A method for securing a client , comprising: storing policy data in the client , wherein the policy data is capable of being updated from a server via communication with an operating system agent in the client , and wherein the policy data describes one or more security policies followed by the client ; characterized in that : a BIOS agent performs said storing of the policy data, wherein the policy data is stored within a BIOS of the client ; the BIOS agent is one or more modules operating at runtime in the BIOS of the client ; the BIOS agent checks that at least one module of the operating system agent is operating correctly and if the module is deleted or corrupted, the BIOS agent reinstalls or recovers it; and in response to the client following at least one of the one or more security policies, a persistent storage medium of the client is locked by instructing a controller of the persistent storage medium to deny, to any entity, and even if the persistent storage medium is removed from the client and installed on a different client , access to data stored on the persistent storage medium unless the entity supplies, to the controller, a recognized authentication credential. storing policy data in the client , wherein the policy data is capable of being updated from a server via communication with an operating system agent in the client , and wherein the policy data describes one or more security policies followed by the client ; characterized in that : a BIOS agent performs said storing of the policy data, wherein the policy data is stored within a BIOS of the client ; the BIOS agent is one or more modules operating at runtime in the BIOS of the client ; the BIOS agent checks that at least one module of the operating system agent is operating correctly and if the module is deleted or corrupted, the BIOS agent reinstalls or recovers it; and in response to the client following at least one of the one or more security policies, a persistent storage medium of the client is locked by instructing a controller of the persistent storage medium to deny, to any entity, and even if the persistent storage medium is removed from the client and installed on a different client , access to data stored on the persistent storage medium unless the entity supplies, to the controller, a recognized authentication credential. a BIOS agent performs said storing of the policy data, wherein the policy data is stored within a BIOS of the client ; the BIOS agent is one or more modules operating at runtime in the BIOS of the client ; the BIOS agent checks that at least one module of the operating system agent is operating correctly and if the module is deleted or corrupted, the BIOS agent reinstalls or recovers it; and in response to the client following at least one of the one or more security policies, a persistent storage medium of the client is locked by instructing a controller of the persistent storage medium to deny, to any entity, and even if the persistent storage medium is removed from the client and installed on a different client , access to data stored on the persistent storage medium unless the entity supplies, to the controller, a recognized authentication credential. <EOS>