1. A security operation management system for managing the security of a managed system including during operation of the managed system, the security operation management system comprising: state changing means for determining a state satisfying a state rule, which defines a desired state for the security of diagnostic items of the managed system, as a target state if the state of the managed system does not satisfy the state rule; and action determining means for determining a countermeasure, which is for changing the state of the diagnostic items in a state different from the target state to the target state, as a countermeasure that needs to be carried out based on action information defined in advance.