Advance your organization’s cloud adoption strategy with CDMC – the Cloud Data Management Capabilities framework – to confidently migrate, manage and protect your data in cloud/hybrid cloud ecosystems.
Assess cloud-readiness
Conduct an objective self-assessment or use a CDMC Authorized Partner to identify gaps and define priorities in cloud adoption.
Confirm your business case
Define and govern your business case for cloud data management as well as opportunities for automations.
Solidify your cloud strategy
Ensure your business’s cloud strategy is centered on best practices for migrating, creating and managing data in the cloud data.
Gain cloud confidence
CDMC was developed with the expertise of hundreds of cross-industry professionals to ensure its sound guidance.
Produce measurable outcomes
CDMC’s framework flexibly supports your cloud data priorities while producing trackable progress and measurable results.
Ensure data protection & privacy
CDMC defines the key controls required to protect data in cloud environments and meet data privacy requirements around the world.
Applications of CDMC
Cloud adoption in any business requires identifying and assessing the data management capabilities and processes your organization needs to achieve your objectives. It also requires defining the business case and obtaining investment. Built by hundreds of data, business and cloud technology experts, CDMC provides the comprehensive and objective framework to produce a clear set of requirements with benchmark comparisons to your stakeholders to secure necessary funding for your program.
Develop a “cloud-savvy” data organization with comprehensive training. Our CDMC training courses and professional certification aligns with the framework itself, ensuring that all staff and executives know what the capabilities are and how they can be implemented to build a more comprehensive, effective and compliant cloud data management and analytics organization.
Conduct an assessment of your cloud or hybrid-cloud ecosystem either internally or with the additional outside expertise and experience of a CDMC Authorized Partner. Evaluate your programs, educate stakeholders, identify gaps and compare ongoing progress against industry peers. Monitor ongoing progress with consistent scoring, tracking of metrics and benchmarking.
Ensure that your valuable data assets are at the core of your organization’s cloud adoption strategy. CDMC defines the requirements to successfully implement cloud while protecting your data with confidence. CDMC’s framework is flexible, allowing you to prioritize what aspects of cloud data management and analytics your business focuses on to align with your overall cloud roadmap.
The CDMC framework includes 14 Key Controls & Automations for protecting sensitive data, such as Personally Identifiable Information (PII), Company or Client Identifiable Information and Material Non-Public Information (MNPI). The controls define key requirements – such as data monitoring, ownership, sovereignty, entitlements and access, security and retention – to effectively manage and reduce data risks in cloud environments.
CDMC was developed by EDM Council’s CDMC Working Group, with 300+ professionals participating from 100+ firms, including the world’s major cloud service providers (CSPs) – AWS, Google Cloud, IBM and Microsoft – plus leading financial firms, consultancies, technology firms and numerous corporations.
What are the core components?
The CDMC 14 Key Controls & Automation are introduced as part of the full CDMC v1 Framework. Download the 14 Key Controls document to review the business and regulatory requirements for managing sensitive data in the cloud.
How is CDMC constructed?
CDMC is built as a series of 14 Key Controls, spanning objectives, questions, artifacts of evidence and criteria for scoring.
How is CDMC scored?
CDMC measures your ability to manage
data in the cloud using a scoring matrix to evaluate engagement and processes with auditable evidence.
Case Studies
BigID achieves certification as a CDMC Certified Cloud Solution
The CDMC framework was developed over the course of 18 months by the EDM Council’s CDMC Working Group (which was established in July 2020), with participation from leading cross-industry firms, consultancies and technology companies, including the major cloud service providers of Amazon Web Services (AWS), Google, IBM and Microsoft. The Working Group is chaired by Morgan Stanley and LSEG, with project management provided by Capco. The collaborative process included thousands of hours from the team. CDMC v1.1 launched in September 2021 as a free license for any organization’s internal use
Although the development of the CDMC framework was initially launched with input from the financial sector, it has been designed by experts from multiple sectors and is relevant to organizations in all industries globally to help protect sensitive data.
Regulators around the world have already expressed interest in the framework and there are a number of key regulators that are members of EDM Council. Several regulators in North America, Europe, the Middle East and Asia-Pacific also supported the development of CDMC by reviewing it and providing feedback to the CDMC Working Group.
The CDMC 14 Key Controls were the first publication of the CDMC Workgroup in July 2021 and encompass the key controls and “always on” automations required for protecting sensitive data in cloud and multi-cloud environments. The CDMC Framework represents the complete model, addressing the broader governance and operational requirements for managing data in the cloud, including the 14 Key Controls.
No. The CDMC framework is available as a free license to all industry for internal use including both EDM Council members and non-members.
A Readiness Assessment is a scorable analysis of existing cloud capabilities, in alignment with the capabilities and sub-capabilities of the CDMC Framework. Readiness Assessments can also be used to benchmark the maturity of your cloud capabilities and can be used to prepare for a full Certification Assessment. Readiness Assessments can be self-administered or can be conducted by a CDMC Authorized Partner. A Certification Assessment is a formal audit of your cloud capabilities, similar to a SOC 2 or ISO 27001 assessment and must be conducted by a CDMC Authorized Partner. To achieve CDMC Certification, substantiated evidence must be produced in alignment with the capabilities and sub-capabilities of the CDMC Framework. Upon successfully completing a Certification Assessment, a CDMC Certification Digital Badge from the EDM Council will be awarded, which is valid for 12 months.
Yes, Cloud Service and Cloud Solution providers can get CDMC certified on specific or all 14 CDMC Key Controls by engaging an independent CDMC Authorized Partner to conduct a CDMC Certification Assessment for their respective cloud offering. Cloud vendor offerings that evidence successful completion of a CDMC Certification Assessment will receive a CDMC Certification Digital Badge from the EDM Council which is valid for 12 months.
While DCAM (Data Management Capability Assessment Model) is an assessment framework for data and analytics management, CDMC is a best practice assessment and certification framework for the management and control of data in cloud, multi-cloud and hybrid-cloud environments. CDMC focuses and expands on capabilities that are critical to the control of sensitive data. It assumes that organizations have strong foundations of data management capabilities and highlights areas where the features of modern cloud platforms present opportunities for standardization and automation of data management and control.
Organizations should use DCAM to assess if they have established the foundations of a data and analytics management initiative.
Organizations should use CDMC to assess if you have the capabilities to underpin a controlled adoption of and migration to cloud.
It depends. A DCAM assessment provides insight to your data and analytics management capabilities across all environments, while a CDMC assessment addresses the capabilities needed to control sensitive data in cloud environments. Consider these factors:
Only perform a CDMC assessment if you are considering cloud migration or adoption or if you already manage data in cloud environments
Consider both DCAM and CDMC assessments If you are considering cloud migration or adoption or already manage data in cloud environments, and you do not understand or you have concerns about your fundamental data and analytics management capabilities
A CDMC assessment should only be performed without having completed a DCAM assessment if you already understand your foundational data and analytics management capabilities
While EDM Council recommends performing DCAM first, there is no strict dependency
