According to the present invention, a security management program which is recorded in a computer readable recording medium and is used to control access to target data in accordance with a security level of a device and an access right of a user, comprises a code of a user authentication step of setting the access right of the user with reference to a saved user authentication history when access to an authentication server cannot be made; and a code of a security level setting step of determining a security level of the device in accordance with a state of the device, and saving the determined security level.