A method comprising binding encryption and decryption keys using a unique user identifier, UID, a unique device identifier, UDID, and a user password,Pswd, to a client mobile device in an enterprise cryptography key management system wherein binding the encryption and decryption keys using the UID, the UDID, and the Pswd comprises: creating a new user account using the UID and a default password, DPswd, in an inactive state in the cryptography key management system by an administrator; communicating the UID and the DPswd to an intended user using a secure communication medium by the administrator; logging into the cryptography key management system using the UID and the DPswd via the client mobile device by the intended user upon authenticating the DPswd by the cryptography key management system; changing the DPswd to a new password (NewPswd) by the intended user; sending the NewPswd, encrypted by a cryptography key derived from the DPswd, to the cryptography key management system; decrypting the received {NewPswd}DPswd by the cryptography key management system 140 using a stored DPswd to obtain NewPswd; replacing, as the password, Pswd, the default password, DPswd, with the new password, NewPswd, if the NewPswd satisfies enterprise password security requirements; requesting the UDID from the client mobile device by the cryptography key management system; sending a hash of the unique device identifier, H(UDID), to the cryptography key management system by a key management application module; authenticating the H(UDID) at the cryptography key management system; storing at the policy engine, the H(UDID) received from the key management application module; updating the user account to an active state if the authentication is successful; and assigning a cryptography data recovery key associated with the client mobile device registering the cryptography data recovery key for the associated client mobile device with the enterprise cryptography key management system using the cryptography data recovery key, the UID, the UDID, and a unique key identifier, KeyID. creating a new user account using the UID and a default password, DPswd, in an inactive state in the cryptography key management system by an administrator; communicating the UID and the DPswd to an intended user using a secure communication medium by the administrator; logging into the cryptography key management system using the UID and the DPswd via the client mobile device by the intended user upon authenticating the DPswd by the cryptography key management system; changing the DPswd to a new password (NewPswd) by the intended user; sending the NewPswd, encrypted by a cryptography key derived from the DPswd, to the cryptography key management system; decrypting the received {NewPswd}DPswd by the cryptography key management system 140 using a stored DPswd to obtain NewPswd; replacing, as the password, Pswd, the default password, DPswd, with the new password, NewPswd, if the NewPswd satisfies enterprise password security requirements; requesting the UDID from the client mobile device by the cryptography key management system; sending a hash of the unique device identifier, H(UDID), to the cryptography key management system by a key management application module; authenticating the H(UDID) at the cryptography key management system; storing at the policy engine, the H(UDID) received from the key management application module; updating the user account to an active state if the authentication is successful; and assigning a cryptography data recovery key associated with the client mobile device registering the cryptography data recovery key for the associated client mobile device with the enterprise cryptography key management system using the cryptography data recovery key, the UID, the UDID, and a unique key identifier, KeyID.