A security support and evaluation system in accordance with the present invention accepts from an operator via an input unit 16, a first specification of a system to be evaluated and a second specification of each of the components constituting the system, and then retrieves data from a security countermeasure database 131 stored in an external storage unit 13 and reads out security countermeasures to be executed to each of the components of the specified system to be evaluated, and then displays on a display unit 17, the security countermeasures read out in correspondence with each of the components of the specified system to be evaluated, and then accepts from the operator via the input unit 16, information whether or not each of the security countermeasures is executed, and thereafter evaluates the state of security based on the information and displays evaluation results on the display unit 17.