Determining data access risks using the data access governance (DAG) maturity model (part 2 of 3)
Learn how organizations progress from visibility to enforcement and certified governance in the DAG maturity model.
Our previously data access governance blog about maturing data access governance explored the critical transition from the total blind spot of Level 1: Unmanaged Risk to the diagnostic insight of Level 2: Visibility. But as many IT and security teams quickly discover, simply seeing your data exposure isn’t enough, especially when the resulting remediation requires endless manual effort.
To break free from that operational bottleneck, we must climb the maturity curve and explore how forward-thinking companies transition from mere awareness to active control. In this post, we will dive deep into Level 3: Enforcement and Level 4: Certified Governance, mapping out exactly how to transform slow, manual workflows into automated, policy-driven defenses. You can check out the full details in our newly published Data Access Governance (DAG) Maturity Model.
What are Levels 3 and 4 of the Data Access Governance (DAG) Maturity Model?
Level 3 focuses on enforcing appropriate access through policies, automation, and ongoing permission management. Level 4 extends governance by adding business-owner certifications, formal access reviews, and documented accountability that help organizations demonstrate who has access to data and why.
Level 3: enforcement
Organizations at this stage are systematically mitigating the risk of unauthorized access to high-value data by taking strict control over how privileges are granted, maintained, and revoked. To achieve this, many organizations pair the deep analytics and visibility of OpenTextTM File Reporter with the policy-driven orchestration of OpenTextTM File Dynamics—both core components of the comprehensive OpenTextTM Data Access Governance solution. By integrating these capabilities, data management shifts from reactive, ad-hoc cleanup projects into a framework of repeatable, standardized, and automated processes.
Sustaining this state requires a genuine step up in organizational skill. Rather than simply assigning tasks to generalist administrators, this phase demands personnel who can design precise access policies, model least-privilege principles against real-world business workflows, and execute remediations safely without disrupting daily operations. Because manual intervention carries an inherent risk of breaking business processes, operating repeatably at this level demands strict change-management discipline rather than just analytical insight.
Organizations that consistently operate at this stage demonstrate an environment under active control. Least-privilege principles are systematically applied, and excessive permissions are cleaned up through automated, repeatable workflows rather than one-off projects. Instead of letting permissions stagnate, the organization drives access decisions through clear governance policies and monitors group changes on a defined schedule. Furthermore, provisioning and deprovisioning are tied directly to identity-lifecycle events, such as employee onboarding, role changes, or offboarding, which allows teams to measure tangible risk reduction over time.
How automation and engagement enable enforcement
A critical element of enforcement is both automation and engagement. Notifications keep line-of-business data owners informed about access changes and enable them to participate directly in data stewardship. Employing advanced policy-driven automation techniques like lockdown and fencing allow governance and controlled access evolution to coexist.
Ultimately, shifting to this policy-driven framework yields a profound business impact. By continuously slashing over-permissioning, organizations lower the likelihood of unauthorized access and data breaches. This automation also drives greater operational efficiency, freeing IT and security teams from the grueling burden of manual cleanup. The end result is a stronger compliance posture, transforming data governance from a reactive scramble into an institutional standard.
Level 4: certified governance
Organizations that reach Level 4 can answer a defining compliance question: “Can you continuously demonstrate that the right people have access to the right data for the right reasons—with the business, not just IT, standing behind that claim?”
Historically, demonstrating this level of strict compliance was reserved for structured data. Organizations routinely validate compliance with structured data privacy, access, and security regulations by conducting formal access reviews over their databases and applications. However, this same rigorous standard can now be applied directly to the chaotic world of unstructured data.
Through a powerful integration between OpenText Identity Governance and OpenText File Reporter, companies can conduct identity access reviews and certifications on unstructured data. By pulling Windows NTFS file system permissions and metadata from OpenText File Reporter directly into the governance framework, it bridges a critical gap in the industry.
Broad-spectrum data access governance bridges the gap
OpenText refers to this approach as broad-spectrum data access governance. It combines data discovery and classification, access analytics, policy-driven permission monitoring, and periodic business-owner reviews of data access alongside application entitlements.
Reaching this level of maturity requires cross-functional expertise that most organizations heavily underestimate. The biggest misconception is thinking this is a purely technical milestone; in reality, the vital skills now live completely outside of IT. Certified Governance demands business owners who understand their own data well enough to confidently certify user access, compliance and audit teams capable of designing rigorous certification campaigns, and formal data stewards to maintain ongoing accountability. True maturity here is organizational rather than technical. The primary constraint is rarely the software’s capability, but rather the distributed data-ownership literacy that the organization has (or doesn’t have) built across its business units.
When an organization successfully builds this culture, its day-to-day characteristics reflect an environment with clearly defined accountability. Formal access reviews are conducted on a strict schedule, with business data owners actively certifying who belongs in each repository. A known-good access baseline is firmly established, allowing security teams to identify and reconcile configuration drift against it. Meanwhile, policy enforcement runs automatically in the background, channeling any exceptions through structured approval workflows. Group membership is strictly governed with defined owners and documented purposes, and access certifications are comprehensively archived. This governance spans seamlessly across multiple repositories and cloud environments, dividing clear, undisputed accountability across IT, security, compliance, and the business line.
Ultimately, cementing this cross-functional structure delivers an immensely valuable business impact. The organization moves into a permanent, audit-ready posture, improving regulatory confidence related to initiatives like FINRA or HIPAA. Rather than relying on guesswork, the enterprise achieves genuine accountability and a security framework that actually holds up under aggressive external scrutiny.
Coming in part 3
In the third and final installment of this series, we will explore the absolute peak of data maturity: Level 5: Continuous Governance. We will break down exactly what this state means for the modern enterprise, exploring a world where data security is no longer a recurring event, but an uninterrupted, automated reality.
More importantly, we will outline the precise roadmap to achieve and maintain this state over time. You will discover how OpenText Data Access Governance leverages automated policies to neutralize threats the moment they appear.
See all this explained in a webinar
David Condrey, the data access governance engineering lead, will walk through all of this on November 5, 2026. Check out his session!
