The purpose of it is to protect the organization from threats, including computer security threats, and handle situations when they do occur. A security policy must identify all of a company's assets as well as all the potential threats to those assets.