A device holding control target data includes a management unit configured to manage the present life cycle state of the device; an authentication unit configured to authenticate a user and indicate a role of the user; a control unit configured to acquire a present life cycle state when a request to access the control target data is received, authenticate the user and acquire the role, acquire access possibility information based on the present life cycle state and the role, and control the access based on the access possibility information; and a prohibiting unit configured to compare a position/time allowed in operation plan information with a present position/time, and prohibit the access when these information items do not match, based on the operation plan information in which life cycle states are associated with positions and times that are allowed for state transitions of the life cycle states.