A device management apparatus includes a setting information acquisition unit that acquires setting information of one or more security setting items from a device; a policy information acquisition unit that acquires policy information defining a single piece of compliant information, a plurality of pieces of compliant information, or a compliant range, for each security setting item; a determination unit that determines whether each of the setting information of the one or more security setting items conforms, based on the policy information; a change unit that changes, when the setting information of any security setting item does not conform, the setting information so as to conform; and a distribution unit that distributes the changed setting information of the security setting item to the device.