UR E26 implementation requirements cover training + supplier management. Crew training: cyber awareness for all crew (phishing + social engineering + USB hygiene + password + reporting); role-based training for Captain + Officers + IT/ETO + Engineer + Bridge watch; refresher annually + post-incident + post-update; class society training requirements + STCW (Standards of Training Certification and Watchkeeping) cyber competency integration; vendor / OEM training for technicians installing or maintaining CBS. Cyber hygiene: USB / removable media policy + drills + safe use of crew internet + safe use of personal devices + safe use of email + browser hygiene; bring-your-own-device (BYOD) policy + segregation. Supplier + OEM management: vendor cyber maturity assessment + due diligence + contract clauses (security requirements + audit right + breach notification + patch obligations + end-of-life); SBOM disclosure + vendor coordination; vendor remote access agreements per UR E26 Protect; supply chain risk per CBS lifecycle (acquisition + installation + maintenance + disposal); secure software development for OEM-supplied CBS per UR E27. Training records maintained + verified at periodic class society survey. IACS UR E26 Implementation + training + STCW + cyber hygiene + supplier + OEM applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.