1. A method of determining and enforcing a policy on an electronic device comprising: collecting operational data corresponding to operation of the electronic device; determining a risk factor based on the data; setting the policy corresponding to the risk factor, the policy including measurement criteria and sanctions for non-compliance to the policy; collecting measurement data, according to the measurement criteria, at a secure component within the electronic device, for determining compliance to the policy.