A computer implemented method of monitoring the operational state of a computer, comprises running on the monitored computer a monitoring program configured to monitor a set of parameters. The set of monitored parameters comprises for example the name(s) of any process(es) running on the computer, together with i) the values of a plurality of metrics indicating the level of activity of the computer, and/or ii) time. The monitored parameters are provided by the monitoring program to another, monitoring, computer; which runs a comparison program which compares the set of monitored parameters with a predetermined model which determines whether or not the monitored computer is in a predetermined operational state defined by the model, and produces an indication of whether or not the monitored computer complies with the model.