Semi E187

SEMI E187 defines a baseline set of cybersecurity requirements that fab equipment itself must meet — patchable operating systems, controlled network ports and services, authenticated remote access, and a documented update process — treating the tool as a networked computer with an attack surface, not just a piece of process hardware that happens to run software. This standard exists because semiconductor equipment has historically run on embedded or legacy operating systems for years or decades without security patching, justified at the time by strict process-qualification requirements that discouraged touching anything on a validated tool — a justification that stopped covering the actual risk once every tool became a networked endpoint on the fab's SECS/GEM and EDA infrastructure.

Equipment ships with its OS and network stack
Historically: unpatched for years, justified by process stability
SEMI E187 baseline requirementsEquipment treated as a networked computer, not just process hardware
Patchable OS + documented update process
Security fixes no longer blocked by 'don't touch a qualified tool'
Controlled ports/services + authenticated access
Attack surface explicitly minimized and access-controlled
Equipment meets a documented security baseline
Auditable against E187, not left to vendor discretion

The tension E187 is built to resolve is real and was not invented by security teams after the fact: a fab's process-qualification discipline genuinely does require that a validated tool's behavior not change unpredictably, while a fab's security posture genuinely does require that known vulnerabilities get patched — E187 addresses this by requiring equipment vendors design for patchability and controlled change from the start, rather than asking fabs to choose between an insecure-but-qualified tool and an unqualified-but-patched one after the fact. A tool built to E187's baseline can receive a security update through a documented, predictable process that a fab's change-control procedures can actually qualify, instead of the update being either refused outright or applied in an uncontrolled way that risks the tool's process validation.

SEMI E187 — Resolving Qualification vs. Patching both requirements are legitimate — the old choice between them was the real problem Without E187 Patch it: risk breaking validation Don't patch: known vulnerability stays With SEMI E187 Documented update process fits fab change-control qualification Baseline requirements E187 sets Patchable OS · controlled network ports and services Authenticated remote access · documented update process equipment designed to be both qualifiable AND patchable

SEMI E187 pairs directly with Malware-Free Equipment Integration (SEMI E188), which covers how new or serviced equipment is verified clean of malware before it connects to the fab network in the first place — E187 is about the equipment's own ongoing security posture once it's on the network, while E188 is about keeping threats from entering the network through equipment at install or maintenance time to begin with.

Take SEMI E187 further

Ask the copilot about this term, or have our engineers assess it against your process.

Ask CFSGPT about this → Request a technical assessment → Open the CFS app