Yes. You can outsource as many controls in ISO 27002 as is appropriate to your organisation.