資安產業跨域聯防推動計畫網站 ACW

【History】  【Introduction】  【Scheme Governance Principles】  【Operational Framework & Certification Process】 
【Approved CB】  【Approved TL】  【Scheme Documents】  【Contact Info】 

History of the SEMI E187 Standard

Over the past decade, driven by digital transformation, the semiconductor manufacturing industry has leveraged production data to enhance smart manufacturing capabilities. However, the industry is increasingly facing challenges such as end-of-support (EoS) for automation systems and equipment, along with the presence of legacy software and outdated hardware. These conditions hinder the ability to perform updates and vulnerability patching, making systems highly susceptible to malware and cyberattacks. The large-scale cybersecurity incident at TSMC in 2018 served as a critical wake-up call for the high-tech manufacturing sector. Cybersecurity has since become an urgent and strategic issue, closely tied to both global industrial development and national security. Although international standards and security guidelines for manufacturing have been released in recent years, there remains a lack of comprehensive solutions that adequately address the current cybersecurity management challenges faced by Taiwan’s manufacturing production environments. Therefore, it is necessary to promote international cybersecurity standards for smart manufacturing, guiding the industry to standardize cybersecurity practices across the entire supply chain.
Through the SEMI international standards platform, TSMC and ITRI jointly established the Fab & Equipment Information Security Task Force in September 2018. The task force aims to connect stakeholders across the smart manufacturing supply chain, build industry consensus on cybersecurity, and lead the development and promotion of international standards for risk management and cybersecurity protection in semiconductor manufacturing equipment and systems. Since its establishment, the task force has held monthly working meetings co-chaired by TSMC and ITRI. Participating members include UMC, ASE, Powerchip, Nanya Technology, Applied Materials Taiwan, Delta Electronics, and various cybersecurity and industrial solution providers. These members actively contribute domain expertise and participate in the development of international cybersecurity standards, facilitating the formation of the draft standard. 
The first semiconductor equipment cybersecurity standard led by Taiwan, SEMI E187, was officially published on the SEMI website in January 2022. 
The standard defines four key areas:

• Operating system support (e.g., long-term support)
• Network security (e.g., secure communication and network configuration management)
• Endpoint protection (e.g., vulnerability scanning, malware detection, endpoint defense mechanisms, and access control)
• Cybersecurity monitoring (e.g., logging and audit trails).

The SEMI E187 Semiconductor Equipment Cybersecurity Certification Scheme is jointly promoted by the Administration for Digital Industries (ADI), Ministry of Digital Affairs, and SEMI. Based on the international standards ISO/IEC 17025 and ISO/IEC 17065, the scheme establishes a third-party certification framework and management mechanism with impartiality and credibility. It aims to build a consistent, trustworthy, and internationally aligned cybersecurity certification scheme for semiconductor equipment, serving as an important foundation for cybersecurity governance across the global semiconductor supply chain.

The scheme adopts equipment models as the unit of certification. Its certification scope focuses on four key areas: operating system support, network security, endpoint protection, and security monitoring, ensuring that smart manufacturing equipment possesses fundamental cybersecurity protection capabilities at the time of shipment (“Secure by Design”).

Through this standardized and verifiable common language, equipment manufacturers, semiconductor fabs, and supply chain partners can effectively reduce cybersecurity risks, enhance the security and operational resilience of smart manufacturing environments, and strengthen the trust foundation of the global semiconductor supply chain.

Scheme Governance Principles