Building Sustainable Cyber Security Through a Quality Management System (QMS)

The rapid development of digital technologies has increased organizational dependence on information systems while simultaneously creating increasingly complex cybersecurity threats. Cyberattacks, data breaches, ransomware, and information security vulnerabilities have become significant challenges that threaten operational continuity, stakeholder trust, and organizational sustainability. Therefore, organizations require a systematic approach that not only focuses on technical protection but also supports continual improvement and effective governance. This study aims to examine the role of a Quality Management System (QMS) in building sustainable cybersecurity by integrating quality management principles with information security management frameworks, particularly ISO 9001 and ISO/IEC 27001. This research employs a qualitative approach through a literature review and organizational case analysis. Data were collected from academic publications, international standards, industry reports, and documented cases related to QMS implementation and cybersecurity governance. The findings indicate that QMS contributes significantly to cybersecurity sustainability through risk-based thinking, standardized security processes, continual improvement mechanisms, effective documentation, and enhanced organizational accountability. The integration of the Plan-Do-Check-Act (PDCA) cycle enables organizations to transition from reactive cybersecurity practices to proactive and adaptive security governance. Furthermore, QMS implementation improves regulatory compliance, strengthens organizational security culture, and supports organizational resilience in responding to evolving cyber threats. This study concludes that QMS is not merely a quality management framework but also a strategic approach to developing sustainable cybersecurity capabilities. The integration of QMS with cybersecurity standards provides organizations with a comprehensive foundation for achieving long-term information security, operational reliability, and digital resilience.