diff --git a/src/knx/application_layer.cpp b/src/knx/application_layer.cpp
index 34d7ce3..36a17eb 100644
--- a/src/knx/application_layer.cpp
+++ b/src/knx/application_layer.cpp
@@ -803,6 +803,7 @@ void ApplicationLayer::individualIndication(HopCountType hopType, Priority prior
             _bau.deviceDescriptorReadAppLayerConfirm(priority, hopType, tsap, secCtrl, *data & 0x3f, data + 1);
             break;
         case Restart:
+            // TODO: handle erase code for factory reset (setting FDSK again as toolkey, etc.)
             if ((*data & 0x3f) == 0)
                 _bau.restartRequestIndication(priority, hopType, tsap, secCtrl);
             break;
diff --git a/src/knx/bau_systemB.cpp b/src/knx/bau_systemB.cpp
index 7a2da13..7790e1a 100644
--- a/src/knx/bau_systemB.cpp
+++ b/src/knx/bau_systemB.cpp
@@ -186,6 +186,10 @@ void BauSystemB::memoryReadIndication(Priority priority, HopCountType hopType, u
 
 void BauSystemB::restartRequestIndication(Priority priority, HopCountType hopType, uint16_t asap, const SecurityControl &secCtrl)
 {
+#ifdef USE_DATASECURE
+    // If erase code is FactoryReset, set FDSK as toolkey again
+    //_secIfObj.factoryReset();
+#endif
     // Flush the EEPROM before resetting
     _memory.writeMemory();
     _platform.restart();
diff --git a/src/knx/security_interface_object.cpp b/src/knx/security_interface_object.cpp
index 3cb64bb..f84c372 100644
--- a/src/knx/security_interface_object.cpp
+++ b/src/knx/security_interface_object.cpp
@@ -9,8 +9,8 @@
 #include "callback_property.h"
 #include "function_property.h"
 
-// Our FDSK
-uint8_t SecurityInterfaceObject::_fdsk[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F };
+// Our FDSK. It is never changed from ETS. This is permanent default tool key restarted on every factory reset of the device.
+const uint8_t SecurityInterfaceObject::_fdsk[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F };
 uint8_t SecurityInterfaceObject::_secReport[] = { 0x00, 0x00, 0x00 };
 uint8_t SecurityInterfaceObject::_secReportCtrl[] = { 0x00, 0x00, 0x00 };
 
@@ -149,7 +149,7 @@ SecurityInterfaceObject::SecurityInterfaceObject()
                 resultData[0] = ReturnCodes::GenericError;
                 resultLength = 1;
             }),
-        new DataProperty( PID_TOOL_KEY, true, PDT_GENERIC_16, 1, ReadLv3 | WriteLv0, (uint8_t*) _fdsk ), // default is FDSK
+        new DataProperty( PID_TOOL_KEY, true, PDT_GENERIC_16, 1, ReadLv3 | WriteLv0, (uint8_t*) _fdsk ), // default is FDSK // TODO: do not overwrite on every device startup!!!!!!!!! ETS changes this property during programming from FDSK to some random key!
         new DataProperty( PID_SECURITY_REPORT, true, PDT_BITSET8, 1, ReadLv3 | WriteLv0, _secReport ), // Not implemented
         new DataProperty( PID_SECURITY_REPORT_CONTROL, true, PDT_BINARY_INFORMATION, 1, ReadLv3 | WriteLv0, _secReportCtrl ), // Not implemented
         new DataProperty( PID_SEQUENCE_NUMBER_SENDING, true, PDT_GENERIC_06, 1, ReadLv3 | WriteLv0 ), // Updated by our device accordingly
@@ -186,5 +186,10 @@ bool SecurityInterfaceObject::isLoaded()
     return _state == LS_LOADED;
 }
 
+void SecurityInterfaceObject::factoryReset()
+{
+    property(PID_TOOL_KEY)->write(1, 1, _fdsk);
+}
+
 #endif
 
diff --git a/src/knx/security_interface_object.h b/src/knx/security_interface_object.h
index b268705..b7d1e22 100644
--- a/src/knx/security_interface_object.h
+++ b/src/knx/security_interface_object.h
@@ -14,6 +14,8 @@ public:
 
   void secureApplicationLayer(SecureApplicationLayer& secAppLayer);
 
+  void factoryReset();
+
   uint8_t* save(uint8_t* buffer) override;
   const uint8_t* restore(const uint8_t* buffer) override;
   uint16_t saveSize() override;
@@ -26,7 +28,7 @@ private:
   LoadState _state = LS_UNLOADED;
 
   // Our FDSK
-  static uint8_t _fdsk[];
+  static const uint8_t _fdsk[];
   static uint8_t _secReport[];
   static uint8_t _secReportCtrl[];
 };