I would like to apply ISO 27001 best practices for a company that has not completed its final online architecture yet and it is still under development phase. However, they pretty much know which technologies/systems (mainly on cloud) to be used but connections between several pieces is not finalised, as well as several security related implementations like WAF etc. Just to note everything is on cloud hosted by a cloud provider that is already ISO27001 certified for all services it provides.
The question is that if it is ok to apply risk methodology based on asset-threats-vulnerabilities and complete the required documents as suggested by several ISO27001 toolkits. This methodology is still valid for ISO 27001 and it is straightforward to apply, but obviously, this is going to be entirely qualitatively, in a sense that no penetration testing can be applied to uncover potential technical vulnerabilities and the development is not final to perform code reviews. Additionally, this risk methodology is based on the asset inventory which undergoes daily changes.
Is it ok to proceed in this way for ISO certification for a snapshot of the existing asset inventory that includes many of the deployed assets?