Does Civi CRM have ISO 27001? And is it compliant with ISO 27002 and ISO 27017?
The standards you reference all relate to information security infrastructure and processes. It doesn't look to me like they apply directly at the application layer.

CiviCRM is going to rely on the security of the underlying platform (LAMP stack) and how it's managed. I suggest you rephrase your question with a specific concern about CiviCRM.