Application of IACS Unified Requirements E26 and E27 in the existing vessels creates a nightmare in terms of working. It is possible that the supplier is rated highly in documentations but the ship may end up having mechanical breakdown, having been associated with a bug that is hidden within OT software. We built the Supply-chain Verified Cyber Resilience (SCV-CR) framework to deal with this gap. Ranging the perimeter of otherwise-isolated networks into view instead of physical dependencies, SCV-CR imposes separation of communication paths and physical machinery dependencies on two explicit graph structures (G N and G S ) and imposes hard Boolean admission gates on signed SBOM and VEX artifacts. Our set-up of the deterministic Monte Carlo experiment took over 20,000 iterations and six representative Maritime subsystems (PMS, AMS, IAS, ECDIS, GMDSS and cargo automation). The disruption failure rates were reduced by 16.22 percent and conditional downtime reduced by 24.28 percent and the 95th-percentile recovery time reduced to 15.31 h over the simulated rollout. Because inherent physical hazard invariants are never eliminated by the framework, it appears to offer a verifiable, mathematically-underpinned, way of audit of cyber safety by shipboard engineers and classification surveyors when carrying out physical surveys of classes.