Inside a semiconductor fab, software does not only hold data. It runs equipment that acts on the physical world, so a compromised component can disrupt production and, where controls are involved, can affect safety. The standards that exist focus on keeping malware and weak configurations out of fab equipment.
What is different about operational technology?
NIST SP 800-82 Revision 3 describes operational technology as programmable systems and devices that interact with the physical environment or manage devices that do. They detect or cause a direct change through monitoring or controlling devices, processes and events. The guide says securing them means addressing their performance, reliability and safety requirements.
That sentence is the whole argument. In an office, the worst case of a bad update is lost data. In a plant, the system may be holding a process in a safe state. Changes need planning, testing and often downtime windows.
What does the supply chain have to do with it?
Fab equipment arrives from suppliers, runs operating systems and third party code, and is serviced by people who bring their own laptops and tools. Each of those routes brings software into the factory network.
SEMI, the industry body, published two standards for this. In its announcement, SEMI describes E187 as the Specification for Cybersecurity of Fab Equipment, developed by a task force led by TSMC and ITRI. It defines a common minimum set of security requirements for fab equipment, focused on four components: operating systems, network security, endpoint protection and security monitoring.
E188, the Specification for Malware Free Equipment Integration, was led by Intel and Cimetrix. It targets malware during initial integration, field service repairs, patching and maintenance. It defines minimum malware scanning requirements so suppliers scan equipment and maintenance devices before shipment, refers to sources such as SCAP and the NVD with CVSS for hardening and vulnerability reporting, and specifies configuration documentation so equipment does not introduce insecure network settings.
SEMI's announcement also notes that in 2018 a major foundry paused production to investigate machines infected by ransomware. It does not name the incident beyond that, and neither do we.
Where do other standards fit?
ISA describes the ISA/IEC 62443 series as requirements and processes for securing industrial automation and control systems, bridging operations and IT and bridging process safety and cybersecurity. Part of the series covers patch management. NIST SP 800-82 gives a general OT security guide. Neither is specific to chip manufacturing, so use them as references beside the SEMI standards, not instead of them.
Check which of these your customers or equipment buyers require. We could not confirm certification program details from primary sources, so confirm any formal scheme with SEMI directly.
Where does software composition analysis help?
Equipment suppliers ship software with open source dependencies. A software bill of materials lets the fab ask which components a machine contains and whether a newly published vulnerability applies. It does not replace the controls above. It makes questions to suppliers specific. Ask for the list, a contact for security notices, and a statement of how updates are tested.
What are the limits?
Do not treat a bill of materials as proof of safety. It lists components and says nothing about how the equipment behaves. And do not run scanners built for offices against live equipment networks without the operations team's agreement.
What to do
- Inventory equipment, operating systems and remote access paths with owners.
- Ask suppliers for software bills of materials and a security contact.
- Require malware scanning of equipment and service devices before they connect.
- Check supplier conformance to SEMI E187 and E188 where your contracts call for it.
- Document network configuration so equipment does not weaken the factory network.
- Plan patching with operations, using NIST SP 800-82 and ISA/IEC 62443 as references.
- Keep a log of vendor service visits and what was brought on site.
Quick check
Is this only a problem for large fabs?
Any site where software controls physical equipment shares the issue. Scale changes the process, not the principle.
Does an SBOM make equipment safe?
No. It tells you what is inside so you can ask better questions. Safety depends on testing and controls.
Sources
- SEMI: SEMI publishes first cybersecurity standards (copy of SEMI announcement), fetched 18 October 2026
- TXOne Networks: How SEMI E187 and E188 elevate cybersecurity, vendor blog, fetched 18 October 2026
- NIST SP 800-82 Rev. 3, fetched 18 October 2026
- ISA/IEC 62443 series, fetched 18 October 2026
Last reviewed: 18 October 2026.
