Abstract
Electronic document management systems (edms) hold some of an organisation's most sensitive records, yet their security is usually checked through manual checklist audits. Such audits lean heavily on the reviewer's judgement, happen only now and then, and leave little that can actually be measured. This study proposes ises-edms, a system that rates the cybersecurity posture of an edms using both expert judgement and the evidence sitting in its own logs. The system works in two stages. First, a fuzzy analytic hierarchy process weights eight security domains aligned with the confidentiality, integrity and availability model; second, an autoencoder learns what normal access looks like and flags anything abnormal in the access and audit logs. We combine the two into a composite cybersecurity posture index (ccpi) and a risk-adjusted posture index (rapi), then place the result on a five-level maturity scale.We tested the framework on the edms of a large public university, drawing on 142,560 access events recorded over ninety days. The domain weights were internally consistent (cr = 0.043), and access control and confidentiality came out as the most important domains. The autoencoder reached a precision of 0.946, recall of 0.921, f1-score of 0.933 and auc of 0.971, ahead of the isolation forest, one-class svm and local outlier factor baselines. The university scored a ccpi of 0.712, which puts it at maturity level four, and its weakest points were audit logging and vulnerability management. Where a manual audit gives an occasional snapshot, this method can be re-run whenever new log data comes in, and it produces numbers rather than impressions.