Identify the missing word(s) in the following control relating to the Policies for information security...

Comprehensive and Detailed Explanation From Exact Extract ISO/IEC 27002:2022 standards:

Annex A.5.1 (Policies for information security) states:

“Information security policy and topic-specific policies should be defined, approved by management, published, communicated to and acknowledged by relevant personnel and relevant interested parties, and reviewed at planned intervals and if significant changes occur.”

This confirms that the missing words are“published, communicated to.”The control emphasizes not just defining and approving policies but ensuring they are actively distributed and communicated so that relevant stakeholders are aware of and acknowledge them. Options A, B, and D are partial but incomplete.

Thus, the correct answer isC.