The article presents an approach to modeling the cyber-physical water supply system of a smart city. The shortcomings of control models are considered, and the list of vulnerabilities of the cyber-physical water supply system of a smart city based on scenario modeling is supplemented. The features of modeling the cyber-physical water supply system of a smart city were formed by a comprehensive threat analysis. The proposed approach makes it possible to generalize vulnerabilities, threats and create requirements for modeling scenarios of violation of the management of cyber-physical water supply systems in order to reduce potential risks. Based on a multi-criteria assessment, the optimal model for control the cyber-physical water supply system of a modern city was determined - a Digital water utility with a centralized data exchange system based on the state information system for water resources management. The results of the study were practically used in one of the largest water supply companies in Russia - the city of Saint Petersburg.