Such a rating system provides not only a measure of performance and awareness, but it also places primary responsibility for information security with the managers whose operations depend on it.
This type of rating system creates a measure of performance and warrants, but it also makes the manager who depends on certain information security the one responsible for that information security.