A system for protecting a computing platform from unauthorized access, comprising: a host processor coupled to a first wireless communication device to receive location-based information from a positioning device; a firmware service configured to run during boot on the host processor to verify that the computing platform is authorized for operation, the authorization based at least on location-based information received from the positioning device and predefined platform policy; and a runtime service configured to verify that the computing platform is authorized for operation, the authorization based at least on location-based information received from the positioning device and pre-defined platform policy, characterized in that the system includes an out-of-band processor (111, 510n) different from and operating independently from the host processor, the out-of-band processor (111, 510n) in communication with the host processor and powered independently of the host processor to enable operation independent of the status of the host processor; the runtime service being configured: to run after boot on the out-of-band processor independent of the status of the host processor; to allow normal operation when the platform is within range of a location defined in the platform policy and when a physical security device is within proximity of the platform and an identifier associated with the physical security device is authenticated by the runtime service; and to perform at least one of the following: lock-up the platform, force the platform to execute a screensaver, or shutdown the platform, if the platform is not within range of the location defined in the platform policy and/or when the physical security device is not within proximity of the platform and/or an identifier associated with the physical security device is not authenticated by the runtime service. a host processor coupled to a first wireless communication device to receive location-based information from a positioning device; a firmware service configured to run during boot on the host processor to verify that the computing platform is authorized for operation, the authorization based at least on location-based information received from the positioning device and predefined platform policy; and a runtime service configured to verify that the computing platform is authorized for operation, the authorization based at least on location-based information received from the positioning device and pre-defined platform policy, characterized in that the system includes an out-of-band processor (111, 510n) different from and operating independently from the host processor, the out-of-band processor (111, 510n) in communication with the host processor and powered independently of the host processor to enable operation independent of the status of the host processor; the runtime service being configured: to run after boot on the out-of-band processor independent of the status of the host processor; to allow normal operation when the platform is within range of a location defined in the platform policy and when a physical security device is within proximity of the platform and an identifier associated with the physical security device is authenticated by the runtime service; and to perform at least one of the following: lock-up the platform, force the platform to execute a screensaver, or shutdown the platform, if the platform is not within range of the location defined in the platform policy and/or when the physical security device is not within proximity of the platform and/or an identifier associated with the physical security device is not authenticated by the runtime service. to run after boot on the out-of-band processor independent of the status of the host processor; to allow normal operation when the platform is within range of a location defined in the platform policy and when a physical security device is within proximity of the platform and an identifier associated with the physical security device is authenticated by the runtime service; and to perform at least one of the following: lock-up the platform, force the platform to execute a screensaver, or shutdown the platform, if the platform is not within range of the location defined in the platform policy and/or when the physical security device is not within proximity of the platform and/or an identifier associated with the physical security device is not authenticated by the runtime service.