A method for restricting access to encrypted content stored on a computing device , wherein the computing device comprises an application , a decryption agent , a data store , a security assessment client and a key management client , the method comprising: obtaining , by the decryption agent , metadata from the data store in response to an access request by the application , wherein the metadata comprises a key identifier and an encrypted header containing a content-decryption key for decrypting the encrypted content; forwarding , by the decryption agent , the encrypted header and key identifier to the key management client ; requesting , by the key management client , a security assessment token from the security assessment client ; assessing whether the security of the computing device meets specified criteria by: forwarding, by the security assessment client , the security assessment token to the key management client ; forwarding , by the key management client , the security assessment token and key identifier to a key management server ; and if it is decided, at the key management server , based on the security assessment token and the key identifier, that decryption of the content is authorised, and if the authenticity of the security assessment token is verified, receiving , at the key management client , a header decryption key from the key management server ; performing, at the key management client , decryption of the encrypted header based on the header decryption key received from the key management server to produce a decrypted header; obtaining , by the decryption agent , the encrypted content from the data store ; and using , by the decryption agent , the content-decryption key from the decrypted header to decrypt the encrypted content. obtaining , by the decryption agent , metadata from the data store in response to an access request by the application , wherein the metadata comprises a key identifier and an encrypted header containing a content-decryption key for decrypting the encrypted content; forwarding , by the decryption agent , the encrypted header and key identifier to the key management client ; requesting , by the key management client , a security assessment token from the security assessment client ; assessing whether the security of the computing device meets specified criteria by: forwarding, by the security assessment client , the security assessment token to the key management client ; forwarding , by the key management client , the security assessment token and key identifier to a key management server ; and if it is decided, at the key management server , based on the security assessment token and the key identifier, that decryption of the content is authorised, and if the authenticity of the security assessment token is verified, receiving , at the key management client , a header decryption key from the key management server ; forwarding, by the security assessment client , the security assessment token to the key management client ; forwarding , by the key management client , the security assessment token and key identifier to a key management server ; and if it is decided, at the key management server , based on the security assessment token and the key identifier, that decryption of the content is authorised, and if the authenticity of the security assessment token is verified, receiving , at the key management client , a header decryption key from the key management server ; performing, at the key management client , decryption of the encrypted header based on the header decryption key received from the key management server to produce a decrypted header; obtaining , by the decryption agent , the encrypted content from the data store ; and using , by the decryption agent , the content-decryption key from the decrypted header to decrypt the encrypted content. <EOS>