Such a rating system provides not only a measure of performance and awareness , but it also places primary responsibility for information security with the managers whose operations depend on it .
This type of rating system creates a measure of performance and warrants , but it also makes the manager who depends on certain information security the one responsible for that information security .