An intrusion prevention device (10, 10A, 10B, 10C) comprising: a reception unit configured to receive, from a control target device connected to an industrial device, a notification indicating a current state of the control target device, to receive, from the industrial device, a notification about a place of the industrial device, and to receive, from a scheduler configured to manage current date and time and a schedule for the industrial device, a notification about time; a monitoring unit configured to receive a control command transmitted from a control device to the control target device; a specification unit configured to specify a current state of the control target device a current time zone, and the place of the industrial device based on the notification received by the reception unit, and to specify a state after transition that is made in a case in which the control target device receives the control command received by the monitoring unit; a storage unit configured to store therein a table in which processing content indicating whether to permit or block passage of the control command is specified in advance for each combination of a current state of the control target device, a state after transition made by receiving the control command, and a time zone, and a place of the industrial device;_and a determination unit configured to acquire, from the table stored in the storage unit, the processing content corresponding to the combination of the current state of the control target device, the state after transition, the current time zone, and the place of the industrial device specified by the specification unit, and to determine whether to permit or block passage of the control command received by the monitoring unit in accordance with the acquired processing content. a reception unit configured to receive, from a control target device connected to an industrial device, a notification indicating a current state of the control target device, to receive, from the industrial device, a notification about a place of the industrial device, and to receive, from a scheduler configured to manage current date and time and a schedule for the industrial device, a notification about time; a monitoring unit configured to receive a control command transmitted from a control device to the control target device; a specification unit configured to specify a current state of the control target device a current time zone, and the place of the industrial device based on the notification received by the reception unit, and to specify a state after transition that is made in a case in which the control target device receives the control command received by the monitoring unit; a storage unit configured to store therein a table in which processing content indicating whether to permit or block passage of the control command is specified in advance for each combination of a current state of the control target device, a state after transition made by receiving the control command, and a time zone, and a place of the industrial device;_and a determination unit configured to acquire, from the table stored in the storage unit, the processing content corresponding to the combination of the current state of the control target device, the state after transition, the current time zone, and the place of the industrial device specified by the specification unit, and to determine whether to permit or block passage of the control command received by the monitoring unit in accordance with the acquired processing content.