Passing your first NDMO audit: a P1-first roadmap

NDMO does not use maturity levels. It uses priorities. Every one of the 191 specifications is P1, P2 or P3, and that is your schedule: P1 in year one, P2 in year two, P3 in year three. The fastest way to a good National Data Index score is to finish P1 cleanly before you touch anything else.

Year one, in order

• Stand up governance: the Data Management Office, the Chief Data Officer, the Personal Data Protection Officer, the data stewards and the entity data committee.
• Write the strategy, the policy and the guidelines, and run the gap analysis.
• Build the data catalog and classify your data against the four tiers (Top Secret, Secret, Restricted, Public).
• Stand up the personal-data-protection basics: notice and consent, the rights process, the breach process and the register.
• Put the data-sharing process and request channel in place, with agreements.

Then evidence, not opinions

NDMO scoring is binary and evidence-backed. A specification is either demonstrably in place or it is zero. So the second half of year one is attaching proof to each P1 specification and getting the Chief-Data-Officer audit ready for submission. Because the personal-data-protection domain maps to the PDPL and the security domain to the NCA controls, evidence you already hold for those should be reused, not recreated.

NDMO is a register-and-evidence problem. Finish P1, attach the proof, and the index takes care of itself.