Identify the missing words in the following sentence.

Clause 4.4 of ISO/IEC 27001:2022 states:

“The organization shall establish, implement, maintain and continually improve an information security management system, including the processes needed and their interactions, in accordance with the requirements of this document.”

This requirement highlights that an ISMS is not static; it must evolve continuously to adapt to new risks, technologies, and business changes. Options A, C, and D are not mentioned in the clause. The continual improvement cycle is central to ISO standards, aligning with thePlan-Do-Check-Act (PDCA)model.

Thus, the missing words are“continually improve.”