Ensuring compliance with legal regulations: While compliance is important and often a byproduct of effective security measures, it's not the primary objective of security assessment and testing. Some assessments are geared towards compliance, but their primary function still revolves around identifying weaknesses and vulnerabilities that could affect compliance. 

Identifying vulnerabilities and weaknesses: This is the core reason for security assessment and testing. The objective is to find any weaknesses before an attacker does, so they can be fixed to improve the overall security posture of an organization. 

Establishing incident response procedures: Incident response is crucial for handling and recovering from security incidents, but it is not the primary objective of security assessment and testing. However, findings from such assessments can certainly inform and improve incident response procedures. 

Developing security policies and procedures: While the insights gained from security assessment and testing could be used to develop or refine security policies and procedures, the primary objective remains the identification of vulnerabilities and weaknesses.