A method for restricting access to encrypted content stored on a computing device, wherein the computing device comprises an application, a decryption agent, a data store, a security assessment client and a key management client, the method comprising: obtaining (406, 408), by the decryption agent, metadata from the data store in response to an access request by the application, wherein the metadata comprises a key identifier and an encrypted header containing a content-decryption key for decrypting the encrypted content; forwarding, by the decryption agent, the encrypted header and key identifier to the key management client; requesting, by the key management client, a security assessment token from the security assessment client; assessing whether the security of the computing device meets specified criteria by: forwarding, by the security assessment client, the security assessment token to the key management client; forwarding, by the key management client, the security assessment token and key identifier to a key management server; and if it is decided, at the key management server, based on the security assessment token and the key identifier, that decryption of the content is authorised, and if the authenticity of the security assessment token is verified, receiving, at the key management client, a header decryption key from the key management server; performing, at the key management client, decryption of the encrypted header based on the header decryption key received from the key management server to produce a decrypted header; obtaining (408, 434), by the decryption agent, the encrypted content from the data store; and using (432, 434), by the decryption agent, the content-decryption key from the decrypted header to decrypt the encrypted content. obtaining (406, 408), by the decryption agent, metadata from the data store in response to an access request by the application, wherein the metadata comprises a key identifier and an encrypted header containing a content-decryption key for decrypting the encrypted content; forwarding, by the decryption agent, the encrypted header and key identifier to the key management client; requesting, by the key management client, a security assessment token from the security assessment client; assessing whether the security of the computing device meets specified criteria by: forwarding, by the security assessment client, the security assessment token to the key management client; forwarding, by the key management client, the security assessment token and key identifier to a key management server; and if it is decided, at the key management server, based on the security assessment token and the key identifier, that decryption of the content is authorised, and if the authenticity of the security assessment token is verified, receiving, at the key management client, a header decryption key from the key management server; forwarding, by the security assessment client, the security assessment token to the key management client; forwarding, by the key management client, the security assessment token and key identifier to a key management server; and if it is decided, at the key management server, based on the security assessment token and the key identifier, that decryption of the content is authorised, and if the authenticity of the security assessment token is verified, receiving, at the key management client, a header decryption key from the key management server; performing, at the key management client, decryption of the encrypted header based on the header decryption key received from the key management server to produce a decrypted header; obtaining (408, 434), by the decryption agent, the encrypted content from the data store; and using (432, 434), by the decryption agent, the content-decryption key from the decrypted header to decrypt the encrypted content.