Drinking water production is part of the critical infrastructure and is important for human health as well as in industries. The purpose of this pilot study is to create an initial view on cyber risks in water treatment plants connected to information flows, critical cyber physical systems, security work and consequences of a successful cyberattack. The pilot study can support the Swedish Civil Contingencies Agency (MSB) in strengthening the protection for critical infrastructure. The primary data collection took place through interviews with representatives from five organizations in the drinking water sector. This was augmented with data from reports, documents and websites. The five organizations that participated in the study supply drinking water to approximately 20% of the households in Sweden. The study gives an overview of actors and stakeholders, information flows and cyber-physical systems in the drinking water sector. It gives an insight into how the interviewed companies work with security, their needs for education and training, and what threats and challenges exist. The study shows that the digitalization within the water sector has created new challenges concerning security, and IT-security in particular. The need for competence in both IT and OT have resulted in the organisations having a hard time recruiting enough people with both of these skillsets. Legislative demands, inter- and intraorganizational dependencies, difficulties in training and practice for example sentence practicing cyber incidents, all make cyber security a difficult issue. The pilot study has provided insight into how the interviewed organizations work on these issues, but due to the small sample of water treatment plants that have been interviewed no firm conclusions about the sector can be drawn. The study concludes with proposals for further work on the subject.