Data strategy for mid-size companies: a one-page framework

What should a mid-size data strategy answer?#

A mid-size data strategy should answer five questions about records the company already keeps: where they live, who is accountable for them, what they are used for, how they are protected and whether they have value outside the company. Enterprise frameworks add governance councils and maturity models; a company with one IT lead and a busy COO needs a page it can keep current.

The page works at the level of record families, such as support tickets, CRM histories, job and dispatch records, order exceptions or quality records, rather than individual tables or fields. That keeps it readable for the leadership team and specific enough to act on.

The one-page canvas#

The one-page canvas has five rows, filled in once for each record family. Each row pairs a question with a short written answer, and the blank cells become the to-do list.

Systems and owners: start with what exists#

Systems and owners come first because every other row depends on them. List each system of record by name: Salesforce or HubSpot for customer history, Zendesk or Intercom for support, Jira and GitHub for engineering, ServiceTitan or Jobber for field work, NetSuite or Acumatica for orders. Note how far back the records go and how they can be exported.

Then assign one accountable owner per record family. The CTO might own engineering histories and the COO job and dispatch records, while IT administers the systems. Owners decide retention, approve new uses and sign off before a system is retired, which is when history is most often lost.

• 1Name the system of record for each record family, not every tool that touches it.
• 2Record the oldest accessible year and any gaps left by migrations.
• 3Note the export route: built-in export, API, backup file or vendor request.
• 4Assign one executive owner and one administrator.
• 5Flag systems due for retirement, renewal or a vendor change.

Uses: pick two or three, not twenty#

The uses row should name two or three decisions or tools that depend on each record family, not every possible application. AI is a growing share of those uses: for the period ending May 3, 2026, the Census Bureau reported that 32 percent of firms with 100 to 249 employees and 37 percent of firms with at least 250 employees said they used AI.

Writing down uses also exposes quality problems. In RSM's 2026 survey of middle-market leaders, problems with data quality and availability ranked first among obstacles to deploying AI, named by 34 percent. Naming the intended use for each record family shows quickly which fields are unreliable and which links between systems are missing.

Protections: access, retention, privacy and contracts#

The protections row records the limits that already apply to each record family. Access roles set who can see it, retention rules set how long it is kept, privacy obligations cover personal details about customers, employees or candidates, and client and vendor contracts may limit reuse.

Write protections as decisions, not aspirations: who may export, how long closed tickets are kept, which fields hold personal data, which client contracts restrict reuse. Where a decision is pending, the page makes the gap visible. Privacy and contract questions are assessed with counsel; the page records the answer and who gave it.

External value: the row most companies skip#

External value is the row most companies skip, partly because records almost never appear on the balance sheet. Under IAS 38, internally generated customer lists and similar items are not recognized as intangible assets, and US GAAP generally expenses the cost of internally developed intangibles that are inherent in a continuing business. The value can be real and still unrecorded.

AI developers license records of real work, such as support outcomes, code reviews, job histories and quality decisions, to train and evaluate models. The SourceX Enterprise Data Value Framework names what drives that value: uniqueness, domain expertise, human-generated signal, scale, recency, data cleanliness, rights and AI utility increase it; exclusivity increases price; reproducibility reduces value; and preparation cost and privacy burden reduce net value.

SourceX's fit check for this row uses metadata only: system names, date ranges, record families and known restrictions. Any license then follows the SourceX five-step transaction, Supply, Rights, Preparation, Approval and Delivery, with the supplier approving every step. Data is licensed, not sold, so the company keeps ownership.

How a holding group uses the page#

A holding group uses the page one operating company at a time and adds a group-level rights register. Records from a software company, a trades business and a distributor are different products with different owners and approvals, so pooling them into one dataset rarely helps.

The register becomes the group's view of its subsidiaries' records as a portfolio: which companies hold distinctive histories, which carry legacy restrictions from their acquisition, and where an approval path is already clear.

• 1Fill a separate page for each operating company, owned by that company's leadership.
• 2Keep a central register of rights positions, contract restrictions and acquisition-era terms.
• 3Note which entity would sign any license, since each supplier entity approves its own.
• 4Record lender, board or investor consents that touch IP or data licensing.
• 5Compare pages to find the two or three companies with the strongest records.

Illustrative: a roofing and restoration company fills the page#

Illustrative: a fictional roofing and restoration company runs jobs in ServiceTitan, books in QuickBooks Online and email in Google Workspace. Its leadership team fills the page in one working session for three record families: estimates and jobs, customer communications, and warranty claims.

The gaps are plain once written down. Job photos have no retention rule, warranty claims live partly in a spreadsheet nobody owns, and nobody knows how far back ServiceTitan history can be exported. The COO takes ownership of job and warranty records, sets a retention rule for photos and moves warranty tracking into ServiceTitan.

On the external value row, the team notes that years of estimates linked to final invoices, supplements and callbacks are distinctive, while homeowner and insurance details add a privacy burden. They record that as a question for a fit check, not a decision.