Cybersecurity for the Semiconductor Supply Chain: Who's Responsible for What

Cybersecurity responsibility in the semiconductor supply chain doesn't belong to one company. It's distributed across OEMs, contract manufacturers, component distributors, equipment suppliers, and IT service providers, with contractual, regulatory, and technical obligations at each layer. This post maps who's responsible for what, where the gaps typically form, and how frameworks like CMMC, SEMI E187, and DFARS flow-down requirements define the accountability chain for electronics manufacturers in 2026.

Nobody Owns the Whole Chain. That's the Problem.

A semiconductor product might touch 15 companies before it reaches an end customer. Design house. Foundry. Packaging and test. Component distributor. PCB fabricator. EMS contract manufacturer. Equipment vendors at every stage. IT service providers. Logistics partners. Each one handles some portion of the data, the IP, the physical product, or the systems that produce it.

And when something goes wrong, the question is always the same. Whose fault was it?

The Verizon 2025 Data Breach Investigations Report showed third-party involvement in breaches doubled from 15% to 30% in a single year, the largest single-year shift in the report's history. The IBM 2025 Cost of a Data Breach report priced supply chain compromises at $4.91M average, with a 267-day mean time to identify and contain, the longest lifecycle of any breach vector tracked.

For electronics manufacturers, those numbers aren't abstract. Your contract manufacturer has your Gerber files. Your equipment vendor has remote access to your production tools. Your component distributor is sourcing parts from a broker you've never audited. Your MSP has admin credentials to your entire IT environment.

Every handoff is a trust boundary. And every trust boundary is a potential point of failure.

The Responsibility Map

Here's who's responsible for what in a semiconductor and electronics manufacturing supply chain. Not who should be in theory. Who actually is, based on contracts, regulations, and how the industry works in practice.

The OEM or Device Manufacturer

You own the product design. You define the security requirements for your supply chain. You're responsible for specifying what cybersecurity controls your suppliers need to meet, verifying that they meet them, and maintaining the documentation that proves it.

If you're in the defense supply chain, DFARS 252.204-7012 requires you to flow down cybersecurity requirements to every subcontractor handling Covered Defense Information. DFARS 252.204-7021 requires CMMC certification at the appropriate level before contract award, and that flows to subcontractors too. Under 32 CFR § 170.23, CMMC requirements apply to prime contractors and subcontractors at all tiers that process, store, or transmit FCI or CUI.

Prime contractors bear full responsibility for their supply chain under DFARS. If a subcontractor breach exposes DoD data, the prime answers for it.

SEMI's June 2026 guidance made it even more explicit for the semiconductor sector. Cybersecurity responsibility is moving closer to the OEM. Fabs and device manufacturers are expected to define security expectations, and OEMs are expected to provide evidence their equipment remains secure throughout its lifecycle, not just at the point of delivery.

The Contract Manufacturer / EMS Company

You build other companies' products. You receive design files, BOMs, test specifications, and sometimes CUI or ITAR-controlled data. Your cybersecurity obligation is to protect that data with the same rigor the OEM requires.

In practice, that means implementing NIST SP 800-171 if you're handling CUI. It means restricting access to design files to authorized personnel only. It means having identity and access management controls that can enforce ITAR citizenship restrictions if you're handling defense-adjacent work. It means being able to demonstrate these controls to your customers and their assessors.

The contract manufacturer who can show CMMC compliance, ISO 27001 certification, and a structured cybersecurity program wins contracts from the one that can't. That's not a future state. That's 2026.

The Equipment Supplier / OEM Tool Vendor

You build and maintain the production equipment. You often have remote access to machines on your customers' production floors. Your firmware runs their processes.

SEMI E187 makes this explicit. Equipment arriving in fabs must be cybersafe by default. Supported operating systems. Hardened configurations. Encrypted communications. Security monitoring capabilities. TSMC requires E187 compliance in supplier contracts. The expectation is that equipment doesn't introduce vulnerabilities into the customer's environment.

Under the EU Cyber Resilience Act, starting September 11, 2026, manufacturers of products with digital elements will be required to report vulnerabilities and incidents. By December 2027, full CRA requirements apply. Equipment suppliers selling into EU supply chains need to track this.

Your remote access to customer equipment is a particularly sensitive area. Over 40% of manufacturers had breaches tied to third-party access in 2025. Every VPN connection, every remote support session, every firmware update channel is a potential entry point that needs to be logged, time-limited, and controlled.

The Component Distributor

You source, store, and ship electronic components. Your cybersecurity responsibility covers two dimensions.

First, the integrity of the components themselves. ERAI reported a 25% increase in counterfeit parts in 2024 vs. 2023. SAE standards (AS6171 for counterfeit detection, AS6081 for distributor mitigation, AS5553 for OEM prevention) define the anti-counterfeiting framework. A compromised component is a cybersecurity event that no amount of IT security can detect.

Second, the data you handle. Customer purchase orders, BOMs, pricing data, delivery schedules. If that information leaks, it reveals your customer's product roadmap, supplier relationships, and production volumes. Basic cybersecurity hygiene applies.

The IT Service Provider / MSP

This is where Consilien sits. We manage IT infrastructure, cybersecurity, and compliance for electronics manufacturers. Our responsibility is to protect the systems we manage, implement the controls our clients' compliance frameworks require, and provide the documentation that proves it.

We're biased here, and it's worth saying directly. An MSP with admin access to your network has more access than almost any other third party in your supply chain. If our security is weak, your security is weak regardless of what you've built internally. That's why the SEMI Semiconductor Supply Chain Assessment includes questions about IT service provider security, and why CMMC flow-down extends to IT managed service providers handling CUI systems.

Where the Gaps Actually Form

Responsibility on paper and responsibility in practice are different things. Here's where the chain breaks.

Gap 1: Flow-down requirements that exist on contracts but aren't enforced. A prime contractor includes DFARS 252.204-7012 in their subcontract. The subcontractor signs it. Nobody verifies whether the subcontractor actually implements the required controls. Primes are increasingly fixing this. Boeing, Lockheed Martin, RTX, and General Dynamics now require SPRS scores and CMMC evidence before contract award. But many mid-tier primes still operate on trust.

Gap 2: Equipment vendors with persistent, unmonitored remote access. We covered this on the OT vs IT security page. A vendor VPN that was set up during equipment installation and never reviewed. A TeamViewer session that's always on. A remote desktop port exposed to the internet. Each vendor connection is a supply chain cybersecurity obligation that usually falls between the OEM's responsibility and the vendor's.

Gap 3: Tier 2 and Tier 3 suppliers with no security maturity. The Tier 1 supplier has CMMC certification and an ISO 27001 program. Their specialty component supplier has 12 employees and no security program at all. But that component supplier has access to technical drawings, specifications, and sometimes CUI. Visibility into sub-tier supplier security is one of the biggest unsolved problems in semiconductor supply chain cybersecurity. Black Kite's 2026 Third-Party Breach Report found an average of 5.28 downstream victims per vendor breach, the highest on record.

Gap 4: Design file sharing without controls. Gerber files sent via email. BOMs shared through personal Dropbox. Test specifications uploaded to a supplier's generic file-sharing portal with no access logging. Every file transfer to a supply chain partner is a potential IP exposure, and most electronics manufacturers don't have data loss prevention controls that extend beyond their own network boundary.

Gap 5: No coordinated incident response across the supply chain. When a breach hits a supplier, who notifies whom? How fast? DFARS 252.204-7012 requires 72-hour incident reporting to the DoD for incidents affecting covered defense information. But notification chains between commercial supply chain partners are often undefined. A supplier breach that goes undisclosed for 73 days (the median disclosure delay per Black Kite's 2026 data) means the OEM is operating with compromised trust boundaries for over 2 months without knowing it.

What the Frameworks Require

None of these frameworks work in isolation. A defense electronics manufacturer needs CMMC for IT systems handling CUI, IEC 62443 for OT security, SEMI E187 for equipment cybersecurity, and DFARS flow-down for their supply chain. NIST CSF 2.0 ties them together.

What You Can Actually Control

You can't control your Tier 3 supplier's patch management cadence. You can control what you require, what you verify, and how you limit exposure when verification isn't possible.

Define requirements before the contract is signed. Security requirements in supplier agreements should specify which controls are expected, how compliance will be verified, and what happens when a supplier fails to meet them. Vague language like "supplier shall maintain appropriate cybersecurity" is unenforceable.

Verify, don't trust. Request SPRS scores. Ask for ISO 27001 certificates. Run the SEMI SSCA assessment for semiconductor supply chain partners. Require evidence of specific controls, not just attestation that controls exist.

Limit data exposure to what's necessary. Don't send full design packages when partial data is sufficient. Use Gerber files instead of native design files when possible, since Gerbers contain manufacturing data but not the full schematic IP. Encrypt files in transit and at rest. Use auditable file-sharing platforms instead of email.

Control vendor access technically. Time-limited connections. Logging. MFA. Separate credentials. No persistent VPN without monitoring. Every equipment vendor and service provider with access to your environment should be in your identity governance program.

Build incident notification into contracts. Define notification timelines. Define what constitutes a reportable event. Define who receives notification. The DFARS 72-hour requirement is a baseline for defense work. Commercial supply chains should have equivalent provisions.

The Chain Is Only as Strong as the Weakest Handoff

Every file transfer, every remote access session, every subcontract signature is a point where cybersecurity responsibility changes hands. The companies that manage this well don't do it by hoping their suppliers take security seriously. They define requirements, verify compliance, limit exposure, and build the notification chains that mean a breach at any tier gets detected and contained before it cascades.