A storage device includes a storage and a controller. The controller receives commands from a host, and queues, in a command queue, the commands received from the host. The controller queues a first command, which is a command to request changing a security setting of a partial area of the storage, a second command, which is a command to access the partial area of the storage, and a third command, which is a command to access an area of the storage other than the partial area, after queuing the second command. The controller changes order of the commands queued in the command queue so that the third command is executed before the second command is executed.