The invention relates to a computer guard system for controlling delivery of encrypted media assets in a service which governs the delivery of a set of media assets to a group of authorised users comprising: an administrator interface configured to receive configuration data from an administrator to define at least one environment defining how media assets in that service are to be delivered to authorised users, wherein the configuration data defines, for each environment, (a) multiple DRM technologies for decrypting the same asset at multiple end user platforms, each DRM technology being associated with its own set of default license properties; (b) at least one software plug-in to be instantiated to perform a verification method to verify if an end user request for delivery of an asset is valid; a store for holding defined environments with respective environment identifiers; a key server module having an interface connectable to an encryption module and configured to: exchange (i) an asset identifier, which identifies an asset to be encrypted, (ii) a secret key for use in encrypting the asset, and (iii) a key identifier which is to be located in the encrypted asset and which identifies the secret key; execute a set of rules to compare a characteristic associated with the asset with multiple environments to associate at least one environment with the asset wherein the characteristic represents the service for which the asset is provided; and store an association between the asset and at least one determined environment, whereby multiple assets for the same service intended for delivery on different end users platforms are associated with a single environment, and wherein the configuration data for each environment identifies the default license properties and software plug-in to be applied to the asset, in dependence on the DRM technology used at the end user platform to enable the computer system to automatically respond to end user requests to play out an asset.