Three customers, three different assurance sentences

Clinic A - 'STAR Level 2 registration'. This is a requirement about the STAR program, not about a specific standard. Any of the Level 2 routes satisfies it: ISO/IEC 27001 plus CCM assessment, SOC 2 plus CCM, or C-STAR. C-STAR is the shortest path for Bramble because there is no prerequisite certificate to obtain first.

Clinic B - 'a current ISO/IEC 27001 certificate'. This names a specific artifact from an accredited certification body. C-STAR is not an ISO 27001 certificate and cannot satisfy it, even though both are Level 2 routes. Negotiation is required: either Bramble pursues ISO 27001, or Clinic B accepts an alternative.

Clinic C - 'SOC 2 Type II covering Security and Availability'. This requires a CPA firm's report over a period. Neither C-STAR nor ISO 27001 substitutes.

Where the CEO's plan fails: the ISO quote does not deliver by Christmas on an 11-month estimate, and even at completion ISO alone is not STAR Level 2 unless the CCM assessment is included in the engagement - so it would satisfy B and, with CCM added, A, but never C. One certificate cannot close three differently worded gates, and promising one date to all three invites three breaches.

Fourteen weeks is the assessor's estimate for a provider that can produce evidence on demand. Bramble cannot yet, so treat it as an optimistic floor rather than a plan.

• No prior audit experience. Nothing has been tested by an outsider. The first gap assessment routinely surfaces a long tail of undated policies, missing access reviews and undocumented changes. A 200-page wiki is not evidence of operation.
• One security engineer. Remediation and evidence collection will land on the same person who is running the platform, and assessment interviews will compete with BAU.
• Operating evidence takes calendar time. Assessors test whether controls operated over a period. Access reviews, vulnerability remediation and incident exercises started in week 1 cannot show a track record by week 10. A 14-week quote assumes the evidence already exists.
• Scope discipline is the main lever. Narrow the assessment to the triage platform and its production environment, with clinic-side responsibilities clearly allocated, rather than attempting enterprise-wide coverage.

A realistic expectation is 6-9 months from a cold start: 4-6 weeks of gap assessment and remediation planning, 8-12 weeks of operating evidence, then the assessment window. The quote is a useful anchor for cost, not for schedule.

Next 90 days:

1. Publish an accurate STAR Level 1 CAIQ within four weeks. It costs nothing, it is self-assessed, and it gives all three customers something real to read. Answer honestly - including where clinic-side responsibilities sit - because the same answers will be tested at Level 2.
2. Run a CCM v4 gap assessment scoped to the triage platform, and convert the wiki into dated, owned, evidence-linked controls. This work is required for every route, including ISO 27001, so it is not wasted whichever way the decision goes.
3. Book the C-STAR assessor's discovery slot now and confirm in writing that no ISO 27001 prerequisite applies to that route.
4. Decide the strategic question with the board: is ISO 27001 needed for the market Bramble sells into, independent of these three deals? If yes, start it in parallel; it is an 11-month programme and delaying it delays 2026 revenue.

What to tell each customer: Clinic A gets the Level 1 listing now, the C-STAR scope and a target date, with a contractual condition. Clinic B gets a straight answer - Bramble does not hold an ISO certificate, here is the roadmap and the date, and can the wording be met another way? Clinic C gets an honest 'not yet', plus the option of a SOC 2 readiness assessment if that market matters. None of them should be told 'STAR Level 2 by Christmas'.