The NIS2 directive requires cybersecurity and incident reporting for critical and important operations across the EU, but implementation differs between countries. In Sweden, a decentralized oversight model has been chosen where different sectoral authorities are responsible for oversight, and the entire organization is covered if any part falls under NIS2 (”whole-entity” principle). CoS must therefore ensure that all parts of the organization meet the requirements, regardless of where they occur within the operation. Sweden has also introduced mandatory cybersecurity training for management and explicit personal responsibility for the CEO and board, including the possibility of disciplinary action for serious deficiencies. Incident reporting must be made within 24 hours (prevention), 72 hours (detailed report) and a final report within one month. In Germany, oversight is more centralized (BSI), while Denmark and Finland have their own sectoral models. The DORA regulations for the financial sector are directly applicable throughout the EU, but national supervisory authorities (e.g. the Financial Supervisory Authority in Sweden) have different roles. Collectively, this means that in Sweden, CoS must be extra proactive, coordinate between multiple authorities, and ensure broad internal support for cybersecurity efforts.