+Airteagal 79 Nós imeachta ar an leibhéal náisiúnta chun déileáil le córais intleachta saorga lena mbaineann riosca
---+Airteagal 79 1.
---+Airteagal 79 2.
---+Airteagal 79 3.
---+Airteagal 79 4.
---+Airteagal 79 5.
---+Airteagal 79 6.
---+Airteagal 79 7.
---+Airteagal 79 8.
---+Airteagal 79 9.

Airteagal 79 Nós imeachta ar an leibhéal náisiúnta chun déileáil le córais intleachta saorga lena mbaineann riosca

-

1. Forbhreathnú

,
Airteagal 79 1.
Maidir le córais intleachta saorga lena mbaineann riosca, tuigfear iad a bheith mar “táirge lena mbaineann riosca” mar a shainmhínítear in Airteagal 3, pointe 19 de Rialachán (AE) 2019/1020 a mhéid a bhaineann rioscaí don tsláinte nó don tsábháilteacht nó do chearta bunúsacha daoine leo.
Airteagal 79 2.
I gcás ina mbeidh cúis leormhaith ag an údarás faireachais margaidh i mBallstát lena mheas go bhfuil riosca dá dtagraítear i mír 1 den Airteagal seo ag baint le córas intleachta saorga, déanfaidh sé meastóireacht ar an gcóras intleachta saorga lena mbaineann maidir le comhlíonadh na gceanglas agus na n-oibleagáidí uile a leagtar síos sa Rialachán seo. Tabharfar aird ar leith ar chórais intleachta saorga a bhfuil riosca ag baint leo do ghrúpaí leochaileacha. I gcás ina sainaithnítear rioscaí do chearta bunúsacha, cuirfidh an t-údarás faireachais margaidh na húdaráis nó na comhlachtaí poiblí náisiúnta ábhartha dá dtagraítear in Airteagal 77(1) ar an eolas freisin agus oibreoidh sé i gcomhar iomlán leo. Comhoibreoidh na hoibreoirí ábhartha, de réir mar is gá, leis an údarás faireachais margaidh agus leis na húdaráis nó comhlachtaí poiblí náisiúnta eile dá dtagraítear in Airteagal 77(1).

Más rud é, agus an measúnú sin á dhéanamh, go gcinnfidh an t-údarás faireachais margaidh, nó, i gcás inarb infheidhme, an t-údarás faireachais margaidh i gcomhar leis an údarás poiblí náisiúnta dá dtagraítear in Airteagal 77(1), nach gcomhlíonann an córas intleachta saorga na ceanglais agus na hoibleagáidí a leagtar síos sa Rialachán seo, ceanglóidh sé, gan moill mhíchuí, ar an oibreoir ábhartha gach beart ceartaitheach iomchuí a dhéanamh chun an córas intleachta saorga a thabhairt chun comhréireachta, an córas intleachta saorga a aistarraingt ón margadh, nó é a aisghairm laistigh de thréimhse a fhéadfaidh an t-údarás faireachais magaidh a fhorordú, agus in aon chás laistigh de 15 lá oibre, nó de réir mar a fhoráiltear i reachtaíocht chomhchuibhithe an Aontais.

Cuirfidh an t-údarás faireachais margaidh an comhlacht ábhartha faoina dtugtar fógra ar an eolas dá réir sin. Beidh feidhm ag Airteagal 18 de Rialachán (AE) 2019/1020 maidir leis na bearta dá dtagraítear sa dara fomhír den mhír seo.
Airteagal 79 3.
I gcás ina measann an t-údarás faireachais margaidh nach bhfuil an neamhchomhlíonadh srianta dá chríoch náisiúnta, cuirfidh sé an Coimisiún agus na Ballstáit eile ar an eolas, gan moill mhíchuí, faoi thorthaí na meastóireachta agus faoi na gníomhaíochtaí a d’éiligh sé ar an oibreoir a dhéanamh.
Airteagal 79 4.
Áiritheoidh an t-oibreoir go ndéantar gach beart ceartaitheach iomchuí i leith na gcóras intleachta saorga uile lena mbaineann atá curtha ar fáil aige ar mhargadh an Aontais.
Airteagal 79 5.
I gcás nach ndéanfaidh oibreoir córais intleachta saorga beart ceartaitheach laistigh den tréimhse dá dtagraítear i mír 2, déanfaidh an t-údarás faireachais margaidh gach beart sealadach is iomchuí chun an córas intleachta saorga a thoirmeasc nó a shrianadh óna bheith á chur ar fáil ar a mhargadh náisiúnta agus óna bheith á chur i mbun seirbhíse, chun an táirge nó an córas intleachta saorga neamhspleách a tharraingt siar ón margadh nó chun é a aisghairm. Tabharfaidh an t-údarás sin fógra, gan moill mhíchuí, don Choimisiún agus do na Ballstáit eile faoi na bearta sin.
Airteagal 79 6.

San fhógra dá dtagraítear i mír 5 beidh na mionsonraí uile atá ar fáil, go háirithe an fhaisnéis is gá chun an córas intleachta saorga neamhchomhlíontach a shainaithint, áit tionscnaimh an chórais intleachta saorga, an cineál neamhchomhlíontachta agus an riosca a bhaineann leis, cineál agus fad na mbeart náisiúnta a rinneadh agus na hargóintí a rinne an t-oibreoir ábhartha. Tabharfaidh na húdaráis faireachais margaidh le fios go háirithe ar tharla an neamhchomhlíonadh i ngeall ar aon cheann nó níos mó de na nithe seo a leanas:

(a) 

neamhchomhlíonadh an toirmisc ar na cleachtais intleachta saorga dá dtagraítear in Airteagal 5;

(b) 

nár chomhlíon córas intleachta saorga ardriosca na ceanglais a leagtar amach i gCaibidil III, Roinn 2;

(c) 

go raibh easnaimh sna caighdeáin chomhchuibhithe nó sna sonraíochtaí coiteanna dá dtagraítear in Airteagail 40 agus 41 lena mbronntar toimhde comhréireachta;

(d) 

neamhchomhlíonadh Airteagal 50.
Airteagal 79 7.
Maidir leis na húdaráis faireachais margaidh nach iad an t-údarás faireachais margaidh sa Bhallstát atá ag tionscnamh an nós imeachta iad, cuirfidh siad an Coimisiún agus na Ballstáit eile ar an eolas, gan moill mhíchuí, faoi aon bheart arna ghlacadh agus faoi aon fhaisnéis bhreise atá acu a bhaineann le neamhchomhlíonadh an chórais intleachta saorga atá i gceist, agus, i gcás nach n-aontóidh siad leis an mbeart náisiúnta a bhfuil fógra tugtha faoi, faoina n-agóidí.
Airteagal 79 8.
Más rud é, laistigh de 3 mhí tar éis dóibh an fógra dá dtagraítear i mír 5 den Airteagal seo a fháil, nach bhfuil aon agóid déanta ag údarás faireachais margaidh de chuid Ballstáit ná ag an gCoimisiún maidir le beart sealadach a ghlac údarás faireachais margaidh de chuid Ballstáit eile measfar go bhfuil údar leis an mbeart sin. Beidh an méid sin gan dochar do chearta nós imeachta an oibreora lena mbaineann i gcomhréir le hAirteagal 18 de Rialachán (AE) 2019/1020. Laghdófar an tréimhse 3 mhí dá dtagraítear sa mhír seo go 30 lá i gcás neamhchomhlíonadh an toirmisc ar na cleachtais intleachta saorga dá dtagraítear in Airteagal 5 den Rialachán seo.
Airteagal 79 9.
Áiritheoidh na húdaráis faireachais margaidh go ndéanfar bearta sriantacha iomchuí i leith an táirge nó an chórais intleachta saorga lena mbaineann, amhail an táirge nó an córas intleachta saorga a tharraingt siar óna margadh gan moill mhíchuí.

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Caighdeáin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Caighdeáin ghaolmhara

Caighdeáin
SCF Non-Conformity Corrective Action

Description

Mechanisms exist to implement corrective action to remediate instances of non-conformity with applicable statutory, regulatory, and/or contractual compliance obligations.

Possible Solutions & Considerations

Micro-Small Business (<10 staff) / BLS Firm Size Classes 1-2

∙ Corrective action log (spreadsheet)
∙ Documented remediation plans for audit findings

Small Business (10-49 staff) / BLS Firm Size Classes 3-4

∙ Corrective action register with remediation tracking
∙ Management review of open findings

Medium Business (50-249 staff) / BLS Firm Size Classes 5-6

∙ Formal corrective action plan process
∙ GRC platform for finding tracking and remediation
∙ Management review of open findings

Large Business (250-999 staff) / BLS Firm Size Classes 7-8

∙ Enterprise corrective action management program
∙ GRC platform with workflow-driven remediation tracking
∙ Executive reporting on open findings

Enterprise (> 1,000 staff) / BLS Firm Size Class 9

∙ Enterprise GRC platform for corrective action management
∙ Automated finding tracking and escalation workflows
∙ Board-level reporting on material findings

SCR-CMM

Level 0 Not Performed

Practices are non-existent, based on the inability to demonstrate an implemented and operational capability. A reasonable person would conclude the control is not being performed.

Level 1 Performed Informally

Compliance (CPL) domain capabilities are ad hoc and inconsistent. Capability criteria associated with this control may include:
▪ Policies, standards & procedures associated with CPL domain capabilities provide limited coverage due to the depth and breadth of the existing documentation.
▪ Compliance management-related activities are decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
▪ Compliance efforts are narrowly-limited to certain compliance requirements.
▪ IT and/or cybersecurity personnel use an informal process to govern statutory, regulatory and contractual compliance obligations.

Level 2 Planned Tracked

Compliance (CPL) capabilities are requirements-driven, but are not standardized across the entity (e.g., local/regional level consistency). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity.
▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are documented and maintained by process owners.
▪ IT and/or cybersecurity personnel work with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address applicable statutory, regulatory and/or contractual requirements for Technology Assets, Applications, Services and/or Data (TAASD).
▪ Compliance management controls-related controls are primarily administrative and preventative in nature (e.g., policies, standards and procedures & guidelines).
▪ Compliance management may be a defined function (e.g., team or department) or assigned as an additional duty to existing IT and/or cybersecurity personnel.
▪ External compliance requirements for cybersecurity and data privacy are identified and documented, based on applicable laws, regulations and contractual obligations.

Level 3 Well Defined

Compliance (CPL) capabilities are standardized across the entity for applicability to People, Processes, Technologies, Data and/or Facilities (PPTDF) to ensure consistency for Technology Assets, Applications, Services and/or Data (TAASD). Capability criteria associated with this control reasonably expect the following criteria to exist:
▪ Policies and standards associated with CPL domain capabilities are formally documented and centrally-managed by the entity's Governance, Risk & Compliance (GRC) team, or similar function.
▪ Standardized Operating Procedures (SOP) associated with CPL domain capabilities are well-documented and kept current by process owners.
▪ A Governance, Risk & Compliance (GRC) team, or similar function, is appropriately staffed and supported to implement and maintain CPL domain capabilities.
▪ Technology is leveraged to enhance the efficiency and accuracy of governance, risk management and compliance operations (e.g., GRC platform).
▪ The entity's Governance, Risk & Compliance (GRC) team, or similar function, works with business stakeholders and process owners to appropriately scope and reasonably implement cybersecurity and data protection controls associated with CPL domain capabilities to address Minimum Compliance Requirements (MCR) (e.g., applicable statutory, regulatory and/or contractual requirements) and Discretionary Security Requirements (DSR) (e.g., entity-required controls).
▪ An implemented and operational capability exists to take corrective action to remediate instances of non-conformity with applicable statutory, regulatory, and/or contractual compliance obligations.

Level 4 Quantitatively Controlled

Utilize SCR-CMM Level 3 criteria definitions:
▪ There are no defined Level 4 criteria, since it is reasonable to assume a quantitatively-controlled process is not necessary to operationalize this control.
▪ While it may be possible to develop “metrics-driven” capabilities for this control, the criteria would be organization-specific to define.

Level 5 Continuously Improving

Utilize SCR-CMM Level 3 or Level 4 (if available) criteria definitions:
▪ There are no defined Level 5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to operationalize this control.
▪ Level 5 capabilities should be considered “world-class” where the control builds on Level 4 capabilities, but are continuously improving through Artificial Intelligence (AI) and/or Machine Learning (ML) technologies.
▪ While it may be possible to develop responsive capabilities for this control through the use of AI and/or ML technologies, the criteria would be organization-specific to define.