A semiconductor fab can contain thousands of process tools and automated material handling systems, each with embedded Windows or Linux computers that arrive from suppliers, connect to the factory network and stay in service for many years. SEMI E187, Specification for Cybersecurity of Fab Equipment, sets a common minimum security baseline for those computers so that fabs and equipment suppliers stop negotiating security tool by tool. It sits alongside SEMI E188 for malware-free equipment integration and SEMI E191 for cybersecurity status reporting. This guide explains what E187 covers and who it applies to, the structure of its requirements, the identity and access questions it raises, how suppliers and fabs implement it, what evidence to ask for, and how it maps to IEC 62443 and NIST frameworks. It is for fab OT security teams, equipment supplier product security and compliance teams, and buyers writing equipment contracts. It complements the Hardware Trojans and Chip Supply Chain Guide, which covers the chips themselves rather than the tools that make them.
Key takeaways
- E187 is a baseline for tool computers. It applies to computing devices in fab equipment that run Microsoft Windows or Linux, and does not apply to PLCs, SCADA systems or devices attached to them through sensor and actuator networks.
- Four requirement areas. Operating system support, network security, endpoint protection and security monitoring, built in at design and kept up through operation and maintenance.
- E188 and E191 complete the picture. E188 governs malware-free delivery, installation and maintenance; E191 defines the OS status information suppliers report for each networked computing device.
- Buyers are making it contractual. SEMI reports that TSMC led the standard's promotion and that it has been included as a requirement in procurement contracts since 2023.
- Evidence beats declarations. Ask suppliers for OS support dates, port and protocol documentation, patching processes, vulnerability assessment and malware scan reports for each tool.
What it is and who it applies to
SEMI published E187 in January 2022 (revision E187-0122) as the first of its cybersecurity standards, followed by E188 in February 2022. SEMI describes E187 as a common, minimum set of security requirements for fab equipment. It was developed by the SEMI Fab and Equipment Information Security Task Force, led by representatives of TSMC and ITRI, and SEMI expects the requirements to evolve as threats change. SEMI Standards are voluntary technical agreements; they become binding when a fab writes them into purchase contracts.
| Standard | Title | Published | Scope |
|---|---|---|---|
| SEMI E187 | Specification for Cybersecurity of Fab Equipment | January 2022 | Windows and Linux computing devices in production equipment and automated material handling systems; excludes PLCs and SCADA |
| SEMI E188 | Specification for Malware Free Equipment Integration | February 2022 | Equipment, computing devices and systems that suppliers bring onto the factory network, during delivery, installation, upgrade, support and restoration |
| SEMI E191 | Specification for Computing Device Cybersecurity Status Reporting | October 2024 | OS details each networked computing device reports: device identifier, OS manufacturer, name, version and build number; E191.1 defines the SECS-II protocol for it |
| SEMI E169 | Guide for Equipment Information System Security | Earlier guide referenced by E187 | Guidance on equipment information system security |
Who it applies to: SEMI states E187 is intended for entities that supply equipment or services to fabs, such as equipment suppliers and system integrators. Fabs are the buyers who specify it, verify it and operate the equipment afterwards. SEMI's 2024 explainer notes that E187 focuses on network-facing computers in new equipment, while E188 applies to new and existing equipment and all computational components, including controllers and PLCs.
Status: SEMI revises its standards over time, so check the SEMI store for the current revision and its status before citing E187 in a contract.
Structure and key requirements
E187's text is sold by SEMI, so this section summarises the requirement areas as SEMI itself describes them; use the purchased standard for exact clauses.
| Area | What SEMI describes | What a fab should expect from a supplier |
|---|---|---|
| Operating system support | A SEMI article on E187 quotes the standard as saying suppliers shall not ship equipment with an end-of-life OS | OS name and version per computing device, vendor support end date, and the supplier's plan for OS updates during the tool's service life |
| Network security | Documentation of network configuration including protocols and ports, and of software upgrade and patching processes | A port and protocol list per tool, justification for each open service, use of standard secure protocols, and a patch qualification process |
| Endpoint protection | Endpoint protection as a required element of the baseline | Statement of supported anti-malware or application allowlisting, how it is qualified with the tool software, and how signatures or rules are updated |
| Security monitoring | Security monitoring as a required element; continuous monitoring and hardening of endpoints and network | Security event logs the tool produces, how they can be exported to the fab's monitoring, and the vulnerability assessment and malware scan documentation delivered with the tool |
E188 adds the integration discipline. SEMI's announcement states that suppliers must scan equipment and maintenance and support devices for malware before shipment, that E188 references trusted external sources such as NIST SCAP and the NVD with CVSS for hardening and vulnerability identification, and that it calls for configuration documentation so equipment does not introduce insecure network configurations. SEMI's 2024 explainer describes E188's focus as malware scanning, vulnerability scanning and network security, with defined scanning tools, procedures and standard reports.
Identity and NHI requirements
E187 is not an identity standard, but every requirement area depends on accounts and credentials on the tool computers. Fabs that already run an identity programme for OT should extend it to tools explicitly.
- Local and service accounts: tool computers ship with local administrator, operator and service accounts and with service accounts used by the equipment software. Ask suppliers to document every account, its purpose and privilege, and whether its password can be changed without breaking the tool.
- Shared engineer credentials: supplier field engineers often use one account across many tools and customers. Require named accounts or fab-issued credentials for maintenance, with passwords changed after each supplier visit.
- Remote support: supplier remote access for diagnostics is privileged access to production. Route it through the fab's managed remote access with approval, session recording and time limits, as in the OT Remote Access Guide.
- Machine to machine connections: tool connections to the manufacturing execution system, recipe servers and automation hosts use machine credentials and certificates. Inventory them as non-human identities with owners and rotation plans.
- Least privilege: reduce high-privilege accounts and disable unused accounts and interfaces, so endpoint protection and monitoring cannot be switched off by ordinary operator logins.
See the Manufacturing Identity and OT Access Guide and the Identity for OT Environments Guide for the wider programme.
Implementation steps
For equipment suppliers
- Map the product: list every Windows and Linux computing device in each tool model and decide which are in E187 scope.
- Fix the OS roadmap: move off end-of-life operating systems and plan OS support for the expected service life.
- Harden and document: close unneeded ports and services, document the remaining protocols and ports, and write the patch qualification process.
- Qualify endpoint protection: test supported anti-malware or allowlisting with the tool software and publish the supported configuration.
- Enable monitoring: make security logs available in a form the fab can collect.
- Prove it at shipment: run vulnerability assessments and malware scans per E188, and ship the reports with the tool.
For fabs
- Write it into procurement: require E187, E188 and E191 conformance in purchase specifications, with the evidence list below.
- Gate incoming tools: scan tools and supplier maintenance media on arrival in a staging area before connection, following E188.
- Segment: place tools in zones by tool group with conduits to MES and automation hosts only, as described in the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
- Collect status: use E191 status reporting where tools support it to keep an accurate OS inventory.
- Handle exceptions: for legacy tools that cannot meet E187, record a risk acceptance with compensating controls (isolation, allowlisting, removable media control) and a review date.
- Test changes safely: qualify patches and endpoint protection updates on a non-production or engineering tool first, with a documented rollback image, before rolling out by tool group.
Decision guidance
| Situation | Recommended approach | Trade-off |
|---|---|---|
| New tool purchase | Full E187, E188 and E191 conformance with the evidence pack as a contract condition | Longer supplier negotiation, but security is built in rather than added later |
| Installed tool, supplier still supports the model | Request an upgrade path to a supported OS and a qualified endpoint protection configuration; apply E188 for every maintenance visit | Upgrades need tool downtime and requalification, so schedule them with planned maintenance |
| Legacy tool on an end-of-life OS with no upgrade path | Isolate in its own zone, allowlist applications, block removable media except through a scanning kiosk, and record a dated risk acceptance | Compensating controls need ongoing monitoring and do not remove the underlying exposure |
| Smaller fab, assembly and test site or research line | Start with the evidence list and incoming scanning, then segmentation; use E191 data where available to keep the inventory current | Less leverage over suppliers than a large fab, so align requirements with industry practice rather than custom clauses |
| Large multi-site fab operator | Central tool security baseline, shared evidence repository per tool model, and a supplier scorecard reviewed at business reviews | Needs a dedicated OT security function working with procurement and equipment engineering |
Whichever route applies, agree who owns each control after installation. Suppliers usually own OS qualification and patch packages, while the fab owns network placement, monitoring, account management and the decision to deploy an update. Writing that split into the contract avoids the common gap where both sides assume the other is patching.
Evidence and assessment
| Evidence item | Supports | When to request |
|---|---|---|
| OS inventory per computing device with vendor support end dates | E187 OS support, E191 | Quotation and factory acceptance |
| Port, protocol and service list with justification | E187 network security | Design review |
| Patch qualification and delivery process | E187 network security and OS support | Contract |
| Supported endpoint protection configuration | E187 endpoint protection | Design review |
| Security log list and export method | E187 security monitoring | Design review |
| Vulnerability assessment report and malware scan report | E188 | Before shipment and at site acceptance |
| Account and credential list for the tool | Identity controls supporting all four areas | Site acceptance |
- Metric: tools with complete E187 evidence packs as a share of new tools received.
- Metric: tool computers on supported operating systems, from E191 data or inventory.
- Metric: incoming tools and maintenance media scanned before connection, target 100 percent.
- Metric: open risk acceptances for legacy tools past their review date.
- Metric: supplier remote sessions through the managed access path, target 100 percent.
Mapping to other frameworks
NIST published a draft Cybersecurity Framework 2.0 Semiconductor Manufacturing Profile (NIST IR 8546, initial public draft, 27 February 2025), built on NIST IR 8183 Rev 1 and intended to complement existing industry standards. The mapping below is NHI Mgmt Group's own alignment of E187 areas to common frameworks, not an official crosswalk.
| E187 or E188 area | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | IEC 62443 (related topic) | ATT&CK for ICS |
|---|---|---|---|---|
| OS support | PR.PS-02 | SA-22 | Patch management for asset owners and suppliers | |
| Network security | PR.IR-01, PR.PS-01 | SC-7, CM-7, CM-2 | Zones and conduits, system requirements | T0886 Remote Services |
| Endpoint protection | PR.PS-01 | SI-3 | Component requirements for malware protection | |
| Security monitoring | PR.PS-04, DE.CM-01 | AU-2, SI-4 | Audit and event logging | |
| E188 malware-free integration | GV.SC-05 | SR-3, RA-5, MP-7 | Service provider requirements | T0847 Replication Through Removable Media |
| Supplier remote access | PR.AA-05 | MA-4, AC-17 | Remote access requirements | T0822 External Remote Services |
For IEC 62443 detail, see the IEC 62443 Guide and the IEC 62443-4-1 and 4-2 Secure Product Development Guide.
Common pitfalls
- Treating E187 as a certificate. A supplier statement of conformance without the evidence pack gives the fab nothing to verify.
- Ignoring out-of-scope devices. PLCs and controllers are outside E187 but inside E188 and the fab's risk; they still need segmentation and malware-free integration.
- No plan for the tool's life. An OS supported at shipment can reach end of life long before the tool is retired; contracts need an update commitment.
- Endpoint protection never qualified. Fabs install their standard anti-malware on a tool computer without supplier qualification, causing process disruption and pressure to remove it.
- Uncontrolled maintenance media. Field service laptops and USB media bypass the incoming scan that E188 expects.
- Shared supplier accounts. The same engineer password works on every tool of a model across many fabs.
Practitioner checklist
- Buy the current revision of E187, E188 and E191 from SEMI and confirm whether a revised E187 is in force.
- Add E187, E188 and E191 conformance and the evidence list to equipment purchase specifications.
- Reject new tools that ship with an end-of-life operating system unless a dated risk acceptance is agreed.
- Require a port and protocol list, patch process and supported endpoint protection configuration for each tool model.
- Scan incoming tools and all supplier maintenance media in a staging area before connection.
- Inventory every account and machine credential on tool computers and remove shared supplier passwords.
- Route all supplier remote support through managed, approved and recorded access.
- Collect tool security logs and OS status data into OT monitoring and the asset inventory.
Standards and references
- SEMI: E187 Specification for Cybersecurity of Fab Equipment
- SEMI: Semiconductor Cybersecurity Standards (E187, E188, E191)
- SEMI: SEMI publishes first cybersecurity standards
- SEMI: How SEMI E187 and E188 standards elevate cybersecurity
- SEMI: Quick start guide to new cybersecurity standard E187
- NIST: IR 8546 (Initial Public Draft) Cybersecurity Framework 2.0 Semiconductor Manufacturing Profile
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Hardware Trojans and Chip Supply Chain Guide · OT Product Procurement Guide · OT Third-Party and Integrator Access Guide · OT Patch Management Guide