Make data governance real on your campus.

Three ways in: pick your lane

The same page serves whoever opens it. Skim the lane that fits you now, then scroll into the full depth below: nothing is walled off, and it's one link to forward to anyone else.

Everything in this resource

A working reference and playbook for higher-ed data governance, from the case for it to the roles, tools, and exercises that make it real. Jump straight to any part.

The case for data governance

Every consequential decision this institution makes (who we admit, where we spend, how we retain students, what we tell accreditors) rests on data. Governance is what makes that data trustworthy. Without it, leaders are deciding on numbers no one can fully stand behind.

This is a short brief for sponsors and funders. Hand it to a president, provost, CFO, or CIO who needs the why in two minutes.

The cost of doing nothing

Ungoverned data isn't free: the cost is just hidden, paid in staff time, risk, and bad decisions.

What it looks like on campus

Three composite snapshots. Each combines patterns common across institutions; none describes a single campus.

What governance delivers

Funded governance pays back across mission, risk, and efficiency.

Pair this brief with the Implementation roadmap (the phased plan) and Metrics & KPIs (how we'll show progress) when you take it to leadership.

The pushback you'll hear: answered

Every governance program meets the same handful of objections. They're worth taking seriously: most contain a grain of truth about programs done badly. Below is a straight answer to each: the version you can say in a meeting.

Notice the pattern: nearly every objection assumes governance means control. It doesn't. It means clarity about who decides, and that's what makes work faster, not slower.

What the governance program stands on

Before any project applies governance, three things are fixed: the goals it serves, the objectives it pursues, and the principles every decision is measured against.

Govern in proportion to context

There is no single correct amount of governance. A liberal-arts college of 2,000 and an R1 research university with a medical center need very different programs. Proportionality means scaling governance to fit the institution (its size, mission, risk, capability, and resources) rather than imposing one rigid model and hoping it sticks.

Over-govern, and the program collapses under its own ceremony: committees no one attends, policies no one reads. Under-govern, and risk goes unmanaged. Proportionality is how you find the level an institution will actually sustain.

What to weigh

Six dimensions calibrate how much structure a program needs. Weigh them honestly before adding any committee, policy, or control.

How a program scales

The same five components appear at every size: what changes is their weight. The right level is rarely the most elaborate one; it's the heaviest one you can keep running.

Before you add a control, ask

Three questions keep a program proportional as it grows. If a proposed rule fails them, it's ceremony, not governance.

How data governance meets the rest

Data governance never operates alone. It shares borders with IT, security, privacy, risk, research, and more. Drawing those borders clearly prevents the two failures that quietly sink programs: gaps, where no one owns a decision, and turf wars, where everyone does.

A simple rule keeps the lines straight: data governance owns the data itself: its meaning, classification, ownership, and access policy. Neighboring domains own the systems it runs on, the uses it's put to, the risk it carries, or the people it concerns. Most friction is a boundary that was never drawn.

The neighboring domains

Each owns its own territory and shares a seam with data governance. The seam is where a handoff has to be explicit.

Three ways a boundary works

Every shared border resolves into one of three relationships. Naming which one applies is what turns an argument into a workflow.

Research data plays by different rules

Research data is the single feature that most distinguishes a university from any other organization, and the place standard data governance most often gets it wrong. It carries authorities your governance program does not control: an IRB, a funder, an export regime, a principal investigator. Treat it like administrative data and you will either break the law or break the research.

The right posture is humility about the boundary: data governance provides the shared infrastructure and standards, and steps back where research-specific authority takes over. This page draws that line.

Why it's different

Four traits set research data apart from the student, financial, and HR data the rest of the framework addresses.

Where the line falls

Data governance does not govern research data: it supports it. The split is clean once named.

The research-data lifecycle

Governance attention shifts at each stage, and the handoffs are where data is lost, leaked, or stranded.

Governance is not data management

Governance sets the rules. Management carries them out. Governance covers authority and accountability. Management covers the hands-on work of moving, storing, and securing data.

Test: "Who decides?" is governance. "How do we do it?" is management.

How they relate

Governance without management sits on a shelf. Management without governance is inconsistent and risky.

{{ cd.name }}

{{ cd.summary }}

{{ cd.detail }}

Where does governance live?

Before roles can be filled, an institution has to decide how to structure the program, including whether to fold it into existing IT governance or stand it up another way. Drawn from how higher-education institutions actually organize, four options recur, each trading control for autonomy differently.

Most programs blend these and shift over time: many also go hybrid, centralizing governance for high-risk data (student PII, FERPA-protected records) while decentralizing low-risk data.

Who does what, top to bottom

Direction and standards flow down. Issues escalate up. Select a role.

Governance is everyone who touches data

The named roles (Trustees, Stewards, Custodians) set and run the program. But every faculty member, administrator, student worker, and analyst who creates, uses, or shares data is a data citizen. The best policy fails if the person with the spreadsheet doesn't follow it.

End users don't need a title or training certificate to participate. They need to know a handful of everyday responsibilities, and where to go when a decision is above their pay grade.

Every data citizen's responsibilities

Six habits that make governance real at the point where data is actually handled.

A spectrum of participation

Governance isn't a department: it's a continuum from setting the rules to following them. Everyone sits somewhere on it.

How mature is your governance?

Maturity is a ladder, not a switch. This five-level scale is adapted from the Capability Maturity Model and Stanford's higher-education data-governance maturity model: moving from ad hoc practice to continuous improvement.

Rate your institution on each dimension below to see an overall level and where to focus next. Your ratings are saved on this device.

Grounded in the Capability Maturity Model (CMMI), Stanford University's Data Governance Maturity Model (2011) for higher education, and the DAMA-DMBoK reference framework, which places data governance at the hub of the data-management disciplines this assessment samples.

How do we know it's working?

Governance earns its keep when it changes outcomes. Track a small, balanced set of measures across five pillars: each with a leading indicator (effort, early signal) and a lagging indicator (realized result).

Start narrow: one leading and one lagging metric per pillar gives leadership a view of both activity and impact without drowning stewards in reporting.

Targets should be set per institution against a baseline: a metric without a baseline and a threshold is just a number. Review leading indicators monthly with stewards and lagging indicators quarterly with the governance committee.

One vocabulary, shared by everyone

Good governance starts with shared definitions. These are the terms used across this site and in day-to-day practice. Press ⌘K anywhere to look one up.

{{ versionStamp }}

See the framework at work, at every level

The same governance framework scales from a campus-wide initiative, to a single project, down to an everyday task. Pick a level to browse worked examples: each one opens the full walkthrough.

From data literacy to fluency

Governance sets the rules; capability is whether people can actually work within them. That capability isn't one thing: it grows along a path from literacy (you can read and question data) through competency (you can do your role's data work correctly) to fluency (you reason and lead with data as second nature).

Not everyone needs fluency, and that's the point: the target level depends on the role. A faculty member needs literacy; a Steward needs domain competency; an analyst or data leader needs fluency. Naming the target is what makes training purposeful rather than generic.

The progression

Three stages, each building on the one before. People move up as their responsibilities grow.

Literacy is the floor for everyone who touches institutional data. Competency and fluency are reached by role, and they're a moving target as tools (and AI) change what "using data well" means.

Target capability by role

What level each role should reach, and the specific competencies that define it. Set these as expectations, then train toward them.

Training for every governance role

Six roles carry the framework. Each module covers what the role is accountable for, the do’s and don’ts that matter most, a get-started path, step-by-step playbooks, worked scenarios from the use-case library, and a scored knowledge check. Pick a role to begin.

Follow the governance lifecycle

With the checklist answered, this is the repeatable lifecycle every initiative follows. Each step calls on the components and roles from the framework. Follow one initiative through all seven steps, then switch to a multi-domain initiative to see what changes when the data crosses boundaries.

The starter is a ready-to-fill checklist and RACI skeleton for the selected initiative: open it in any editor and assign owners.

Govern the small stuff, not just the big launches

Most data decisions never become a project. A spreadsheet lands in your inbox, someone asks for a one-off export, a duplicate record turns up. The same framework still applies: compressed into a two-minute call. This is governance at the size of a single task, where it most often quietly breaks.

Common situations, answered

Pick a situation to see the governed call: its classification, who decides, the rule, and exactly what to do.

What should I do with this data?

Answer three quick questions about a dataset and get its classification tier, how to handle it, and who to ask. This turns the classification rules into a thirty-second decision you can make at your desk.

Guidance only: the Data Trustee for the domain makes the final call and records it in the catalog. When two answers point in different directions, the higher tier wins.

Governing data in the age of AI

AI doesn't replace data governance: it raises the stakes. A model is only as trustworthy as the governed data behind it, and a system that acts on data autonomously needs every component of the framework working. The same five components apply; AI just stretches each one.

Governance doesn't move to a new home for AI: it reaches into the model lifecycle: the data a model learns from, the data it can touch at run time, and the actions it's allowed to take.

What makes AI different

Traditional systems are deterministic and legible: a report runs the same query every time, and you can read exactly what it did. AI breaks those assumptions: six properties demand consideration that conventional data systems never required.

How the five components apply to AI

Each component you already know extends naturally to models and the data that feeds them.

Four tiers, one handling rule each

Every data element carries a classification. The tier sets who may see it, how it must be stored and shared, and what happens if it's exposed. When in doubt, classify up: the higher tier always wins.

Classification is assigned by the Data Trustee for a domain and recorded in the catalog alongside each asset.

Try it: combine fields into a dataset

A dataset takes the highest tier of any field in it. Add or remove fields to see the result.

The artifacts the framework refers to

Every policy has a named owner and a review cadence. A policy without a current review date is treated as out of date.

The laws and regulations governance must satisfy

A university holds student, employee, financial, health, and research data: each with its own rules. Governance doesn't replace these obligations; it's how the institution meets them consistently.

Orientation only, not legal advice. Your Office of General Counsel and Privacy Office determine what applies and how.

Does the EU AI Act apply to US higher ed? Not as a blanket rule, but it reaches US institutions situationally (EU-used output, EU learners, EU operations) much like GDPR, and education uses are largely high-risk under it. Treat it as both a possible obligation for global programs and a de facto benchmark. Counsel determines scope per system; this is orientation, not legal advice.

The front door

Four standard requests cover almost everything people need from governance. Each routes to the right steward and follows a defined turnaround.

If data is exposed, move in this order

A data incident is any unauthorized access, loss, or disclosure. Speed matters most in the first hours, contain first, investigate second.

Suspected incident? Notify the Privacy Office and CISO immediately: do not wait until you're sure.

Grounded in NIST SP 800-61r2 (Computer Security Incident Handling Guide) and the NIST Cybersecurity Framework. Notification obligations follow FERPA, GDPR where applicable, and state breach-notification law: your Privacy Office and Legal counsel set the binding timelines.

Governance happens in four phases

You don't stand up governance all at once. Each phase delivers value while building toward the next. Most institutions spend 12–24 months reaching steady state.

Quick answers

Match your question to a role

Governance is people, not just policy. Below is who owns what. Fill in the names for your institution.

Why data governance is uniquely hard in higher education

Universities aren't corporations. Authority is shared, data is scattered across decades of systems, and the culture prizes autonomy. A governance framework that ignores this context fails on contact: these are the realities it has to work within.

Naming the obstacles up front is what separates a framework that's adopted from one that sits on a shelf.

Centralized, federated, or decentralized?

There's no single right structure, only the right fit for your institution's size, culture, and risk. The three models trade control against autonomy in different ways.

What do we govern, and how do we find it?

Before a single policy applies, you need an honest inventory: which systems, data, reports, and flows exist, who touches them, and which ones matter enough to govern. This is discovery: the unglamorous work that makes every later metric legible.

You will never catalog everything, and you shouldn't try. Scope to the vital few (the assets that carry risk, feed decisions, or cross unit boundaries) and expand from there.

1 · What counts as an asset

“Data asset” is broader than a database. Five categories together describe what a governance program actually oversees.

2 · How to find them

Discovery is triangulation, not a single scan. Run these five passes: each surfaces assets the others miss.

3 · How to define a domain

A data domain is a grouping of related data that a single owner can be accountable for. Draw the boundary around the subject, not the system or the org chart. A well-drawn domain passes five tests.

4 · Deciding what's in scope

You can't govern all of it at once. An asset earns a place in scope when it meets one or more of these tests, and you sequence by risk × reuse.

Everything else is in the catalog but lightly governed until a reason to invest appears. Proportionality applies here too: scope is a dial, not a switch.

The data domains of a university

Governance starts by naming the domains and their systems of record. Every domain needs a Trustee; every critical element should trace to one authoritative source.

The grouping below follows the CAUDIT Higher Education Reference Models (HERM): an internationally adopted reference model that organizes a university's capabilities and information around its mission: the academic mission (learning, research, engagement) and the enabling functions that support it.

Where domains meet

Most governance disputes happen at the seams, where several domains use one record. Select a seam to see what crosses it and who settles it.

Systems of record & ownership

For the core administrative domains, the authoritative source and typical Trustee: the starting point for assigning accountability.

Domain groupings follow the CAUDIT Higher Education Reference Models (HERM); Trustees and sensitivity tiers are typical defaults: confirm yours. The hardest data lives at the seams between domains (a student who is also an employee, an alum who was a research subject), which is why cross-domain ownership is defined explicitly in the framework.

The standards that make data interoperable

Higher ed has shared data standards for reporting and system interoperability. Adopting them is how governed data moves between systems and out to the sector without re-mapping every time.

This framework, mapped to the standards

Nothing here is invented from scratch. This is a higher-ed-specific synthesis of established bodies of knowledge: recast in plain language and sized for institutions. The crosswalk below shows roughly where each part aligns with established standards, to help you orient the framework against what your peers already use.

— indicates the framework's scope does not address that area. CAUDIT HERM is a reference architecture (business, data & technology models), so it maps to the structural rows but not to governance controls such as access, quality, policy, or privacy.

Make governance real by practicing it

Policy on a page changes nothing until someone applies it to a messy, specific situation. These exercises put governance into everyday decisions: most are ordinary judgment calls, not crises. Some are group discussions, some you can do solo in five minutes.

There's rarely one right answer; the value is in surfacing who decides, on what authority, and where the framework applies.

Case studies for group discussion

Pick one, cast the disciplines around the table, read the situation, and work the questions together.

Facilitator tip: there are no trick answers. If your group reaches a different resolution than the framework suggests and can defend it on accountability and risk, that's a healthy governance culture: capture it and feed it back to the committee.

Take the framework and run with it

Concepts are only useful when someone can act on them. These are the working artifacts the framework refers to: ready to download, adapt to your institution, and put to use.

Each downloads as a ready-to-print PDF you can adapt to your institution. They're starting points, not finished policy: replace the bracketed placeholders and run them past your Counsel and Privacy Office.

What this framework is built on

This framework synthesizes established bodies of practice rather than inventing its own. These are the foundational sources, for those who want to go deeper or cite the basis.

Links and citations are intentionally generic: add your institution's licensed editions and internal references. This framework adapts these sources to a higher-education context; it does not reproduce them.

What this site is, and how to read it

A reference and playbook for data governance in higher education: the concepts, roles, processes, and tools an institution needs to manage, protect, and use its data. The core idea: governance becomes real when a named person is accountable for each domain of data, using a few components and principles scaled to risk.

It's written for the sector, not one campus: a shared vocabulary and starting point, not a rulebook.

How it's organized

{{ aboutGroupCount }} parts. Open any one, or see the full section-by-section map on the overview.

Related frameworks

Data governance is the foundation trustworthy AI is built on. These companion resources by the same author cover the AI side.

Status

Use this, build on it, credit the source

This framework is meant to be shared. Any higher-education institution is welcome to use and adapt it for their own non-commercial purposes: under an open license, with attribution.

License