Before final commissioning the integrator submits as-built design documents and a ship cyber resilience test procedure, then carries out Society-witnessed tests after other commissioning. The procedure covers every requirement's commissioning tests (the Society decides whether tests already passed in E27 certification can be omitted, which is generally not allowed where findings carry over, compensating measures apply or the CBS changed), tests compensating countermeasures, records status and findings, specifies set-up, equipment, initial conditions, method and acceptance criteria, and is kept under change management and aligned with final configurations; the Society may ask for more tests.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.