Study guide
2.3 Policies, Standards, and Procedures
DAMA Certified Data Management Professional CDMP
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: Exam Overview & DMBoK Framework
1.1 CDMP Exam Details & Strategy 1.2 The DMBoK Framework 1.3 Data Management Organization & Roles
2 Chapter 2: Data Governance (Part A)
2.1 Data Governance Principles & Drivers 2.2 Operating Models & Structures 2.3 Policies, Standards, and Procedures
3 Chapter 2: Data Governance (Part B)
2.4 Data Stewardship 2.5 Governance Metrics & Implementation
4 Chapter 3: Data Modeling and Design (Part A)
Section 3.1: Conceptual, Logical, and Physical Models Section 3.2: ERD Notations & Relational Modeling Section 3.3: Normalization
5 Chapter 3: Data Modeling and Design (Part B)
3.4 Dimensional Modeling 3.5 Naming Standards & Modeling Best Practices
6 Chapter 4: Data Quality (Part A)
Section 4.1: Data Quality Dimensions Section 4.2: Data Quality Policy & Rules Section 4.3: DMAIC & DQ Improvement Lifecycle
7 Chapter 4: Data Quality (Part B)
4.4 Root-Cause Analysis & Remediation 4.5 DQ Metrics, Tools, and Reporting
8 Chapter 5: Metadata Management (Part A)
5.1 Business, Technical, and Operational Metadata 5.2 Metadata Lineage & Impact Analysis 5.3 Repository Architectures
9 Chapter 5: Metadata Management (Part B)
5.4 Standards and Semantics 5.5 Metadata Governance & Integration
10 Chapter 6: Master and Reference Data Management
6.1 Master vs Reference Data 6.2 MDM Repository Architectures 6.3 Match-Merge & Identity Resolution 6.4 Reference Data Governance & Standards
11 Chapter 7: Data Warehousing and Business Intelligence
7.1 DW Architectures: Inmon vs Kimball 7.2 Data Warehousing Storage & Load Patterns 7.3 BI Delivery & OLAP 7.4 Data Marts & Enterprise Data Warehouses
12 Chapter 8: Data Architecture
8.1 Enterprise Data Architecture & Zachman Framework 8.2 Data Flow Diagrams & Value Chains 8.3 Architecture Frameworks & Standards
13 Chapter 9: Document and Content Management
9.1 Records Management & ECM 9.2 Retention, Disposal, and E-Discovery 9.3 ARMA GARP Principles & Taxonomies
14 Chapter 10: Data Integration and Interoperability
Section 10.1: Integration Patterns & Technologies Section 10.2: Replication & Virtualization Section 10.3: Canonical Models & Integration Standards
15 Chapter 11: Data Security
Section 11.1: Security Principles: CIA Triad & Privacy Section 11.2: Access Control & Encryption Section 11.3: Security Regulations & Standards
16 Chapter 12: Data Storage and Operations
Section 12.1: Database Technologies & DBA Roles Section 12.2: Backup, Recovery, and High Availability Section 12.3: Performance Tuning & Operations
17 Chapter 13: Big Data and Data Science
13.1 Big Data V's & Technologies
18 Chapter 14: Data Ethics
14.1 DMBoK Data Ethics Framework
19 Chapter 15: Data Management Process and Maturity
15.1 Maturity Assessment Frameworks
2.3 Policies, Standards, and Procedures
Key Takeaways Explain This Topic AI
Policies are mandatory, high-level strategic statements of what must be done and why, whereas standards are mandatory, detailed rules of how policies are executed.
Procedures provide step-by-step instructions for executing specific operations, while guidelines offer non-mandatory recommended best practices.
The policy lifecycle is a continuous process involving identification, drafting, stakeholder review, formal council approval, communication, compliance monitoring, and periodic updates.
Waiver management is a critical governance control that allows projects to deviate from standards under strict justification, time limit, and Data Owner approval.
Last updated: July 2026
- Policies, Standards, and Procedures in Data Governance
- 1. The Hierarchy of Governance Documentation
A key task of Data Governance is establishing clear, formal documentation that outlines the rules of the road for data management. Organizations must maintain a strict hierarchy of governance documents, moving from high-level, business-aligned strategies down to granular, technical instructions.
Document Type Mandate Level of Detail Primary Approver Example
Policy Mandatory High-level (What & Why) Data Governance Council (DGC) Data Retention Policy : All customer data must be retained for 7 years post-account closure.
Standard Mandatory Medium-level (Rules for How) Steering Committee / Lead Stewards Naming Standard : Column names must use snake_case and end with a standard class word (e.g., _date , _amt ).
Procedure Mandatory Low-level (Step-by-Step) Process Owners / Data Custodians Archiving Procedure : Steps to run the automated script to move legacy data to cold storage.
Guideline Recommended Low-level (Best Practices) DGO / Subject Matter Experts Data Cataloging Guideline : Best practices for writing clear business descriptions in the glossary.
Understanding this hierarchy is critical for the CDMP exam. A common point of confusion is conflating policies and standards. Policies state what must be done and why , driven by business strategy and regulatory compliance. Standards define the specific requirements and constraints that must be followed to satisfy the policy.
2. The Policy Lifecycle
Policies are not static documents; they must follow a structured lifecycle overseen by the Data Governance Office (DGO) :
Identify & Draft : A business need or regulatory requirement triggers the policy creation. For example, GDPR mandates a policy regarding the 'Right to be Forgotten.' The DGO and relevant Data Stewards collaborate to draft the policy.
Review & Align : The draft is circulated among key stakeholders—including Legal, compliance, Information Security, IT, and business division leaders—to identify operational impacts and ensure alignment with existing corporate rules.
Formal Approval : The policy is submitted to the Data Governance Council (DGC) . Once approved by the council, it becomes an official corporate policy with mandatory enforcement.
Communicate & Implement : The policy is published in a central, accessible repository (such as the intranet or data catalog). Training and awareness campaigns are launched to ensure employees understand their responsibilities.
Monitor & Enforce : The DGO, along with internal audit, monitors operational compliance. This involves analyzing metrics and assessing whether systems are adhering to the rules.
Review, Update, & Retire : Policies are reviewed periodically (at least annually) to adapt to changing technologies, business models, or laws. If a policy is no longer relevant, it is officially retired.
3. Types of Data Standards
Standards bridge the gap between abstract policy and operational database reality. Key types of data standards include:
Data Naming Standards : Define the rules for naming data elements in business glossaries and physical databases. A common methodology is the Prime Word - Modifier - Class Word structure (e.g., Customer_Billing_Address ).
Data Modeling Standards : Establish rules for conceptual, logical, and physical models. This includes specifying acceptable notations (e.g., IE Crow's Foot, IDEF1X), modeling tools, and requirements for documenting entity definitions.
Reference Data Standards : Define standard code sets and values. Organizations should adopt industry standards where possible, such as ISO 3166 for country codes, ISO 4217 for currency codes, or standard industry codes (e.g., SIC, NAICS) for business classification.
Security and Privacy Standards : Mandate how sensitive data (such as Personally Identifiable Information - PII) is handled, including encryption standards (e.g., AES-256), masking protocols (dynamic vs. static), and tokenization methods.
4. Implementation and Enforcement Mechanisms
Simply writing policies and standards is insufficient; they must be actively implemented and enforced.
Automated Enforcement : The most effective mechanism is embedding standards directly into technical workflows. Examples include:
Database schema constraints (e.g., primary keys, foreign keys, not-null constraints).
Validation rules in ETL (Extract, Transform, Load) pipelines or API gateways.
Automated deployment checks in CI/CD (Continuous Integration/Continuous Delivery) pipelines that fail if a database script violates naming conventions.
Data Quality Profiling : Continuous profiling of production data alerts owners and stewards to anomalies or drift, highlighting policy breaches before they cause systemic business issues.
Architectural Reviews : The Enterprise Data Architect conducts design gates. Any new database schema or data integration must pass an architecture review to verify alignment with modeling standards before promotion to production.
The Waiver and Escalation Process : In rare cases, a project team may have a valid reason why they cannot comply with a standard (e.g., software package constraints). The team must file a formal Waiver Request detailing the business justification, risks, and a plan for eventual remediation. The request is reviewed by the lead steward and approved or denied by the Data Owner. If a dispute arises, it escalates to the DGC.
Compliance Monitoring and Reporting
A vital task of the DGO is reporting on compliance metrics to the DGC. This includes tracking:
The percentage of data assets mapped to approved policies.
The number of active policy waivers and their expiration dates.
The volume of unresolved data quality issues violating established standards.
Regular internal audits conducted on sensitive data domains to verify that encryption and access standards are operating as intended.
Cultural Alignment and Change Management
Policies and standards fail if they are viewed solely as bureaucratic constraints. Effective governance programs combine enforcement with change management. The DGO should focus on educating staff on the value of standards—such as how standardized naming reduces development cycle times or how clean data prevents operational errors. This shifts the perception of governance from a restrictive control function to a business accelerator.