OpenCyber Academy
Postgraduate · Chapter 2 · English
Course code: OCA-141Chapter 02: OCA-141-C002

Chapter 2 — Governance operating model

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Models"]
  N2["2.2 Choosing for Corran"]
  N3["2.3 The governance group"]
  N4["2.4 Starting small"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Models"]
  N2["2.2 Choosing for Corran"]
  N3["2.3 The governance group"]
  N4["2.4 Starting small"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]
[Learning outcomes]
    |
    v
[2.1 Models]
    |
    v
[2.2 Choosing for Corran]
    |
    v
[2.3 The governance group]
    |
    v
[2.4 Starting small]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) compare governance operating models; (2) select one for a mid-sized company; (3) define a governance group's mandate.

2.1 Models

Dr. Achebe introduces operating models. A centralised model places governance decisions in one team. A federated model shares decisions between a central office setting standards and business units applying them. A decentralised model leaves decisions to units with light coordination. DAMA-DMBOK2 discusses these options and notes that the right one depends on culture, size and how data are shared. Lucía observes that Corran's data cross departments constantly, from sales orders to operations and finance, which argues against leaving decisions entirely to each department.

2.2 Choosing for Corran

Lucía compares models against Corran's situation: one head office, three regional depots, shared systems and a small data team. A fully centralised model would overload the data team and ignore depot knowledge. A decentralised model would perpetuate inconsistent definitions. She proposes a federated model: a central governance office of two people sets standards and runs reporting, while owners in operations, sales and finance make decisions for their domains within those standards. Lucía shows the comparison as a short table, with one row per model and one column per factor.

2.3 The governance group

She drafts a mandate for a governance group chaired by the chief operating officer. The group approves policies and standards, resolves disputes between domains, sets priorities for quality work and reviews performance quarterly. Its members are the domain owners and the head of IT. ISO/IEC 38505-1 describes the governing body's role as evaluating, directing and monitoring data use, and Lucía maps each mandate item to one of these three activities to show completeness. The chief operating officer reviews the draft mandate and accepts it.

2.4 Starting small

Dr. Achebe warns against launching a large programme. Lucía proposes starting with one critical data set, shipment tracking, where disputes create clear costs. Success there would build credibility for expanding to customer and driver data. She drafts a six-month plan and presents it to her manager, who agrees to propose it to the chief operating officer. She notes in her log that a narrow start makes results visible quickly, which matters in a company focused on daily operations. The officer approves it.

Worked example

Lucía compares centralised, federated and decentralised models, proposes a federated model with a two-person office, drafts a governance group mandate mapped to evaluate, direct and monitor and starts with shipment tracking.

Synthetic case. Corran Freight is synthetic; DAMA-DMBOK2 and ISO/IEC 38505-1:2017 are real.

Errors and limits

Launching governance across all data at once spreads effort too thin.

Exercises

Worked answers

EX006. A federated model.

EX007. Two.

EX008. The chief operating officer.

EX009. Evaluating, directing and monitoring.

EX010. Shipment tracking.