We are currently switching over to Exchange 2013 and we are thinking about outsourcing the spam and malware filtering to Microsofts Exchange Online Protection. Its implemented by changing the MX Record of our domain to the address of their datacenter.
This would be a very practical and also relativley cheap solution for us. But we are also thinking about an ISO 27001 validation. Is the outsourcing of spam and malware filtering compliant to ISO 27001?
There's nothing in ISO27001 that would specifically preclude what you describe.
At a high level provided you have conducted a risk assessment applicable to the use of the email proxying service and the 'output' is consistent with your risk acceptance criteria it will not be incompatible with ISO27001.
Thinking more about specific control areas, as a starting point there are relevant controls/advice in 'Supplier Relationships', there are likely others that will have relevance as well (refer to the standard and decide based on the proposed solution).
Also, since you appear to be within the EU, you may want to ensure you have covered data protection requirements in the contract with the supplier (Microsoft should have standard contract clauses that are compliant with EU data protection requirements).
If you do not already have a copy I would recommend getting hold of ISO27002 which provides more detailed explanation about the controls in ISO27001.
ISO 27001 does not provide guidelines nor requirements regarding the technical setup and technology behind your controls. So there is nothing against outsourcing your email filtering protection per se.
However, you will need to make sure that the same level of control applies to your new setup compared to the previous one. E.g., access-control, monitoring events etc.
And as this is an outsourcing, you will also need to make sure that the security requirements are met for this new provider (refer to section 15 "Supplier relationships").
As indicated on above answers, there are no concern from ISO 27001 in terms of cloud/on-prem solution.
But there are ISO 27001 certified cloud services which will help in getting your compliance easily.
