SEMI E187 and E188: what TSMC asks of a tool with a computer inside, and what a small builder can show today

Why a tool builder in Arizona should read this

If you sell TSMC a tool, a load port, an automation cell or a test station with a Windows or Linux computer inside, TSMC checks it against SEMI E187 before the tool goes in. TSMC said so publicly in September 2023: E187 became one of its procurement-contract requirements that year, with a verification mechanism to make sure suppliers comply "before the introduction of any new equipment". That applies to a Falcon Field shop building around an embedded PC as much as to a Hsinchu equipment maker.

What E187 is, in SEMI's words

SEMI E187 is the Specification for Cybersecurity of Fab Equipment, published in 2022 under the designation E187-0122. SEMI describes it as defining "overarching and fundamental cybersecurity requirements as a baseline to secure semiconductor fab equipment by design and support security protection in operation and maintenance." It applies to the computing devices of fab equipment that run Microsoft Windows or Linux, and SEMI states that it does not cover PLCs, SCADA systems or the sensor and actuator networks connected to them. It was written by SEMI's Fab and Equipment Information Security Task Force under the Taiwan Information and Control Technical Committee.

SEMI groups the requirements into four aspects, and TSMC uses the same four in its own wording.

SEMI's overview page glosses the four as legacy operating systems, network configuration, malware and vulnerability management, and log management. The clause-level requirements are in the standard itself, which SEMI sells and we link to below.

How TSMC uses E187

TSMC's article of September 2023 says E187 was included among its procurement-contract requirements in 2023 and set up "as a tool procurement specification and verification mechanism", with a Verification Checklist across the four areas, so that suppliers comply before any new equipment is introduced. The same article says SEMI compiled an E187 Reference Practice in 2022, worked with the Administration for Digital Industries of Taiwan's Ministry of Digital Affairs to help equipment makers adopt the checklist, and that two Taiwanese suppliers, Gallant Precision Machining and Contrel Technology, became the first verified by a third party as meeting the standard.

What the article does not say matters as much: it does not say every supplier must use a third-party verifier, does not describe how TSMC Arizona runs the check, and does not mention E188. Ask your TSMC procurement or equipment-engineering contact for the current process; do not infer it from us.

What E188 adds, in SEMI's words

SEMI E188 is the Specification for Malware Free Equipment Integration, designation E188-0222. SEMI describes it as "a framework for how to mitigate the propagation of malware to manufacturing facilities during capital equipment delivery and support activities". Its scope covers controlling access to equipment through networks and removable media, installation procedures, upgrade and support tasks, and restoration work such as hard-disk replacement and component updates. It applies to equipment suppliers, users and component suppliers, and excludes factory-side systems such as the MES and host systems.

Our reading, not SEMI's words: E187 is about how the tool is built and configured; E188 is about how it arrives and is serviced without carrying malware in, which in practice means scanning before shipment, clean installation media and controlled service access. Nothing TSMC has published that we have read says whether TSMC Arizona asks for E188 evidence. Ask.

What a small builder can produce as evidence today

You do not need a certificate to start, and the documents below are what any verifier asks for first. For each tool model: an asset list naming the controller hardware, the operating system and version, and the vendor's support end date; a written patch policy stating who applies updates, how often, and how a customer is told; a network diagram showing every open port, service and protocol, and what is disabled; the endpoint-protection configuration, meaning what anti-malware or allow-listing runs and how it updates; the logging settings, meaning what is logged, where, and for how long; recent vulnerability or malware scan reports; and a letter of attestation, signed by an officer, mapping each of these to the four aspects. Whether TSMC accepts a self-attestation or requires third-party verification for your class of tool is not public; the file is the same either way.

What FabReady holds, and what it does not

FabReady has five E187 rows and no E188 rows. Row TSMC-E187-001 states the procurement requirement and the four areas; it traces to TSMC's article and SEMI's page and was checked against both on September 7, 2026. Rows TSMC-E187-002 to 005, covering supported operating systems with patching, disabling Telnet and FTP and documenting ports and services, removing default and shared accounts under a password policy, and retaining security logs, are practical items whose wording currently traces to a security vendor's checklist (TeamT5, August 2026), not to SEMI's text. They are marked draft, FabReady shows their source, and they stay that way until we cite the standard's own clauses. E188 attestation is on our roadmap only if a builder asks for it.

So that no one mistakes our words for the standard's: SEMI's statements are the titles, abstracts, scope, exclusions and four aspects. TSMC's are the 2023 procurement requirement, verification before introduction, the checklist, the four areas in its wording, the Ministry of Digital Affairs work and the two verified suppliers. Ours are the four detailed row items, the evidence list, the reading of how E187 and E188 divide the work, and the advice to ask TSMC directly.

Disclaimer

FabReady is a readiness and organisation tool. Nothing on this page is legal, compliance or certification advice, and nothing FabReady holds is "verified" or "compliant". Requirements change; verify against the sources below and against the standard itself.

Sources

1. TSMC, "TSMC Strengthens 'Specification for Cybersecurity of Semiconductor Equipment', Realizing Mutual Industry Benefits", dated 2023/09/13 on the page: https://esg.tsmc.com/en-US/articles/280
2. TSMC, 台積公司深化「晶圓設備資安標準」，實踐產業共好, dated 2023/09/13 on the page (Traditional Chinese edition of the same article): https://esg.tsmc.com/zh-Hant/articles/280
3. SEMI, SEMI E187 Specification for Cybersecurity of Fab Equipment (E187-0122), store page with abstract and scope: https://store-us.semi.org/products/e18700-semi-e187-specification-for-cybersecurity-of-fab-equipment
4. SEMI, SEMI E188 Specification for Malware Free Equipment Integration (E188-0222), store page with abstract and scope: https://store-us.semi.org/products/e18800-semi-e188-specification-for-malware-free-equipment-integration
5. SEMI, standards overview for fab equipment cybersecurity (task force, four areas): https://www.semi.org/en/products-services/standards/cybersecurity
6. TeamT5, "How to prepare for SEMI E187 validation: an essential checklist for equipment suppliers", August 2026 (vendor checklist; the current source for FabReady rows TSMC-E187-002 to 005): https://teamt5.org/en/posts/how-to-prepare-for-semi-e187-validation-an-essential-checklist-for-equipment-suppliers/

On this site

• Requirement TSMC-E187-001 in the library
• Start a readiness assessment
• Guide: the one-time PFAS report under TSCA §8(a)(7)