An apparatus for implementing a user policy includes a policy module that issues a user policy for a plurality of computing devices. Two or more of the computing devices have different hardware configurations. The apparatus includes a soft metrics module that, in response to the user policy, sends soft metrics for a computing device of the plurality of computing devices, to determine if the computing device complies with the user policy, where the soft metrics are specific to a hardware configuration of the computing device. The apparatus includes an operational data module that receives, from the computing device, operational data responsive to the soft metrics, and a compliance module that analyzes the operational data to determine if the computing device complies with the user policy.