The scientific foundation of DQPA rests on two pillars of international standardization. ISO 8000 establishes the principles of data quality management, while the ISO/IEC 33000 family provides the general mechanism for process capability assessment: a process reference model, process attributes rated on an ordinal scale, and a maturity model that aggregates those attributes into organizational levels. Although this mechanism has a long track record in domains such as software development, Green IT, and data quality certification, no international instantiation had ever covered data governance, data management, and data quality management jointly as integrated disciplines. The only ISO instantiation for the data domain, the ISO 8000-6x series, is confined to data quality management alone. The researchers built on a direct precedent, the MAMD model, and on the UNE 0077 through 0080 specifications—what they describe as the first standardization initiative to close that gap with normative status—enriched with the governance principles of ISO/IEC 38505 and the DAMA-DMBOK body of knowledge.

What distinguishes self-assessment from formal certification is its purpose. Under ISO/IEC 33000, assessment by an independent team enables certification with validity toward third parties, while self-assessment, performed by the organization itself, is an equally recognized application of the same method aimed at understanding one’s own situation recurrently and affordably as a basis for continuous improvement. Until now, no adequate instrument has existed for this second application, for two reasons. Independent assessment is too costly to repeat frequently, and its most expensive phase—evidence collection—depends heavily on tacit human knowledge that is difficult to automate. Moreover, translating normative processes into language that business profiles can act upon, one of the very purposes of data governance, rarely occurs in manual practice. Existing frameworks fall short in different ways: COBIT 2019 lacks an integrated data-domain maturity model; DCAM and CMMI-DMM support self-assessment but are not grounded in ISO/IEC 33000; and DAMA-DMBOK systematizes the disciplines without defining a maturity model of its own. None combines integrated coverage, an ISO/IEC 33000-based mechanism, automated scoring, automated recommendations, and open-source availability.

DQPA’s architecture is deliberately engineered around a strict separation between deterministic computation and generative artificial intelligence. The platform is a multilayer web application: a React single-page client, a Node.js and Express server exposing a REST API and hosting the deterministic assessment engine, a MongoDB document store accessed through Mongoose, and an external large language model service invoked only after results have been computed. Authentication is token-based with role-based access control, and both tiers deploy as independent containers. Crucially, the normative model itself—processes, questions, weightings, and improvement tasks—is maintained as configurable data through an administration module restricted to expert users, meaning the platform can adapt to revisions of the specifications or even to equivalent frameworks without touching the source code. This data-driven design is what makes the tool reusable and future-proof in a way that hard-coded assessment instruments cannot be.

The heart of the platform is its assessment engine, which algorithmically reproduces the measurement framework of ISO/IEC 33020. Question answers are first converted into weighted percentage scores at two granularities: one per process, from process-specific capability-level-1 questions, and one per capability level from 2 to 5, from cross-cutting questions shared across the scope. The four-category achievement scale maps onto these scores: Not implemented for 0 to 15 percent, Partially implemented for above 15 to 50 percent, Largely implemented for above 50 to 85 percent, and Fully implemented for above 85 to 100 percent. The staged aggregation rule then applies: a process reaches a given capability level when its process-specific score and all lower cross-cutting scores are Fully achieved and the score at that level is at least Largely achieved. The organizational maturity level, on a six-level scale from 0 to 5, is derived from the consolidated capability of the assessed processes in a staged manner. The entire computation is deterministic, traceable, and executed without any intervention from humans or the AI service—a design choice the authors argue is a property rather than a limitation, because transparency and auditability are explicit requirements of the ISO/IEC 33000 method itself.

Only after the numbers are settled does artificial intelligence enter the picture—and the boundaries are strict. The recommendation service neither trains nor fine-tunes any model. Instead, a pre-trained language model, Gemini 2.0 Flash Lite, selected after a structured comparison against alternatives including GPT-4o and GPT-4.1 nano for its large context window and high throughput, is conditioned at inference time by a purpose-built structured prompt. The model’s grounding is entirely deterministic: its input consists solely of the computed as-is state—levels, ratings, and gaps—and a catalogue of predefined improvement tasks curated by domain experts from an anonymized corpus of real projects, assessment reports, standards, and technical documentation. The prompt explicitly forbids the re-computation of levels and imposes prioritization criteria including impact on maturity, criticality of the gap, dependencies, feasibility, urgency, and normative alignment. If the model call fails, the service degrades gracefully to a template-based ordering of the curated catalogue, so a usable plan is always produced without the generative component.

The platform was validated in striking fashion against a real organization: a Spanish public river basin management body responsible for hydrological data acquisition and exploitation. Questionnaire responses were recorded in parallel through DQPA and through the manual procedure of an external expert assessment team, with each business process owner completing the instrument in roughly two and a half hours with support from assessors. The engine computed a largely achieved process-specific score, a partially achieved level-2 dimension, and an unattained level-3 dimension, yielding maturity level 1—precisely the level determined independently by the human experts. Verification went further: the engine’s logic was exhaustively checked against a reference spreadsheet used by the consulting team in professional practice, across all 1,024 possible rating combinations, with full agreement in every case, including boundary conditions between capability levels.

The quality of the AI-generated recommendations was then scrutinized by four expert evaluators—three of them external to the author team and blind to the study—who rated thirty recommendations on a five-point rubric covering consistency with the computed state, alignment with the specifications, actionability, and clarity for non-technical profiles. The overall mean was 4.35 out of 5, with no two evaluators differing by more than one point on any of the 480 ratings, and the restricted external-only mean of 4.23 confirmed the result does not depend on the internal rater. The platform was also applied to three further organizations—a local public administration, a port authority operating critical infrastructure, and a large private technology corporation—producing consistent operation across markedly different sectors, with resulting maturity levels ranging from 0 to 1. Perceived usability, measured with the System Usability Scale across four participants, averaged 80.6, comfortably above the scale’s commonly cited average of about 68. Performance testing showed the deterministic engine computing results in a median of 105 milliseconds and sustaining 150 concurrent users, while end-to-end report generation took a median of three seconds, dominated by the external model call.

The implications reach well beyond convenience. For public administrations and resource-constrained organizations facing obligations under the European Data Governance Regulation, DQPA substantially lowers the barrier to understanding and improving their data practices without depending on scarce certified assessors. For researchers, the platform’s elimination of inter-assessor variability in the computation phase opens the door to genuinely reproducible, longitudinal, and sector-level empirical study of data maturity—questions such as which processes systematically act as bottlenecks, or how maturity evolves after improvement plans are applied, that have been nearly impossible to address empirically until now. The authors are careful to delimit their claims: the platform does not verify declared evidence, cannot prevent deliberate misstatement, does not replace third-party certification, and its recommendations must be contextualized by each organization since the AI knows nothing of internal budgets or politics. Future work includes ablation studies contrasting catalogue-anchored with unconstrained generation, a self-hosted AI deployment for stricter data-residency control, sector-level benchmarking, and what-if simulation of improvement scenarios under explicit resource constraints. But the core message is already clear: the machinery once reserved for expensive consulting engagements has been reproduced as transparent, inspectable, open-source software that any organization can pick up and run.

Subject of Research: An open-source software platform for ISO/IEC 33000-based self-assessment of data governance, data management, and data quality maturity

Article Title: DQPA: A software platform for ISO/IEC 33000-based self-assessment of data governance, data management, and data quality maturity

Article References: Gualo, F., Ayuso, Y., Caballero, I., & Piattini, M. (2026). DQPA: A software platform for ISO/IEC 33000-based self-assessment of data governance, data management, and data quality maturity. SoftwareX, 35, Article 103012. https://doi.org/10.1016/j.softx.2026.103012

Image Credits: AI Generated

DOI: 10.1016/j.softx.2026.103012

Keywords: data governance, data quality, data management, maturity models, ISO/IEC 33000, ISO 8000, self-assessment, process capability, large language models, open-source software, SoftwareX, UNE 0080

The landscape of intellectual property management within the Department of Defense is fraught with intricacies, given the diverse range of technologies and innovations involved. McMartin and McGinn’s focus is to harness commercial best practices, standards, and technologies, many of which have already proven effective in the private sector, to bolster the DoD’s ability to manage its IP licenses. The initiative underscores the need for an organized and streamlined approach to data management, transforming how the DoD interprets and applies license rights.

A central component of this research involves mapping the entire chain of license rights. This mapping process spans initiating solicitation documents, reviewing proposal documents, and assessing assertions made during the contracting phase. Furthermore, it extends to interpreting contract instruments and analyzing the deliverables brought forth through these contracts. This comprehensive mapping is essential not only for clarity but also for ensuring compliance and strategic alignment with the DoD’s goals.

By establishing a meticulous framework to map these rights, McMartin and McGinn aim to address potential barriers that could hinder the DoD’s adoption of commercial best practices. Identifying these challenges is critical, as it will enable the researchers to craft targeted solutions that address specific pain points within the existing system. They are keenly aware that the oversight of IP licenses must evolve concurrently with technological advancements and changing geopolitical landscapes.

Moreover, the researchers are focused on carving out potential paths for the DoD to seamlessly integrate these commercial standards and practices into its operational frameworks. This requires an understanding of the unique challenges that government entities face, including bureaucratic hurdles, security protocols, and the complexities of government contracting processes. These insights become pivotal in fostering a culture of innovation that can keep pace with the rapid evolution of technology.

McMartin and McGinn’s project is not merely an academic endeavor; it holds substantial implications for the future of defense-related technological development. As the DoD seeks to leverage private sector innovations—like artificial intelligence, machine learning, and advanced computing—an effective data management system for IP licenses will facilitate access to these cutting-edge technologies. Consequently, the security and effectiveness of U.S. defense operations could see marked improvement.

The funding that initiated this project, granted by Stevens Institute of Technology as part of a subaward from the U.S. Department of Defense, signifies an expanding recognition of the necessity for robust data management practices. The funding cycle running from November 2024 to February 2025 will enable thorough exploration and analysis, ultimately leading to practical recommendations that can be implemented by defense contractors and policymakers alike.

As the landscape of national defense technology becomes increasingly intertwined with commercial advancements, the research conducted by McMartin and McGinn stands at the forefront of this transformation. Their work will ultimately contribute to a more systematic approach to capture, manage, and utilize intellectual property, which is paramount for sustaining competitive advantage in defense capabilities.

In conclusion, the project “Enabling Data Management of Intellectual Property Licenses for the Department of Defense” is a critical step towards enhancing the operational efficacy of the Department of Defense. By adapting commercial standards and practices, the DoD can facilitate a more sophisticated approach to intellectual property management. This project not only exemplifies the intersection of academia and practical defense strategies but also represents a commitment to ensuring that the United States remains at the cutting edge of technological innovation in defense.

As Benjamin McMartin and John McGinn advance their research, their findings will undoubtedly shape the future frameworks for IP management within the Department of Defense. The effective management of intellectual property licenses stands as a vital pillar supporting national security and technological superiority in an increasingly competitive global landscape. The outcomes of this research may well inform future policies and practices, ensuring the United States capitalizes on the vast potential that lies within its intellectual assets.

Subject of Research: Data Management of Intellectual Property Licenses
Article Title: Enabling Data Management of Intellectual Property Licenses for the Department of Defense
News Publication Date: Not specified
Web References: Not specified
References: Not specified
Image Credits: Not specified

Keywords: Data management, Intellectual property, Department of Defense, Commercial best practices, Research, Licensing, Technologies, Innovation, National security.