Water Utilities are increasingly interested in the issue of the security of water supply, both in terms of quantity and of quality. This paper deals with the issue of the resilience of the water production and distribution system to extreme events. It proposes an implementation of a cost-benefit analysis (CBA) of resilience scenarios in the face of a cyber-attack. The study area is the Strasbourg Eurometropole in northern France. To the knowledge of the authors, this is the first application of its kind. The business-as-usual (BAU) situation (reference situation) is the way a crisis is (or would be) currently tackled and managed by the Utility. Two different resilience programs assume that the Utility has implemented resilience measures in order to reduce the impacts of the attack on users and is able to recover normal operating condition more rapidly than in the BAU. Expected results might show that users react differently depending on the proposed resilience program characteristics, its timeline and/or its relied cost.