Such a rating system provides not only a measure of performance and awareness, but it also places primary responsibility for information security with the managers whose operations depend on it.
This type of rating system creates a measure of performance and warrants, but it also makes the manager who depends on certain information security the one responsible for that information security.
Under this rating system, managers will have no responsibility for making sure information is secure.  