Which of the following has the GREATEST impact on the implementation of an information security governance model?

The complexity of the organizational structure has the greatest impact on the implementation of an information security governance model. The model must be tailored to fit the organization's decision-making processes, reporting lines, and degree of centralization or decentralization. A complex, multinational conglomerate with autonomous business units requires a fundamentally different (e.g., federated) governance model than a small, centralized organization. Factors like budget, employee count, and location are components of this overall complexity but do not shape the governance framework as profoundly as the core organizational structure.

A. The organizational budget is a constraint and an enabler, but the governance model is designed to fit the structure first, which then determines budget needs.
B. The distance between physical locations is a logistical factor that contributes to complexity but is subordinate to the overall organizational and reporting structure.
C. The number of employees is a measure of scale, but a smaller organization with a complex structure may require a more intricate governance model than a larger, simpler one.

1. Peterson, R. R. (2004). Crafting information technology governance. Information Systems Management, 21(4), 7-22. https://doi.org/10.1201/1078/44705.21.4.20040901/84187.2. The paper highlights that governance structures (e.g., centralized, federal, decentralized) must be aligned with the firm's organizational structure.

2. ISACA. (2019). COBIT 2019 Framework: Design Guide. Page 16, Section 3.3. Lists "Enterprise size" and "Role of IT" as design factors, which are directly related to organizational complexity and structure.

3. Weill, P., & Ross, J. W. (2004). IT Governance: How Top Performers Manage IT Decision Rights for Superior Results. Harvard Business School Press. Chapter 3 discusses how different organizational structures necessitate different IT governance archetypes.