I'm in the process of defining the scope definition according to ISO 27001 for a company whose core business process is based on the analysis of health-related data. The IT infrastructure is entirely based on the cloud and the company has no dedicated physical location. This is a small size organization (20+ people) all work remotely by connecting to the cloud.
Given this scenario, can we implement ISO 27001 for my organization without a dedicated location? The organization is registered.