BSI-Richtlinie TL-03420

Public-sector tenders often contain the requirement to erase or destroy data carriers "in accordance with BSI TL-03420". This refers to a technical guideline of the Federal Office for Information Security (BSI). Here you can find out what the guideline regulates, who it applies to and how it differs from other erasure standards.

What does the TL-03420 regulate?

The BSI publishes technical guidelines (TL) for the protection of classified information. They specify how the requirements of the Classified Information Instruction (VSA) are implemented technically. The TL-03420 bears the title "Guidelines for the erasure and destruction of information in need of protection on analog and digital data carriers". It covers paper and microfilm as well as electronic, magnetic and optical data carriers.

The guideline distinguishes two security levels:

Security level	Typical information
Medium security	Classified information up to and including VS-NUR FÜR DEN DIENSTGEBRAUCH (VS-NfD) and comparable classifications, personal data
High security	Classified information from VS-VERTRAULICH and comparable classifications, special categories of personal data

Depending on the level, the guideline sets different requirements for erasure methods, for destruction equipment and for the organizational process. For higher classifications, as a rule only products approved by the BSI come into question. The BSI makes the current version available through an internal area to which authorized bodies are granted access on request.

For whom is the guideline relevant?

• Federal and state authorities, that dispose of IT with classified information .
• Companies in classified-information protection, that work with VS on behalf of the state, for example in the defense or security sector.
• Organizations with high protection needs, that voluntarily follow an official benchmark.

For most companies without classified information, other sets of rules are decisive, such as DIN 66399 for destruction and the module CON.6 "Deleting and Destroying" in the BSI IT-Grundschutz.

Distinction from other standards

The TL-03420 is not a certificate for service providers but a requirement for methods and products. The US guideline NIST SP 800-88 pursues a similar goal, but is written for US federal agencies and is publicly accessible. DIN 66399 describes protection classes and particle sizes for physical destruction and is the common benchmark for businesses. Tenders often require a combination: erasure by a recognized method, destruction in accordance with DIN 66399 and, for VS, a procedure in line with the requirements of the BSI.

How public authorities dispose of VS-NfD hardware in practice is shown in our guide Decommissioning VS-NfD hardware. Which erasure methods are suitable for HDDs and SSDs is explained in the guide Securely erasing hard drives and SSDs.

Relation to Second IT

Second IT processes data carriers in a VS-NfD-compliant manner and erases HDDs, SSDs and mobile devices using Blancco, including a digitally signed erasure certificate for each device. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399, certified for security level H-5. More on certified data deletion.

Frequently asked questions about the BSI TL-03420

Is the TL-03420 publicly available?

The BSI makes the current version available to authorized bodies through an internal area. Access is generally granted on request to public authorities and companies in classified-information protection.

Does the TL-03420 also apply to companies?

It is binding primarily for bodies that work with classified information and for companies that process VS on behalf of the state. Other companies may follow it voluntarily. For them, the GDPR, DIN 66399 and IT-Grundschutz are usually decisive.

What is the difference between TL-03420 and DIN 66399?

DIN 66399 is a general standard for the physical destruction of data carriers with protection classes and security levels. The TL-03420 is a BSI requirement for erasing and destroying information in need of protection, above all classified information, and also includes erasure methods.

Is the TL-03420 a certificate for service providers?

No. The TL-03420 is not a certificate for service providers but a requirement for methods and products. Tenders often require a combination: erasure by a recognized method, destruction in accordance with DIN 66399 and, for classified information, a procedure in line with the requirements of the BSI.

Which security levels does the TL-03420 distinguish?

The guideline knows medium and high security. Medium applies, for example, to classified information up to VS-NfD and to personal data. High applies from VS-VERTRAULICH and to special categories of personal data. Depending on the level, erasure methods, devices and processes change.