Provided is a security management system for managing the security of a managed system including during operation of the managed system, the security management system comprising: state changing means for determining a state that satisfies a state rule, which defines a desired state of the managed system, as a target state if the state of the managed system does not satisfy the state rule; and action determining means for determining a predetermined process, which is for changing the difference between the state of the managed system when the target state is determined and the target state, as a countermeasure that needs to be carried out in the state of the managed system when the target state is determined.