The short answer
SEMI E187 is the world's first cybersecurity standard for semiconductor fab equipment. It sets the minimum security that equipment must have built in before it leaves the factory. It was led by TSMC and Taiwan's Industrial Technology Research Institute (ITRI) and published in January 2022.
Key takeaways
- Full title: SEMI E187 Specification for Cybersecurity of Fab Equipment.
- One of the few international standards developed under Taiwan's leadership, prompted by a 2018 incident that halted production lines.
- It covers computers running Windows or Linux on fab equipment — not PLCs or SCADA systems.
- Four pillars: operating system, network security, endpoint protection, and security monitoring.
- It isn't law, but fabs can write it into purchasing specifications and acceptance tests — which makes it a delivery requirement for equipment suppliers.
- In August 2026 SEMI announced a major revision adding tiered security levels; Taiwan's third-party validation mark is expected to be issued from the end of 2026.
What is SEMI E187?
SEMI, the global semiconductor industry association, develops industry standards for semiconductor equipment and materials. E187 was its first cybersecurity standard and serves as a security baseline for fab equipment — the minimum every tool should meet.
Its core idea is secure by design: security isn't something the fab bolts on after a tool is installed; the equipment supplier builds it in during design and before shipment.
Origins: an incident that stopped the line
In August 2018, a procedural error during the installation of new equipment at TSMC let a computer virus into production, infecting computers and tools and halting parts of the line. Media estimated the revenue impact at around NT$5.2 billion — the costliest cybersecurity incident in Taiwan's history.
The incident exposed a long-standing problem: semiconductor tools are used for well over a decade and depreciated over many years, yet the computers inside were still running unsupported Windows XP, whose vulnerabilities couldn't be patched.
From September 2018, TSMC pushed for a cybersecurity task force on SEMI's standards platform, co-chaired by TSMC and ITRI. It brought together 34 industry representatives — including UMC, ASE, PSMC, Applied Materials Taiwan, Nanya, Delta Electronics and MOXA — and academics. After three years of work, SEMI E187 was published in January 2022.
Scope
| Details | |
|---|---|
| In scope | Computers running Microsoft Windows or Linux on fab production equipment and automated material handling systems (AMHS) |
| Out of scope | Programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, and devices connected via sensor/actuator networks such as PROFIBUS, MODBUS or DeviceNet |
Out-of-scope devices still need protection — through other OT security controls such as network isolation.
Who is affected?
| Party | Role |
|---|---|
| Equipment suppliers | Primary responsibility: equipment must meet E187 before shipment, with supporting documentation and reports |
| Fabs and OSATs | Write E187 into purchasing specifications; check compliance when equipment arrives |
| Fab IT and security teams | Keep checking equipment security status during day-to-day operations |
E187 is an industry standard, not a law, but SEMI recommends that fabs include it in purchasing specifications. For suppliers, once a customer writes it into a contract or acceptance criteria, it's a threshold you must meet.
The four pillars
| Pillar | Problem it addresses | Key requirements |
|---|---|---|
| 1. Operating system | Equipment runs unsupported systems that can't be patched | Avoid end-of-life (EOL) operating systems; document patch and update procedures; isolate legacy equipment that can't be upgraded behind a firewall as a compensating control |
| 2. Network security | Equipment is compromised or spreads malware over the network | Use secure protocols such as HTTPS, SFTP and SSH; disable unnecessary ports, protocols and services; provide network configuration documentation |
| 3. Endpoint protection | Malware is planted on the equipment, or it's accessed without authorization | Scan for vulnerabilities and malware and patch before shipment (reports must record dates and details); support anti-malware; restrict removable media; least privilege; multi-factor authentication recommended |
| 4. Security monitoring | Incidents can't be investigated | Generate and forward security logs (access, configuration changes, system errors); store logs remotely and protect them from tampering; give authorized users read-only access |
The thinking behind it: OT zero trust
E187 rests on the idea of OT zero trust: no person, network or asset — internal or external — should be trusted until identified. Equipment is the first line of defense on the fab floor, and without suppliers' cooperation, fabs can't achieve zero trust.
Related standards: E188 and E191
| Standard | Content | Relationship to E187 |
|---|---|---|
| SEMI E187 | Equipment cybersecurity baseline | Subject of this guide |
| SEMI E188 | Specification for Malware Free Equipment Integration | Published alongside E187; broader scope, covering all equipment components including computers, controllers and PLCs |
| SEMI E191 | Equipment cybersecurity status reporting | Lets equipment report its own security status to the fab |
| ISA/IEC 62443 | International industrial cybersecurity standards | The E187 family aligns with 62443 |
Latest developments (as of October 2026)
- October 2022: SEMI Taiwan published the E187 Reference Practice to help companies implement the standard.
- August 2025: SEMI published an E187 compliance white paper giving the rationale, implementation guidance and expected artifacts for each requirement.
- August 2026: SEMI announced a major revision of E187, adding tiered security levels and a more complete defense architecture, with emphasis on systematic hardening, removing non-essential functions, prompt fixes for supplier-identified vulnerabilities, and lifecycle issues such as end-of-life operating systems.
- Third-party validation: Taiwan's Ministry of Digital Affairs and SEMI have launched a validation scheme. The Institute for Information Industry and ITRI have obtained TAF ISO/IEC 17025 laboratory accreditation, and the first SEMI E187 validation marks were reported (September 2026) to be due by the end of 2026.
Pre-validation checklist (for equipment suppliers)
| Area | Check |
|---|---|
| Operating system | ☐ OS is within the vendor's support period ☐ A written patch and update procedure exists ☐ Latest security patches applied |
| Network | ☐ Only encrypted protocols in use ☐ All open services and ports inventoried ☐ Insecure protocols such as Telnet and FTP disabled |
| Endpoint | ☐ Vulnerability and malware scans completed before shipment, with dated reports ☐ Anti-malware supported ☐ USB and local installation restricted ☐ Unnecessary services disabled |
| Accounts and privileges | ☐ Default accounts disabled ☐ Password policy in place ☐ No shared accounts ☐ Role-based authorization |
| Logging | ☐ Logins, configuration changes and system errors are logged ☐ Logs can be forwarded to fab systems ☐ Logs are protected from alteration or deletion |
Documents alone aren't enough. Fabs and validators want independently verifiable results: are there known vulnerabilities, default accounts, high-risk open ports or unencrypted connections on the equipment? Each item needs evidence — scan reports, configuration records or logs.
How to implement: four steps
- Inventory equipment and software: list each tool's operating system, version, open services and installed software. Output: equipment asset inventory.
- Turn requirements into verifiable checks: for each pillar and customer requirement, define how to check it and what counts as a pass. Output: inspection baseline.
- Assess and analyze gaps: scan and inspect, then prioritize fixes by risk and production impact. Output: gap report.
- Remediate, keep evidence, recheck: record owners and progress; reassess after any change to the equipment. Output: remediation records, recheck reports.
E187 isn't one-and-done. Equipment goes through installation, volume production, maintenance and upgrades, and each change can affect its security posture — so recheck regularly.
Common mistakes
- "E187 is only the supplier's problem." Fabs are responsible for writing it into purchasing specs, checking at acceptance and maintaining it in operation.
- "Good documentation is enough to pass." Validation looks at actual scan and configuration results.
- Giving up on legacy equipment. Tools that can't upgrade their OS can be isolated with network segmentation as a compensating control — with the rationale documented.
- Checking once. Maintenance, part replacement and software updates can all introduce new problems.
How Guidant AI helps
Every E187 check needs evidence: scan reports, configuration records, logs. Guidant AI helps you collect that evidence automatically and manage it in one place.
- Detection agent: deployed inside the fab network to run configuration compliance checks (OpenSCAP), port and service discovery (Nmap) and vulnerability scans; reports become evidence automatically.
- Custom checks: build E187's four pillars and your customers' acceptance requirements as controls, assign owners and track status item by item.
- Centralized tasks and evidence: evidence for every tool and every check is attached to the matching item and exported in one go for acceptance or audit.
- Scheduled rechecks: set up recurring scans so changes to equipment aren't missed.
- On-premises deployment: install it on the fab's internal network so inspection data never leaves the site.
Guidant AI is not an E187 validation body and does not issue validation marks.
[Book a demo →]
See how Guidant AI maps to it →
FAQ
It isn't law — it's an industry standard. But fabs can include it in purchasing specifications, supplier management or acceptance criteria, and once it's in a contract you must meet it.
References
- SEMI, SEMI E187 Specification for Cybersecurity of Fab Equipment (available from the SEMI store)
- SEMI Standards Watch, "Major Revision of SEMI E187: Tiered Security Levels," August 2026
- SEMI Standards Watch, "Navigating SEMI E187: New Cybersecurity White Paper," August 2025
- ITRI, Computer & Communications, "Promoting the SEMI E187 Cybersecurity Standard," 2023
- SEMI E187 Reference Practice v2.0, October 2022