PUMA

PUMA kicks into high gear with agile vendor risk management

Multinational sports brand reinvents vendor risk management with collaborative, organization-wide approach

Reinventing vendor risk management
Easing the assessment workload
Fostering a risk-aware culture
Gaining global traction
Driving security at scale

Overview

Industry: Retail and Manufacturing

Region: International

Company size: Enterprise

Featured solutions: Third-party Management, IT and Security Risk Management, Cookie Consent, Mobile App Consent

Looking at PUMA’s vendor risk management process, you wouldn’t think it launched just a year ago. But it did.

“We noticed that several other companies experienced data breaches and we wanted to improve our policies. With regulations and requirements getting more complex, we required a better system to check external vendors,” says Marco Preissinger, Senior Manager Information Security at PUMA SE.

In the past, PUMA lacked a standardized way to manage vendor risks from an information security and data privacy point of view.

“We wanted to know the exact IT risks tied to our current vendors and get a more consistent evaluation of new vendors,” recalls Florian Brandner, Director Global Information & Cyber Security at PUMA SE. “Using the OneTrust platform, our teams were able to create a clear framework for evaluating and monitoring vendor risks.”

This became PUMA’s Vendor Check process. Since it launched in 2023, the team has onboarded 250 vendors, reduced the process to an average of 17 days, and cut down its process time by 80% — and it’s just getting started.

"Implementing OneTrust has accelerated our team's efficiency, cutting down our process time by 80% and reducing vendor onboarding to an average of 17 days. This efficiency has led to significant time savings, optimized resource utilization, and smoother operations."

Marco Preissinger, Senior Manager Information Security at PUMA SE

Reinventing vendor risk management

PUMA works with hundreds of independent suppliers and thousands of vendors across the globe, which meant the team needed to hit the ground running.

“We really benefit from the templates library in OneTrust,” says Preissinger. “For us as a German company, the ISO templates were especially of great use. But we also pulled questions from other templates, so it was like a supermarket — a little bit of NIST, a pinch of ISO, and round it out with some GDPR. We did some rephrasing to fit our PUMA wording and OneTrust does the magic after.”

The team decided to take a creative and proactive approach to mitigating vendor risks. While most organizations simply notify vendors when risks arise, PUMA goes a step further by including a technical damage scenario that details the potential impact and a treatment plan with suggestions for remediation.

“We’re not just pointing out the risks. We notice vendors need a little bit more help to understand and mitigate risks, so we create what we call treatment plans. They're very simple; I would say five or six steps to mitigate one risk,” says Preissinger.

They’ve seen an impressive adoption rate, with most vendors willing to address the risk. “The usage of the OneTrust platform has been instrumental in strengthening our relationships with vendors, as it allows us to provide them with targeted advice on mitigating risks based on our standardized treatment plans,” adds Brandner.

This creates a mutually advantageous situation, where a vendor increases the security and reliability of its service, and PUMA as their customer effectively reduces overall risk.

Easing the assessment workload

But the team didn’t stop there. After observing that vendors are often bombarded with assessments, they decided to lighten the workload by including only questions relevant to PUMA.

“Some vendors provide a lot of services. For example, Microsoft has everything, but what if we only use a fraction of what they offer, like the Exchange email?” explains Preissinger.

As part of the Vendor Check, the team created what they call the “business pit stop,” where they ask specific business units a few fast questions that help put the vendor in the right context. Dynamic assessments are then built in OneTrust, using conditional logic to further enhance the questionnaire based on each vendor answer.

The result? “We were able to reduce and simplify the assessment for the vendor, the business, and us as the reviewer,” says Preissinger. “The uniform approach ensures consistent and comprehensive risk handling, leading to a more robust risk management framework. As a result, our responses are faster and more effective, contributing to the overall resilience of PUMA.”

"Even though we’re a sporty, agile, fast brand, in terms of vendor risk management, we came from an Excel and Word world.

We have found and sorted 1,500 risks so far and with OneTrust, we can leverage these to make faster and smarter decisions and get better at dealing with risks. I think we are now much closer to an ideal situation with OneTrust."

Marco Preissinger, Senior Manager Information Security at PUMA SE

Fostering a risk-aware culture

Streamlining the vendor risk process gave the team time to focus on its top priority: increasing awareness and understanding of risk within the company.

“If one responsible business unit is not included, it will not work. We needed to establish a process that enables continuous improvements and brings everyone to the table,” explains Preissinger. “We don’t need everyone to be privacy or security specialists, but a risk-aware culture helps us expedite the process.”

Regular meetings are also where a lot of the learning happens, as stakeholders from all the different departments across PUMA bring their own concerns and viewpoints about the process.

Timo Stauber, Legal Counsel Data Protection at PUMA SE, attests to the benefits of taking risk into consideration. “Vendor Checks are useful for us legal counsels in the data protection sector,” he says.

“The assessments give a quick overview of vendors and the use of a planned tool or project. We carry out an initial data protection evaluation and, if necessary, a more in-depth legal review. If the deployment of the vendor is permissible from a legal data protection perspective, we conduct the data protection contract negotiations based on the assessment and any existing risks.”

This collaborative approach has led to a cultural shift at PUMA. Stakeholders are now more concerned about potential risks and know that every vendor they want to use will need to go through the Vendor Check process.

“Bringing people closer together has been the biggest improvement,” says Preissinger. “This is where OneTrust helps a lot because we’re able to centralize processes to make faster, more informed decisions, and increase risk awareness throughout PUMA.”

From left: Timo Stauber, Daniela Dillmann, Florian Brandner, Wei Lo, Marco Preissinger

Gaining global traction

The Vendor Check process saw early success in building awareness and reducing risk and is currently being introduced to global subsidiaries through a system called ‘location onboarding’.

Beginning in PUMA North America, the team spent a week at its Massachusetts office to introduce their established policies and best practices.

The week was spent working closely with senior management to define their existing risk management processes, input them into OneTrust, and plan marketing campaigns for other business units. At the end of location onboarding, all details were compiled in a neat package and handed over to the local team.

“Without OneTrust, it would not be possible to have the agility and flexibility to adjust to local regulations and laws. It’s still a complex task, but the tool removes the uncertainty of knowing what to ask,” says Preissinger.

Looking forward, location onboarding is scheduled for multiple other regions: Chile, LATAM, Europe, EMEA, Austria, Hong Kong, Dubai, and the Nordics.

“We would like to visit all the different PUMA entities and show our colleagues the OneTrust software as a whole, and the Vendor Check in particular,” says Daniela Dillmann, Legal Counsel Data Protection at PUMA SE.

Driving security at scale

PUMA has been working with OneTrust since 2018, starting with its initial use of the Cookie Consent Module across all ecommerce sites. Now, more than five years later, they’ve further integrated with the platform’s Third-Party Management module and Power BI dashboards to achieve more robust and insightful analysis and internal transparency.

“Last year, we started with the Vendor Check and revised our template in the Data Mapping Automation module. With its various functionalities, OneTrust has great potential to simplify many processes here at PUMA,” says Stauber.

“In the future, procedures could be more integrated, automated. and adopted on a wide scale, including the entire vendor lifecycle and all relevant stakeholders for holistic risk management,” agrees Brandner. “This approach will guarantee seamless and efficient management of vendor relationships from start to finish.”

PUMA

PUMA kicks into high gear with agile vendor risk management

Table of contents

Overview

"Implementing OneTrust has accelerated our team's efficiency, cutting down our process time by 80% and reducing vendor onboarding to an average of 17 days. This efficiency has led to significant time savings, optimized resource utilization, and smoother operations."

Reinventing vendor risk management

Easing the assessment workload

"Even though we’re a sporty, agile, fast brand, in terms of vendor risk management, we came from an Excel and Word world.

We have found and sorted 1,500 risks so far and with OneTrust, we can leverage these to make faster and smarter decisions and get better at dealing with risks. I think we are now much closer to an ideal situation with OneTrust."

Fostering a risk-aware culture

Gaining global traction

Driving security at scale

You may also like

Ethics Program Management

From reactive to proactive: Transforming your ethics & compliance program

Join this webinar to hear experts explore actionable strategies employed by Ethics & Compliance programs to drive a more ethical culture.

September 12, 2024

Speak-Up Program Management

Modern slavery: Identifying the signs of forced labor in your supply chain

Looking up and down your organization's supply chain for key indicators is critical to preventing, identifying, and stamping out forced labor.

June 25, 2024

Speak-Up Program Management

EthicsConnect: Speak Up - Balancing Regulation with a Genuine 'Safe Space' for Employees

Network with fellow ethics professionals, collaborate in break out rooms, and learn how to over the challenges of meeting EU Whistleblower Directive compliance from experts.

June 13, 2024

Ethics Program Management

Drive employee engagement with Ethics Program Management

In this tech talk, we will walk you through the customer's employee journey utilizing our Ethics Program Management suite of tools.

May 21, 2024

Ethics Program Management

EthicsConnect: Risk - It’s not just for breakfast anymore

Join us for a deep dive into embedding privacy by design into the fabric of your business to promote the responsible use of data.

April 25, 2024

Ethics Program Management

Business messaging apps: A guide to corporate compliance

How can your business use third-party messaging apps while staying compliant? Dive into key usage considerations based on the DOJ’s 2023 guidance.

February 13, 2024

Third-Party Risk

4 top-of-mind challenges for CISOs

What key challenges do CISOs face going into the new year? Download this infographic to hear what experts from industries across the board have to say.

January 30, 2024

Third-Party Due Diligence

Best practices for conducting third-party due diligence for ethics & compliance​

Join this webinar for best practices for conducting third-party due diligence for ethics and compliance.

January 11, 2024

Ethics Program Management

Ethics Exchange: Third-party applications and ephemeral apps

Learn practical advice on how to navigate the risks of ephemeral apps and employee privacy in BYOD world.

December 05, 2023

Speak-Up Program Management

Navigating the EU Whistleblower Protection Directive: New rules, new risks

Join our expert-led webinar where we explore the EU Whistleblower Protection Directive and practical steps towards compliance.

November 02, 2023

Ethics Program Management

Ethics Exchange: Risk assessments

Join our risk assessments experts as we discuss best practices, program templates, and how provide an assessment that provides the best value for your organization.

October 25, 2023

Ethics Program Management

Ethics Exchange: Investigations

Join our live webinar and learn how to conduct comprehensive ethics investigations that are trustworthy and efficient.

September 07, 2023

Third-Party Due Diligence

Driving excellence in third-party risk management: An in-depth look at different due diligence approaches

Join our in-depth webinar and learn how to define third-party due dilligence levels and when to apply them during your vendor management lifecycle.

July 20, 2023

Third-Party Due Diligence

A shortcut to third party due diligence fundamentals

In this webinar, we examine the scope of third-party due dilligence, best practices, and industry trends driving greater scrutiny on third parties.

July 13, 2023

Third-Party Due Diligence

Sanctions and export controls: Ensuring compliance

Watch our live expert webinar on understanding global sanctions and export controls and how to reduce your organiztion's risk exposure and ensure compliance.

June 29, 2023

Third-Party Risk

Third-party management demo

See how OneTrust's third-party management solution can help scale your third-party lifecycle and evaluate vendors with real-time risk intelligence.

June 27, 2023

Ethics & Compliance

Creating an effective code of conduct

In this eBook, learn how to create an effective code of conduct with six key steps.

Best practices for conducting third-party due diligence for ethics & compliance