The National Institute of Standards and Technology is gathering public comments on its draft framework for managing and reducing cybersecurity risks in semiconductor manufacturing.
The 136-page draft, titled “Cybersecurity Framework Version 2.0 Semiconductor Manufacturing Profile,” structures methods for identifying and addressing areas for improvement in current cybersecurity practices within semiconductor manufacturing systems.
It also offers cybersecurity evaluation approaches to ensure that control environments work within acceptable risk levels. In addition, the profile provides a standardized approach for the development and maintenance of cybersecurity plans across the semiconductor manufacturing process.
Roadmap’s Focus Areas
The profile’s roadmap follows the six primary functional areas under NIST’s Cybersecurity Framework 2.0: govern, identify, protect, detect, respond and recover. In addition, it expands to various semiconductor subdomains — fabrication, enterprise IT and equipment, and tooling — for framework flexibility and adaptability.
Sanjay Rekhi, group leader of the security components and mechanisms group at NIST, described the profile as a “comprehensive framework” drawn from industry and government collaboration. “This initiative is part of a broader, multi-year effort to strengthen the security of critical infrastructure, with a particular focus on the security of semiconductors and their supply chain,” he added.
The deadline for submitting comments is on April 16. NIST’s National Cybersecurity Center of Excellence plans to hold a virtual workshop for the profile on March 13 to provide an overview of the draft.
