Identify the missing words in the following sentence. The organization shall establish, ________, maintain, and continually improve an information…

The sentence is a direct quote from ISO/IEC 27001:2022, Clause 4.4. The full sentence reads: "The organization shall establish, implement, maintain and continually improve an information security management system, in accordance with the requirements of this document." This phrase describes the complete, ongoing lifecycle of the ISMS. It aligns with the Plan-Do-Check-Act (PDCA) cycle, where "establish" is Plan, "implement" is Do, "maintain" is Check, and "continually improve" is Act.

(Assuming plausible incorrect options)

B. document: Documentation is a required component (Clause 7.5) but is an element of establishing and maintaining the ISMS, not a separate primary action in this sequence.

C. review: Review is part of the "Check" and "Act" phases (e.g., Clause 9.3 Management review) and is integral to maintenance and continual improvement, not a distinct step here.

D. certify: Certification is an optional, external audit process to verify conformance with the standard, not a core action performed by the organization itself in the ISMS lifecycle.

1. ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection — Information security management systems — Requirements, Clause 4.4 "Information security management system".