An information processing system that facilitates management of information security policy even for an extended application installed from exterior. A receiving unit receives security policy data in which a security policy is described. A management unit manages an extended application that can be added and deleted and that operates in an image processing apparatus. A notification unit notifies an administrator of error information about a security policy of an extended application managed by the management unit, when the extended application managed by the management unit does not comply with the security policy described in the security policy data, and when an identifier of an extended application that is extracted from the security policy data and that is excepted from applying the security policy does not match with the identifier of the extended application managed by the management unit.