You've spent the last unit measuring whether individual data is trustworthy. Now zoom out. How do you measure whether the governance effort itself is working? Picture a colleague telling you in the hallway that the program is "maturing nicely." What would you need to see to believe that, or to gently disagree? That question is the whole point of this unit: replacing the warm feeling of progress with something you can actually point to.

Here's the trap most people fall into: they treat maturity as one number, or worse, one gut feeling. But "mature" is as vague as "good data" was last unit. Mature at what?

The Five-Level Maturity Model gives you a ladder to answer that. At the bottom is Initial, where things only work through individual heroics and luck, with nothing consistent. Next is Managed, where a few habits repeat but nobody has written them down. Then Defined, where the practice is documented and standard. Then Measured, where you actually track whether it's working. And at the top, Optimizing, where you deliberately improve it over time.

But a ladder of what, exactly? That's where the Maturity Dimensions come in: five areas you rate separately. There's people and roles (does anyone actually own decisions?), process and decision forums (do issues get resolved in a regular rhythm, or only when someone panics?), data and artifacts (glossaries, catalogs, standards that genuinely exist), policy and standards (written and adopted, or just aspirational?), and enablement or adoption (do people know about any of this and use it?).

Here's why splitting them matters. A team can be surprisingly advanced in one dimension and primitive in another: a polished glossary for one domain (early Defined on data) while nobody is accountable for any decision (Initial on people). Anyone who says "we have a glossary, so we're mature" has rated one dimension and assumed the rest. The dimensions force the sharper question: mature where?

Now the harder problem: how do you assign a level without it becoming a popularity contest? Because the moment you ask people to rate themselves, optimism creeps in, and effort gets confused with progress.

• Dan: Honestly, I'd say our customer domain is pretty mature. We've been at this a while.
• Natalie: What makes it mature? If I asked who owns the customer definition, could you name one person?
• Dan: Well, a few of us kind of share it.
• Natalie: Then that's the signal. "A few of us, kind of" is informal ownership, which reads as Initial, not mature. No knock on the work, it's just where the evidence points.
• Dan: Fair. I was rating how much effort we've put in, not what's actually in place.

Notice what Natalie did: she refused the feeling and asked for the artifact. That's the core move of a lightweight maturity assessment. This is a starter self-check, not a formal program audit, so you don't need a heavy questionnaire. You do need to ground every rating in something you can point to: a named owner, a meeting that genuinely happens on a cadence, a glossary entry you can open, a policy people actually follow. If a rating rests on "we're pretty good at this," it isn't a rating yet, it's a hope.

And honest, low ratings are far more useful than flattering ones. A defensible Initial tells you exactly where to aim. An inflated Defined tells you nothing and quietly sets you up to be wrong in front of leadership later.

So your assessment is done and it's full of gaps. Tempting to attack the biggest one. But is the biggest gap really the right first move?

The Impact-Effort-Readiness Lens says weigh each opportunity across five questions, not one. How much business impact would fixing it create? How much effort would it take? How much risk does it reduce? How ready are the stakeholders to actually do it? And what does it depend on that has to come first? A high-impact fix that nobody is ready for, or that depends on a role you haven't named yet, is not a good first move no matter how big the payoff looks.

This is where dependencies bite. You can't standardize a definition before someone owns the decision to set it. So formalizing roles often outranks flashier work, not because it scores highest on impact alone, but because everything else waits on it. The discipline is to make your reasoning visible: name what you'd do first, and name what you're deliberately deferring, and why.

So the takeaway for this unit: maturity is not one number but five honest, evidence-backed signals, and the right next move is whichever fixable gap the organization is actually ready to close. Next you'll work through a few short scenarios and decide which maturity level the evidence truly supports, then write a full assessment and a prioritized shortlist of your own. As you sort them, sit with this: when you rate your own work, how often are you scoring what's actually in place versus how hard you've tried?