First, what this diagnosis is and is not
UNE 166006:2018 is used in Innguma’s reference documentation as a framework for talking about monitoring and intelligence systems. The five dimensions below are a teaching rubric created for the Academy; they do not reproduce clauses, do not replace an audit and do not allow you to declare regulatory compliance.
We use five understandable dimensions: alignment with decisions; coverage and operation; responsibilities and evidence; products and use; assessment and improvement. An indicative score helps start the conversation, but the valuable part is justifying observable examples and turning them into actions.
How to score with judgement
For each dimension we propose an internal scale: 0 = no observable practice exists; 1 = it exists on an ad hoc basis or depends on individuals; 2 = it is documented and applied on a recurring basis; 3 = its effectiveness is reviewed with evidence and it is improved. Do not add up scores without explaining what they mean: two organisations with the same total can have completely different risks. For each answer, provide a verifiable example and note one relevant gap.
| Teaching dimension | Evidence you could show | Uncomfortable question |
|---|---|---|
| Decisions | Prioritised list of decisions and questions | Who confirmed that they are still priorities? |
| Coverage | Map of sources, cadences, incidents and gaps | How do we know that a source worked? |
| Responsibilities | Matrix of roles and backups | What happens if the person responsible is absent? |
| Products and use | Briefings with recipients and feedback | What changed after the product was received? |
| Improvement | Reviews and verified changes | Which error did we detect and avoid repeating? |
Interactive · Self-assessment
Your profile, without misleading averages
Rate each dimension from 0 to 3 (0 does not exist · 1 ad hoc or depends on individuals · 2 documented and recurring · 3 its effectiveness is reviewed). Teaching rubric: not a UNE audit.
Five-dimension self-assessment on a 0–3 scale.
Company A case · simulation
Fictional caseCompany A case: do not hide weakness behind an average
Company A scores well on capture (2), acceptably on products (2), but has hardly any evidence of who validates conclusions (1) and does not review coverage failures (0). Publishing an «average maturity level» would hide precisely the important risk. The result must communicate the gaps and prioritise actions: name a validator and a substitute; document the status of critical sources; test a monthly review of omissions.
Educational simulation: fictional information and organisations.
Interactive · Decide
Which gap do you prioritise?
The score helps start the conversation; impact decides the priority.
Activity: decide which gap to prioritise in two situations.
Company A has “Responsibilities” at 1 (no formal backup) and “Improvement” at 0. The pilot decision is in three weeks and the analyst is going on vacation.
“Coverage” is at 0 in an area that was deliberately excluded, with justification.
The team wants to present “average maturity 1.4” to management.
Your 90-day plan
Days 1–30: establish visibility. Agree on the priority decision, owner, scope, source inventory and obvious risks. Days 31–60: operate and check. Produce at least one deliverable, review the traceability of claims, log incidents and collect feedback from the recipient. Days 61–90: correct and stabilise. Apply one concrete improvement, test its effectiveness, update the plan and decide the priorities of the next cycle. The timeframes are a training proposal, not a UNE requirement. This implementation plan in three 30-day stages is different from the continuous improvement cycle in 6.5, which applies once the system is already working.
Do it yourself
Do it yourself · 15-minute diagnosis + plan
Answer the five dimensions with concrete evidence. Choose the gap with the greatest impact on a real decision, not the lowest-scoring one without context. Formulate three actions, each with an owner, date, verification indicator and residual risk. Compare the initial situation with the one at 90 days.
Deliverable: explainable self-diagnosis and improvement plan.
Common mistakes: presenting internal scores as certification; claiming UNE compliance without an audit; copying text from the standard without permission; optimising for a score instead of closing gaps; promising that automation removes the obligation to govern the system.
Key takeaway: maturity is not a number: it is the ability to explain what we do, how we know it and what we change when it stops working.
Maturity assessment and 90-day plan
Identify verifiable improvements and assign them a short cycle.
See the template →Check it · self-assessment
Check your diagnosis
This part needs professional judgement: there is no automatic marking. Complete your work in the practice, rate it with the lesson's rubric and compare it with the indicative solution.
What your answer should include
- Each dimension has concrete evidence.
- You choose the gap with the greatest impact on a decision, not the lowest-scoring one without context.
- Three actions, each with an owner, date, verification indicator and residual risk.
- You do not use the average as conformity and you do not present the dimensions as UNE clauses.
Indicative solution
Starting point: decisions 2, coverage 2, responsibilities 1, products 2 and improvement 0. Model solution: do not use the 1.4 average as conformity. Prioritise backup cover and detection of failed sources, error review and feedback from the decision-maker. Days 30/60/90: action, owner, evidence of execution and an independent effectiveness test; document the risk that remains.
Mistake to avoid: Presenting the five dimensions as UNE clauses or issuing a compliance seal.
Illustrative solution for a fictional case: reasoned alternatives are valid.
Optional extensionDeep dive · A rubric that resists the temptation of the average
The 0–3 scale is didactic, original and non-normative. The score must rest on an observable record, not on what the team believes it does. Where evidence is lacking, note «not verified» and ask for an example; do not assume that a practice operates just because it is described in a presentation. The result is not a «certification» or a «UNE grade».
Company A · Sample diagnosis (fictional)
| Academy dimension | Indicative level | Evidence available | Risk that must not be hidden |
|---|---|---|---|
| Alignment with decisions | 2 | Question and recipient agreed | No quarterly update on record |
| Coverage and operation | 2 | Initial inventory and cadence | A source goes down with no alarm |
| Responsibilities and evidence | 1 | Analyst named | No formal substitute |
| Products and use | 2 | Monthly note delivered | We do not know what the recipient decided |
| Assessment and improvement | 0 | No documented review | Faulty filters are repeated |
The 1.4 average has no certifying interpretation. Prioritise by a combination of impact on the decision, likelihood of recurrence, ease of detection and capacity to intervene. A level 1 shortfall may require immediate action if it compromises a security requirement; a level 0 one can wait if the scope was deliberately excluded and this is justified.
A 90-day plan that can be verified
| Teaching timeframe | Concrete action | Proposed owner | Independent check | Residual risk |
|---|---|---|---|---|
| Day 30 | Approve a substitute and a procedure for a failed source | Monitoring coordination | The substitute runs a query | Dependence on credentials |
| Day 60 | Review 10 records and correct a filter | Quality manager | Comparison with a sample fixed beforehand | Too few cases to extrapolate |
| Day 90 | Hold a review with the recipient and close the incident | System sponsor | Minutes and proof of the change in a second cycle | Future use uncertain |
Extension (optional) · Audit of the claims in your own diagnosis
Write five statements of the type «our system always…». For each one, attach a document or a dated observation, or write «no evidence». Ask someone external to try to refute two of the statements. Review your levels, select three feasible actions and note which signal would show that they worked. If the diagnosis improves only because people know how to answer better, but no practice has changed, do not record an improvement in maturity.
References and limits
- UNE · Spanish Association for Standardization. UNE 166006:2018. Gestión de la I+D+i: Sistema de vigilancia e inteligencia (2018). DocumentReference framework for watch and intelligence systems. It is cited only as context, never as a source of requirements.Reference consulted on 2026-10-18.
- Innguma · internal training material. Cuaderno de trabajo (2021-12-01) (2021).Self-diagnosis questions.Innguma training material, not public.
- Company A is a fictional case: its data, companies and figures do not describe real markets or organisations.
- The five dimensions and the 0–3 scale are a teaching rubric of the Academy: they do not reproduce clauses of UNE 166006, do not replace an audit and do not allow you to declare conformity.
Intelligence Lab · L01
Maturity assessment
Ready to apply it? Open the Maturity assessment in the Lab and identify your improvement priorities in a downloadable result. Output: improvement priorities. Works in the browser, no server, no account and no connected AI. The result may need reviewing and adapting to your case.