Skip to content 
Baustein CON.6
In brief
CON.6 "Deleting and Destroying" is a module of the IT-Grundschutz Compendium of the Federal Office for Information Security (BSI). It describes how institutions securely erase and destroy information and data carriers and create a holistic concept for it. For IT decommissioning, the CON.6 module provides concrete minimum requirements for erasure methods, destruction and the involvement of external service providers.
What does the CON.6 module require?
In the BSI IT-Grundschutz the module is to be applied once for the entire information domain. It deals with the erasure of complete data carriers, not individual files. The requirements in the 2023 edition include, among others:
| Requirement | Core |
|---|---|
| CON.6.A1 (Basic) | Regulate erasure and destruction, observe statutory retention and erasure periods |
| CON.6.A2 (Basic) | Securely erase or destroy data carriers in need of protection before disposal; secure collection points against access |
| CON.6.A11 (Basic) | External service providers: process secure and traceable, method at least as good as the internal requirements |
| CON.6.A12 (Basic) | Minimum methods, e.g. overwriting with random values or securely deleting the key for encrypted data carriers |
| CON.6.A13 (Standard) | Destroy defective digital data carriers at least in accordance with security level 3 of ISO/IEC 21964-2 |
ISO/IEC 21964 is the international counterpart of DIN 66399. The BSI is currently transferring IT-Grundschutz step by step into the new Grundschutz++ format. Therefore check the version currently in force (as of 10/2026).
CON.6 in practice
For companies this means: a documented Erasure concept, secured collection points, clear procedures for each type of data carrier and service providers whose approach is traceable. Which erasure methods suit HDDs and SSDs is shown in the guide Securely erasing hard drives and SSDs. Second IT erases with Blancco and issues a digitally signed erasure certificate for each device. Data carriers that cannot be erased are destroyed in-house in accordance with DIN 66399, certified for security level H-5.
Frequently asked questions about CON.6
Is CON.6 mandatory for companies?
Only for institutions that work according to IT-Grundschutz or have themselves certified accordingly. For everyone else, the module is a recognized orientation for the state of the art.
Does CON.6 require multiple overwriting?
No. The minimum requirement for unencrypted, rewritable data carriers is a complete overwrite with random values. Depending on the protection requirement, stricter methods may be necessary.
What does CON.6 say about defective hard drives?
If defective data carriers cannot be erased securely, they should be destroyed at least in accordance with security level 3 of ISO/IEC 21964-2.
Does CON.6 apply to individual files or to entire data carriers?
CON.6 deals with the erasure of complete data carriers, not individual files. In IT-Grundschutz, the module is to be applied once for the entire information domain. A documented erasure policy forms the basis for this.
What does CON.6 require of external service providers for erasure?
The process must be secure and traceable. The service provider’s method should be at least as good as your own internal requirements. Therefore check how a service provider erases and have the erasure documented for you.
Erase and destroy according to fixed procedures, with proof for each device.
Send us your device list. You will receive your offer in 48 hours on average.