Abstract: An information processing system includes a first acquisition unit configured to acquire first information indicating a state of a control system including a control device in response to an occurrence of a request or an event related to an abnormality that has occurred in the control system, an abnormality detail determination unit configured to determine details of the abnormality that has occurred on the basis of the first information, a second acquisition unit configured to request, in accordance with the details of the abnormality, a user to provide second information and acquire the second information from the user, a cause conjecture unit configured to conjecture a cause of the abnormality that has occurred on the basis of the first information and the second information, and a notification means configured to notify the user of the conjectured cause of the abnormality.