the mandatory survey standard for enrollment, completions, and finance.
CEDS
Common Education Data Standards — a shared vocabulary for education data elements across systems and states.
PESC
Postsecondary Electronic Standards Council — transcript and admissions data exchange between institutions.
Ed-Fi
A common data model and API standard for integrating student data across operational systems.
1EdTech · LTI & Caliper
Standards for connecting learning tools (LTI) and capturing learning-activity data (Caliper Analytics).
OneRoster & SIF
Roster and systems-interoperability standards for moving class, enrollment, and grade data between platforms.
Why standards are a governance concern

A standard is a shared definition — exactly what the catalog and glossary enforce internally. Adopting sector standards means your governed definitions already line up with federal reporting and partner systems, turning compliance and integration from a yearly scramble into a byproduct of good governance.

Reference · Standards crosswalk

This framework, mapped to the standards

Nothing here is invented from scratch. This is a higher-ed-specific synthesis of established bodies of knowledge — recast in plain language and sized for institutions. The crosswalk below shows roughly where each part aligns with established standards, to help you orient the framework against what your peers already use.

A note on this crosswalk

These are high-level associations, not authoritative or certified mappings. They're meant to show roughly where this framework's ideas align with widely recognized standards — not to claim equivalence or compliance. Treat every entry as a starting point for your own review, and confirm specifics against the source material before relying on them.

The Data Management Body of Knowledge — the field's reference text.
CAUDIT Higher Education Reference Models — the sector-standard business & data reference architecture.
SP 800-53 & the Privacy Framework — US federal security and privacy controls.
EDM Council's Data Management Capability Assessment Model.
ISO/IEC 38505-1 — board-level governance of data; applies ISO/IEC 38500.
ISACA's enterprise IT-governance framework; APO14 is its Managed Data objective.
CMMI Data Management Maturity model — six categories, 25 process areas.
Roles & accountability
Trustees, Stewards, Custodians & the RACI.
DAMA-DMBoK
Data Governance & Stewardship
CAUDIT
Business Capability Model
NIST
PM & PL program management
DCAM
Data Governance / Org structure
ISO 38505
Responsibility; EDM model
COBIT 2019
EDM01 · APO01
CMMI DMM
Data Governance
Data catalog & metadata
Glossary, definitions, lineage, inventory.
DAMA-DMBoK
Metadata Management
CAUDIT
Data Reference Model
NIST
CM-8 system inventory
DCAM
Data Architecture & Cataloguing
ISO 38505
Data accountability map
COBIT 2019
APO14 Managed Data
CMMI DMM
Metadata Management
Access lifecycle
Request, approve, provision, review, revoke.
DAMA-DMBoK
Data Security Management
CAUDIT
NIST
AC access control family
DCAM
Data Security Management
ISO 38505
Acquisition; Conformance
COBIT 2019
APO13 · DSS05
CMMI DMM
Data Operations
Data quality
Rules, thresholds, monitoring, remediation.
DAMA-DMBoK
Data Quality Management
CAUDIT
NIST
SI integrity controls
DCAM
Data Quality Management
ISO 38505
Performance principle
COBIT 2019
APO11 · APO14
CMMI DMM
Data Quality
Classification
The four-tier sensitivity model.
DAMA-DMBoK
Data classification (Security)
CAUDIT
Data Reference Model
NIST
RA-2 / FIPS 199 categorization
DCAM
Data Governance
ISO 38505
Conformance principle
COBIT 2019
APO14 · APO13
CMMI DMM
Data Governance
Policy & standards
The documented rules of the program.
DAMA-DMBoK
Data Governance
CAUDIT
NIST
-1 policy controls (each family)
DCAM
Data Governance
ISO 38505
Direct (governing body)
COBIT 2019
EDM01 · APO01
CMMI DMM
Data Mgmt Strategy
Privacy of personal data
Consent, purpose limits, individual rights.
DAMA-DMBoK
Data Security & privacy
CAUDIT
NIST
Privacy Framework
DCAM
Data Governance
ISO 38505
Conformance; Human Behaviour
COBIT 2019
MEA03 · APO14
CMMI DMM
Data Governance
Technology enablement
The tooling that operationalizes governance.
DAMA-DMBoK
Data Architecture & Integration
CAUDIT
App & Technology Models
NIST
SA & SC system controls
DCAM
Technology Architecture
ISO 38505
Acquisition principle
COBIT 2019
APO03 · BAI
CMMI DMM
Platform & Architecture

— indicates the framework's scope does not address that area. CAUDIT HERM is a reference architecture (business, data & technology models), so it maps to the structural rows but not to governance controls such as access, quality, policy, or privacy.

Why the mapping matters

When an auditor, accreditor, or new CIO asks “what is this based on?”, you can point to seven recognized references rather than an internal opinion. The crosswalk also makes it easy to adopt a peer institution's artifacts — the vocabulary lines up.

Learn & practice · Scenarios & exercises

Make governance real by practicing it

Policy on a page changes nothing until someone applies it to a messy, specific situation. These exercises put governance into everyday decisions — most are ordinary judgment calls, not crises. Some are group discussions, some you can do solo in five minutes.

There's rarely one right answer; the value is in surfacing who decides, on what authority, and where the framework applies.

Group · 15–25 min
Case studies
Cross-discipline dilemmas. Cast the roles and argue it out.
Solo · 5 min
Quick calls
Everyday "what would you do?" judgment prompts with a model answer.
Solo or group
Hands-on builds
Classify data, write a definition, draft a RACI, map a lifecycle.
Group · 25 min
Incident tabletop
The emergency drill — one category among many, not the whole point.

Case studies for group discussion

Pick one, cast the disciplines around the table, read the situation, and work the questions together.

How to run a group case study
1 · Cast the roles
Assign each person one of the disciplines at the table. They argue from that seat.
2 · Read & react
Read the situation aloud. Each role gives their first instinct before any discussion.
3 · Work the questions
Debate the discussion prompts. Capture where you disagree — that's the gold.
4 · Compare to the framework
Reveal "what good governance looks like" and see what your group missed.
{{ scn.tag }}

{{ scn.title }}

{{ scn.situation }}

Who's at the table
{{ r }}
The tension

{{ scn.tension }}

Discussion questions
  • ?{{ q }}
Curveball — drop this in halfway

{{ scn.inject }}

What good governance looks like

{{ scn.resolution }}

Framework in play
{{ a }}

Facilitator tip: there are no trick answers. If your group reaches a different resolution than the framework suggests and can defend it on accountability and risk, that's a healthy governance culture — capture it and feed it back to the committee.

Quick calls — solo practice

Five-minute judgment checks for the choices people actually face at their desks. Decide your answer first, then reveal the governed one. No table required.

{{ q.tag }}

{{ q.prompt }}

{{ q.verdict }}

{{ q.answer }}

Practice by role

Role-specific training usually isn't a separate set of exercises — it's a lens. Run any case study above from a single role's seat: the learner answers only as that role, judged on that role's duties. Pick a role to see the questions it brings to every scenario, plus one exercise specific to it.

As the {{ lens.label }}, always ask

{{ lens.role }}

  • ?{{ q }}
Role-specific exercise
{{ lens.exerciseTitle }}

{{ lens.exercise }}

Run it offline

Download the facilitator pack — all six case studies plus the quick-call set, with roles, questions, curveballs, and answer keys, formatted for printing.

Toolkit · Templates

Take the framework and run with it

Concepts are only useful when someone can act on them. These are the working artifacts the framework refers to — ready to download, adapt to your institution, and put to use.

Each downloads as a ready-to-print PDF you can adapt to your institution. They're starting points, not finished policy — replace the bracketed placeholders and run them past your Counsel and Privacy Office.

{{ t.kind }}
{{ t.title }}

{{ t.desc }}

Get the whole set

Download every template together as a single starter kit you can drop into a shared drive.

Reference · Further reading

What this framework is built on

This framework synthesizes established bodies of practice rather than inventing its own. These are the foundational sources — for those who want to go deeper or cite the basis.

Data management
DAMA-DMBoK

The Data Management Body of Knowledge — the reference model placing governance at the hub of the data disciplines.

Higher-ed community
EDUCAUSE

Research, toolkits, and the data-governance community of practice for higher education IT and analytics.

Maturity model
Stanford DG Maturity Model

The 2011 higher-education maturity model underpinning this site's assessment dimensions.

Institutional research
AIR

The Association for Institutional Research — standards and ethics for data use in decision support.

Security & risk
NIST CSF & SP 800-61

The Cybersecurity Framework and incident-handling guide behind this site's protection and incident response.

Process maturity
CMMI

The Capability Maturity Model lineage behind the five-level maturity scale used throughout.

Reference model
CAUDIT HERM

The Higher Education Reference Models — capability and information models organizing the institution by mission. Basis for the data-domains map.

Links and citations are intentionally generic — add your institution's licensed editions and internal references. This framework adapts these sources to a higher-education context; it does not reproduce them.

Reference · About & sharing

Use this, build on it, credit the source

This framework is meant to be shared. Any higher-education institution is welcome to use and adapt it for their own non-commercial purposes — under an open license, with attribution.

Authorship & ownership

The conceptual framework, its structure, the selection of what to include and exclude, the sequencing, and the curation reflect the professional and scholarly judgment of Joe Sabado — a data governance practitioner and scholar.

Copyright in that original selection, arrangement, and expression is retained by the author. Joe Sabado | CampusAIExchange.com.

Developed with AI

This website and its prose were developed with the assistance of AI tools used for drafting and production, under the author's direction.

The author directed the work, reviewed and edited the output, and is responsible for the final content. The intellectual structure and editorial decisions are the author's; AI was an assistive tool, not the author.

Built on established work

This framework synthesizes and adapts established bodies of practice — including DAMA-DMBoK, the NIST Cybersecurity Framework and SP 800-61, the CAUDIT Higher Education Reference Models, the Stanford data-governance maturity model, and EDUCAUSE community work. The original contribution is the synthesis, structure, and application to a higher-education context, not the underlying concepts, which remain the work of their respective authors (see Further reading).

License

Creative Commons BY-NC-SA 4.0 Free to use · Non-commercial

You are free to share and adapt this material, provided you follow these terms:

BY — Attribution
Give credit to the author, link to the license, and note any changes you made.
NC — NonCommercial
You may not use the material for commercial purposes.
SA — ShareAlike
If you adapt it, distribute your version under this same license.

Full license: creativecommons.org/licenses/by-nc-sa/4.0/  ·  This is a human-readable summary, not the license itself.

How to attribute

When you use or adapt this work, include a credit like:

"Data Governance Framework for Higher Education" by Joe Sabado (CampusAIExchange.com), licensed under CC BY-NC-SA 4.0. Adapted from the original.
Suggested citation

For scholarly or formal reference:

Sabado, J. (2026). Data Governance Framework for Higher Education. CampusAIExchange.com. Retrieved from campusaiexchange.com
Names & logos are not licensed

The CC license covers the framework content. It does not grant rights to the author's name, "CampusAIExchange," or any logos, marks, or branding, which remain reserved.

Provided as-is — not legal advice

This material is offered for general guidance and orientation. It is provided without warranty and is not legal, compliance, or professional advice. Confirm applicability and obligations with your own counsel, privacy office, and leadership.

Data Governance Framework

A standard set of governance concepts, roles, and processes for higher education — the foundation for how data is managed, protected, and applied to projects across the institution.

Joe Sabado  |  CampusAIExchange.com  ·  Licensed CC BY-NC-SA 4.0  ·  Developed with AI assistance