How do I assess my organization's information governance maturity and figure out the next level to target?

Assessing information governance (IG) maturity means taking an honest, evidence-based look at how well your organization creates, manages, protects, and disposes of information—and then setting a realistic target for improvement. Maturity assessment is a planning exercise, not a grade. The goal is to know where you stand and what to do next.

Pick a frame of reference

Most maturity models describe a progression along similar lines:

• Ad hoc / minimal — practices are informal, inconsistent, and undocumented.
• Developing — some policies exist but adoption is uneven.
• Defined / essential — policies, schedules, and roles are documented and broadly followed.
• Managed / proactive — practices are monitored, measured, and integrated into operations.
• Optimized / transformational — IG is continuously improved and supports broader business goals.

Recognized standards such as ISO 15489 and professional frameworks from bodies like ARMA International offer principles—accountability, transparency, integrity, protection, compliance, availability, retention, and disposition—you can score against.

Gather the evidence

Assess across people, process, and technology rather than relying on impressions:

• Policy and accountability — Do you have current records and retention policies? Is someone clearly responsible?
• Retention and disposition — Is there an approved retention schedule, and is it actually applied?
• Coverage — Does governance reach email, collaboration tools, and cloud systems, or only paper and shared drives?
• Legal and regulatory fit — Can you meet recordkeeping, privacy, and legal-hold obligations on demand?
• Training and culture — Do staff understand their responsibilities?

Interview stakeholders, review documentation, and sample real systems to confirm that stated practices match reality.

Choose the next level to target

Score each area against your chosen model and look for the lowest, highest-risk gaps first. Aim for the next level, not the top one—maturity advances one rung at a time. A practical target is specific and measurable: for example, “approve and publish a retention schedule covering all record series within twelve months.”

Prioritize areas where weakness creates the most legal, financial, or operational exposure. Document your baseline so you can reassess on a regular cycle and demonstrate progress over time.

For broader context on principles, roles, and program building, see the information governance topic hub.