If you were to assess the compliance posture of a new cloud application, what steps would you take to ensure it aligns with ISO/IEC 27001?