PROBLEM TO BE SOLVED: To implement an appropriate countermeasure at the time of anomaly.SOLUTION: A management system for an industrial control system comprises: a control apparatus; a control network connected to the control apparatus; and multiple devices controlled by the control apparatus via the control network. The management system includes multiple firewall parts provided for each of control zones each controlling one part of the industrial control system, the firewall parts relaying communication between devices in the control zones and the control network; an event analyzing part collecting events from each of the multiple firewall parts and analyzing the events to detect an anomaly of each of the control zones; and a communication managing part changing a communication operation performed via the firewall part provided for the control zone where an anomaly has been detected.