An environment information distribution unit transmits a policy ID for specifying an access policy to be applied to a terminal device. An environment information reception unit notifies an access policy application management unit of a policy ID specified based on information received from the environment information distribution unit. The access policy application management unit specifies a relevant access policy from an access policy storage region which stores at least one access policy based on a notified policy ID to notify an access control management unit in an OS of information designating the access policy. The access control management unit determines whether to allow or not to allow a request from a subject to access an object based on a specified access policy.