27001 doesn’t actually explicitly dictate anything other than the structure and operation of the ISMS itself. The selection of appropriate security controls t

27001 doesn’t actually explicitly dictate anything other than the structure and operation of the ISMS itself. The selection of appropriate security controls to implement is made on the basis of a risk assessment, and although the standard security controls which you are compelled to consider are explicitly listed in appendix A, the actual fine grained implementation of them is not prescribed at all. There’s nothing stopping you implementing something better than the now slightly outdated recommendations/best practice for those controls found in 27002. It is guidance only, and if you have good reason to implement a control in a different way, or to not implement a control that is listed but instead treat a risk with an entirely different control you are free to do that. That’s not to say that 27001 doesn’t have other flaws, and that it isn’t sold/understood as being something it’s not in a problematic way.