In incidents related to cybersecurity, data breaches, or serious regulatory violations, the Chief of Staff has a clear responsibility to act quickly and in a structured manner in accordance with Swedish law. For NIS2-classified operations, a first report (”heads-up”) must be submitted to the sectoral authority within 24 hours, a detailed report within 72 hours, and a final report within one month. In the event of personal data breaches under the GDPR, reporting to IMY must be done within 72 hours. CoS must ensure that there are clear incident management procedures, that the division of responsibilities is known, and that all staff know how to act in the event of an incident. It is also CoS’s responsibility to coordinate internal and external communication, involve the right competencies (IT, law, communication), and ensure that lessons learned from the incident are documented and lead to improvements. In Sweden, it is particularly important to involve trade union representatives in major changes to the working environment or monitoring, and for reporting to be carried out transparently and in accordance with both law and collective agreements.