The DCAM Data Management capabilities that are required to provide the heightened level of controls on the data described in the BCBS 239 Principles have been mapped to DCAM v.1

Since DCAM is a capability model, level 5 (Achieved) is the target against the BCBS 239 mapped capabilities within the context of the Risk Data Domains and is required to provide the desired controls.

In this case, you wouldn’t need a level 5 against every function, system, domain, etc., but only against those that relate to the management of risk data.

Measuring maturity is determined by whether you have applied those capabilities to all the data in scope to BCBS 239.

For example: if you have only applied the controls to half of the data in your scope data set, you would only be 50% mature related to BCBS 239.

Updated mapping of BCBS 239 to DCAM v.2 is being developed and will be released in 2020.