The character of the device management apparatus resides in that: the apparatus includes a device configuration information holding part for holding configuration information on the device; a subscriber information holding part for holding subscriber information of the service; a security policy holding part for holding security policy set on the basis of the configuration information or the subscriber information; a module state holding part for holding state information on the module acquired from the device; and a device diagnosis part for making a diagnosis of the configuration of the device by comparing the security policy with the state information on the module.