> I don't think self-hosting gitlab is enough to claim ISO/IEC 27001

probably not. but it does mean you can focus on the rest of your stack rather than having to go through every single process from the ground up.