In a semiconductor fab, inspect the production equipment first, because the tools run general-purpose operating systems that connect to the fab network. SEMI E187 sets a cybersecurity baseline for that equipment in four areas: operating system support, network security, endpoint protection and security monitoring. It excludes PLC and SCADA devices.
What is SEMI E187?
SEMI's listing describes E187 as defining overarching and fundamental cybersecurity requirements as a baseline to secure semiconductor fab equipment. It is meant to build security into equipment design and to support protection during operation and maintenance. Its intended users are the entities that supply equipment or services to fabs, such as equipment suppliers and system integrators. The current revision is E187-0122, the first published version, and a related guide, SEMI E169, covers equipment information system security and is sold separately.
The scope boundaries matter. E187 applies to semiconductor production equipment and automated material handling systems, specifically their computing devices that run Microsoft Windows or Linux. It does not cover computing devices in PLCs and SCADA systems, or devices linked to them through sensor-actuator networks. So E187 is a floor for the tool PCs, not a complete plant security program.
What should a fab inspect first?
Start where the standard starts and ask four questions of every tool.
Operating system support. What OS and version does each tool run, and is it still supported by its maker? Tools can run for many years, so long-lived tool PCs on old releases are a normal finding. The question is whether you have a plan, an owner and compensating controls.
Network security. How is each tool connected, to what, and why? Draw it. Tool networks should be separated from corporate networks, with explicit and minimal paths for equipment automation and vendor service. NIST's OT guide, SP 800-82 Revision 3, describes OT security with performance, reliability and safety requirements in mind, which is a useful reminder when you propose changes to a tool that is mid-process.
Endpoint protection. What protects the tool PC from malware, and how are patches or definitions applied without interrupting production? Ask your supplier what they have validated, since unapproved changes can void support.
Security monitoring. What logs does the tool produce, where do they go, and who looks? A tool that cannot report anything is a blind spot, and you should record it as a risk.
What about the software on the tools?
Equipment software is software. It has dependencies, some of them open source, and some of them with disclosed vulnerabilities. Ask suppliers for a bill of materials for the tool software, even a partial one, and keep it. When a library flaw is announced, the question "do any of our tools contain it?" becomes a lookup. Reachability analysis helps you judge whether a flawed component is exposed on a given tool, and the answer belongs in your record along with the supplier's own statement.
How do you use E187 in procurement?
Put it in the purchase conversation. Ask each supplier whether the tool conforms, which requirements they interpret how, and what evidence they provide. SEMI's published listing is for suppliers and integrators, so frame your questions as requests for their conformance information. Do not assume conformance from a brochure line.
Also record what E187 does not cover: PLC and SCADA devices and their sensor networks need other measures, such as the IEC 62443 series for industrial automation and control systems.
What to do
- List every tool PC, with OS, version, support status and owner.
- Draw and review the network paths for each tool, including vendor service access.
- Ask each supplier how endpoint protection and patching are validated for their tool.
- Confirm what each tool logs and where the logs go.
- Ask suppliers for a conformance statement against SEMI E187 and keep it.
- Request a software bill of materials for tool software and store it.
- Record separate controls for PLC and SCADA devices outside E187.
Quick check
Does SEMI E187 cover PLCs?
No. SEMI lists computing devices in PLCs and SCADA systems, and devices linked to them through sensor-actuator networks, as outside its scope.
Who is E187 written for?
SEMI says its intended users are entities that supply equipment or services to fabs, such as equipment suppliers and system integrators. Fabs can use it to frame procurement questions.
Sources
- SEMI store: SEMI E187 Specification for Cybersecurity of Fab Equipment
- NIST SP 800-82 Revision 3
- ISA: ISA/IEC 62443 series of standards
Last reviewed: 18 October 2026.
