Purpose
Compare an organization's current data governance practices against a structured six-pillar framework and produce a prioritized gap register — each gap scored for severity and business risk, with a phased remediation roadmap — so leaders know exactly what is missing, what to fix first, and why it matters.
When to Use
Invoke this skill when the user asks to:
- Audit or assess an existing data governance program against best practice
- Identify what's missing before a regulatory audit or maturity assessment
- Build the business case or roadmap for governance investment
- Diagnose recurring data quality, access, or compliance problems
- Prioritize which governance capabilities to build first with limited resources
- Establish a baseline before standing up a new governance function
Inputs Required
Before starting, collect:
- Current practices: Description of how governance works today across any of the six pillars — even partial or informal
- Organization size & data footprint: Headcount, number of key systems/data domains, on-prem vs. cloud
- Regulatory scope: Which regimes apply (GDPR, CCPA, HIPAA, SOX, PCI-DSS, industry-specific)
- Existing roles & tooling: Any named data owners/stewards, catalog, quality, or lineage tools in place
- Known pain points: Incidents, audit findings, or complaints that prompted this review
- Program maturity goal: Where they want to be (foundational / managed / optimized) and by when
If regulatory scope or maturity goal is missing, assume GDPR/CCPA applicability and a "foundational to managed" target, and note the assumption.
Instructions
Step 1: Map Current State Across the Six Pillars
For each pillar, extract what exists today from the inputs and classify it. Do not assume absence — flag as "Unknown" if the input is silent rather than scoring it as a gap.
Pillar 1 — Ownership Accountable data owners assigned to domains, decision rights defined, governance council/committee exists with a charter.
Pillar 2 — Stewardship Operational stewards named per domain, defined responsibilities, business glossary/definitions maintained, steward time formally allocated.
Pillar 3 — Lineage Data flows documented from source to consumption, transformations tracked, impact analysis possible, lineage automated vs. manual.
Pillar 4 — Quality Quality dimensions defined (accuracy, completeness, timeliness, consistency, validity, uniqueness), SLAs/thresholds set, monitoring in place, remediation workflow exists.
Pillar 5 — Access Role-based access control, least-privilege enforcement, access review cadence, classification/sensitivity tiers, provisioning/deprovisioning process.
Pillar 6 — Compliance Regulatory obligations mapped to controls, retention/deletion policies, consent/subject-rights handling, audit trail, evidence collection for auditors.
For each pillar, assign a maturity level: Absent / Ad hoc / Defined / Managed / Optimized.
Step 2: Identify Gaps Against Best Practice
For each pillar, compare current maturity to the target maturity level. Write each gap as a discrete, specific finding — not "improve quality" but "no defined completeness thresholds for customer records; errors surface only at reporting time."
Every gap must state:
- What exists now (current state)
- What best practice requires (target state)
- The delta (the specific missing capability)
Step 3: Score Severity and Business Risk
Rate each gap on two axes:
- Severity (Critical / High / Medium / Low):
- Critical — active regulatory exposure, unmanaged access to sensitive data, or no accountability for a regulated domain
- High — recurring quality/trust failures affecting decisions, or missing controls an auditor would flag
- Medium — inefficiency or manual workaround that scales poorly
- Low — hygiene or documentation gap with limited near-term impact
- Business risk statement: One sentence naming the concrete consequence (fine, failed audit, wrong decision, breach, rework cost).
Weight compliance and access gaps upward where regulatory scope is high.
Step 4: Prioritize
Order all gaps by a priority score combining severity and remediation effort (Low/Medium/High effort). Surface quick wins (high severity, low effort) explicitly — these lead the roadmap.
Step 5: Build a Phased Remediation Roadmap
Group prioritized gaps into three horizons:
- Phase 1 — Stabilize (0–90 days): Critical gaps and quick wins; assign owner accountability, close the highest regulatory exposure
- Phase 2 — Operationalize (3–9 months): Standing up stewardship, quality monitoring, lineage, access review cadences
- Phase 3 — Optimize (9+ months): Automation, metrics/dashboards, continuous improvement
For each phase, state the outcome achieved and the pillars advanced.
Output Format
- Structure: Current-state maturity summary table → gap register table → prioritized quick wins → phased roadmap
- Length: 1,000–1,400 words
- Format: Tables for the maturity summary and gap register; numbered/grouped lists for roadmap
- Sections: Six-Pillar Maturity Summary → Gap Register (with severity + risk) → Quick Wins → Phased Remediation Roadmap → Executive Summary (3–4 sentence bottom line)
- Tone: Director-level, evidence-based, direct — states risk plainly without alarmism; every finding is actionable
Quality Checklist
Before delivering output, verify:
- [ ] All six pillars are assessed and assigned a maturity level (count them)
- [ ] Every gap includes current state, target state, and the specific delta — no vague "improve X" findings
- [ ] Every gap has both a severity rating and a one-sentence business risk statement
- [ ] Silent inputs are marked "Unknown," not scored as gaps by default
- [ ] Gaps are ranked by priority, and quick wins (high severity / low effort) are called out explicitly
- [ ] The roadmap sorts every prioritized gap into one of the three phases with a stated outcome
Notes
- Ownership and accountability gaps are almost always the root cause behind quality, access, and compliance failures — resolve owners first, or downstream fixes won't hold
- When regulatory scope is broad, treat any unmanaged access to sensitive data as Critical regardless of stated maturity
- If the current-state description is thin, a maturity summary heavy on "Unknown" is itself a finding — recommend a discovery workshop as Phase 1 action zero
- Resist over-scoping Phase 1; stabilization only succeeds when it targets the two or three gaps that carry the most risk
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills