The objective of the proposed research is to improve the resilience of cyber-physical systems against security threats spanning both software and physical processes. The research first studies software supply chain security by developing techniques to identify third-party components in controller firmware and determine the actual supply chain vulnerability status considering non-standard patching practices. It then studies physical process recovery by characterizing attack consequences and developing recovery methods that restore disrupted task progression after attacks. Building on these efforts, the proposed future work will further investigate systematic characterization of the cyber-physical attack space under varying adversary capabilities, with a focus on connecting theoretical attack analysis to realizable interactions with physical systems and characterizing attack consequences based on their severity and recoverability.