DQPA — a web platform for ISO/IEC 33000-based self-assessment of data governance, data management, and data quality maturity, aligned with the Spanish specifications UNE 0077–0080

Résumé fourni par la source

DQPA is a web platform that supports diagnostic internal self-assessment of data governance, data management, and data quality maturity in accordance with the ISO/IEC 33000 assessment mechanism, as instantiated by an ISO 8000-based process reference model and the Spanish specifications UNE 0077–0080. It enables an organization to evaluate its own processes in a recurrent and affordable manner—without depending on the availability of specialized external assessors—by capturing evidence through a guided questionnaire, deterministically computing process capability and organizational maturity levels, and transforming the computed state into a prioritized improvement roadmap. Unlike third-party certification assessments, this self-assessment application of the same method is aimed not at certification but at helping organizations understand their own situation as a basis for continuous improvement. Architecturally, DQPA separates a deterministic assessment engine from a generative recommendation service, a boundary that preserves the traceability of the normative computation. The engine reproduces the ISO/IEC 33020 aggregation rules without human intervention, deriving capability and maturity levels from weighted questionnaire responses in a fully traceable and reproducible manner; a complementary service based on a pre-trained language model, conditioned by a structured prompt and grounded in an expert-curated catalogue of improvement tasks, intervenes only afterwards to turn the computed "as-is" state into a written diagnosis and prioritized recommendations. The normative model—processes, questions, weightings, and improvement tasks—is maintained as configurable data rather than hard-coded, so the platform can be adapted to revisions of the specifications or to equivalent frameworks without modifying the source code. DQPA is released as open-source software under the GNU AGPL v3.0 license. The backend is a stateless REST service built on Node.js and Express that concentrates the business logic of the platform and exposes its functionality under the /api prefix, with a health-check endpoint for monitoring. It manages the full server-side lifecycle of a self-assessment—user registration and email confirmation, JWT-based authentication and role-based authorization, questionnaire creation and progress saving, answer updates, and completion—persisting all state in a document-oriented MongoDB database accessed through the Mongoose object-document mapper. Credentials are protected by hashing, and the service adheres to a data-minimization principle: it stores no documentary evidence or source data from the assessed organizations, retaining only the account email, the organization's descriptive attributes, and the questionnaire responses required to compute and reproduce the result. The deterministic assessment engine resides in this layer and represents the core of the product: from the recorded responses it computes the per-process and per-level scores, applies the ISO/IEC 33020 staged aggregation rules to derive process capability and organizational maturity, and returns the result without any intervention from the generative component. Strictly posterior to this computation, the backend orchestrates the AI recommendation service, which calls a managed Google Gemini model conditioned by a structured prompt and grounded in the curated improvement-task catalogue; if the model call fails or its quota is exhausted, the service degrades deterministically to the catalogue so that a usable improvement plan is always produced. The backend additionally handles transactional email through Microsoft Graph and provides administrative endpoints for maintaining the normative model and for consulting aggregate statistics and trends. Because it is stateless and container-ready, the service can be scaled horizontally, which is the natural path for absorbing the generative workload under concurrent load.

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.