According to Wikipedia1, a maturity model is a framework for measuring an organization's maturity, or that of a business function within an organization, with maturity being defined as a measurement of the ability of an organization for continuous improvement in a particular discipline. A maturity model will best indicate the effectiveness and efficiency of an organization or a business function, as it helps to evaluate how well they achieve their intended objectives with minimum resources, time, and cost. A maturity model also helps to identify and prioritize the areas and opportunities for improvement, and to establish and communicate the standards and best practices for the discipline. References = Wikipedia1

Explanation/Reference:
Explanation:
Complexity of the organizational structure will have the most significant impact on the Information security governance model. Some of the elements that impact organizational structure are multiple business units and functions across the organization.
Incorrect Answers:
A: Currency with changing legislative requirements should not have major impact once good governance models are placed, hence, governance will help in effective management of the organization's ongoing compliance.
B, D: The numbers of employees and the distance between physical locations have less impact on Information security models as well-defined process, technology and people components together provide the proper governance.

Section: Volume C
Explanation:
Risk threshold helps to identify those risks for which specific responses are needed.

Section: Volume C
Explanation:
Threat and vulnerability assessment consider the full spectrum of risks. It identifies the likelihood of occurrence of risks and impact of the significant risks on the organization using the risk scenarios. For example: Natural threats can be evaluated by using historical data concerning frequency of occurrence for given natural disasters such as tornadoes, hurricanes, floods, fire, etc.
Incorrect Answers:
A, B: These use either some technical evaluation tool or assessment methodologies to evaluate risk but do not use risk scenarios.
D: Risk assessment uses quantitative and qualitative analysis approaches to evaluate each significant risk identified.