The Public Health Security and Bioterrorism Preparedness and Response Act of 2002 (Bioterrorism Act) required water utilities to perform vulnerability assessments (VA). Later, it became clear that the security focus of the VAs needed to be expanded to an "all-hazards" approach. Utility managers have expanded their thinking from looking only at the vulnerability of their systems to malevolent attacks to a more robust understanding of the risks their systems face from natural hazards, and "dependencies," such as utility power or key vendors and supply chains. America's Water Infrastructure Act (AWIA) of 2018 requires that all community water systems serving at least 3,300 people assess the risks to, and the resilience of, their drinking water systems. The AWIA requires that a risk and resilience assessment (RRA) must be conducted and aligned with an emergency response plan that incorporates the RRA findings. Water utility managers have long understood the concept of managing risk. While the concept of "resilience" has gained traction more recently, water utilities regularly take measures to anticipate interruption of water service, as well as providing solutions and pragmatic "workarounds" to restore service quickly. These are measures of resilience. The article details the authors' insights gained over various analyses focused on RRA of urban water infrastructure and lessons learned from this process. In addition, it also provides specifics of an "all-hazards" approach that includes cyber vulnerability of municipal water infrastructure. These lessons are applicable to other similar projects and studies, opening the door to new and ongoing discussions on vulnerabilities of municipal water infrastructure and their potential risk mitigation needs, leading to more effective policies and procedures.