A device management apparatus (100; 1100; 2100; 3100) comprising: a setting information acquisition unit (153; 2153; 3153) that acquires setting information of one or more security setting items from a device; a policy information acquisition unit (155; 3155) that acquires policy information for each security setting item, the policy information defining a single piece of compliant information, a plurality of pieces of compliant information, or a compliant range; and a determination unit (159; 2159) that determines whether the setting information of the one or more security setting items conforms to the policy information; characterised by: a change unit (161; 1161) that changes, when a corresponding piece of the setting information of any one of the security setting items does not conform to a corresponding piece of the policy information, the corresponding piece of the setting information so as to conform to the corresponding piece of the policy information; and a distribution unit (163; 3163) that distributes the changed setting information of the security setting item to the device; wherein the setting information acquisition unit further acquires kind information indicating a kind of the device from the device (10, 2010, 2020, 2030), the policy information defines a kind of the applied device for each security setting item, and the determination unit determines whether a setting value of a security setting item to be determined conforms to the compliant value/compliant range associated with the kind indicated by the kind information in the policy information. a setting information acquisition unit (153; 2153; 3153) that acquires setting information of one or more security setting items from a device; a policy information acquisition unit (155; 3155) that acquires policy information for each security setting item, the policy information defining a single piece of compliant information, a plurality of pieces of compliant information, or a compliant range; and a determination unit (159; 2159) that determines whether the setting information of the one or more security setting items conforms to the policy information; characterised by: a change unit (161; 1161) that changes, when a corresponding piece of the setting information of any one of the security setting items does not conform to a corresponding piece of the policy information, the corresponding piece of the setting information so as to conform to the corresponding piece of the policy information; and a distribution unit (163; 3163) that distributes the changed setting information of the security setting item to the device; wherein the setting information acquisition unit further acquires kind information indicating a kind of the device from the device (10, 2010, 2020, 2030), the policy information defines a kind of the applied device for each security setting item, and the determination unit determines whether a setting value of a security setting item to be determined conforms to the compliant value/compliant range associated with the kind indicated by the kind information in the policy information. a change unit (161; 1161) that changes, when a corresponding piece of the setting information of any one of the security setting items does not conform to a corresponding piece of the policy information, the corresponding piece of the setting information so as to conform to the corresponding piece of the policy information; and a distribution unit (163; 3163) that distributes the changed setting information of the security setting item to the device; wherein the setting information acquisition unit further acquires kind information indicating a kind of the device from the device (10, 2010, 2020, 2030), the policy information defines a kind of the applied device for each security setting item, and the determination unit determines whether a setting value of a security setting item to be determined conforms to the compliant value/compliant range associated with the kind indicated by the kind information in the policy information.