Cybersecurity in Water and Resource Recovery Facilities (WRRFs) has gained importance as recenttrends in digitalisation have increased operational efficiency but also exposure and vulnerability to cyberattacks. Through a literature review and interviews with Spanish experts, current top cyber threats toWRRFs and water sector cybersecurity maturity are examined. Results show a lack of available data oncyber threats, as well as a lack of expertise in cybersecurity and that management of the digitalinfrastructure of WRRFs can be improved. The new legislative framework regarding cyber-incidentsunderscores that it is necessary to carefully map the digital infrastructure and minimise human error tofoster better protection against cyber-threats in WRRFs.This research stems from the Water Digitalization and Cybersecurity Chair (C014/24), the result of a collaboration agreement between the National Cybersecurity Institute (INCIBE) and the University of Girona. This initiative is carried out within the framework of the Recovery, Transformation and Resilience Plan, funded by the European Union (Next Generation).