Care Identity Service authenticators

Users can authenticate using 7 different methods. The image below shows an overview of our authenticator options.

See a full list of AAL2-supported applications.

Users are issued with an authenticator by a local administrator known as a Registration Authority (RA).

Users can self-register non-smartcard authenticators.

CIS authenticators come in two ‘assurance’ levels:

• AAL2 – ‘high confidence’ 

• AAL3 – ‘very high confidence’ 

For security reasons, some applications are restricted to AAL3 authenticators. Other applications allow both AAL2 and AAL3 authenticators. We are working to increase the range of applications that allow AAL2 authenticators.

For more details, see websites and apps you can access with CIS2 Authentication. 

All NHS digital services use CIS2 Authentication, and can be used with our full range of authenticators, subject to authenticator level restrictions.

Some commercial software applications still use our legacy CIS1 authentication. These applications are restricted to using smartcards over HSCN.

CIS1 Authentication is deprecated and scheduled for retirement by the end of February 2027. All new integrations must be with CIS2 Authentication, and we are working to migrate all existing applications from CIS1 to CIS2.

We are working with software providers to migrate all commercial software applications to CIS2 authentication. 

For more details, see websites and apps you can access with CIS2 Authentication. 

AAL2 authenticators

These authenticators can only be used with applications that are enabled for AAL2.

AAL3 authenticators

These authenticators can be used with all applications that use CIS2 Authentication (AAL3 and AAL2).

Many organisations require their staff to work across shared desktops, tablets or ward terminals. CIS offers a wider range of authenticators, giving you more flexibility in how staff access the systems they need.

Before deciding which authenticators to promote within your organisation, check which applications you use and any technical specifications related to the authenticator, and confirm with your application supplier what they support.

For systems supporting AAL3

Staff on shared devices, desktops or kiosks can use smartcards or security keys. Additionally, certain models of security key can be plugged easily into tablets.

For systems supporting AAL2

Staff can authenticate using Microsoft Authenticator, NHS.net Connect (formerly NHSmail) or passkeys - all options that allow a user to authenticate with their mobile device. This cross-device authentication allows a health and care professional to authenticate using a push notification, one time passcode, or biometrics on their phone.

Offering a broader portfolio of authenticators can:

• help cut smartcard support issues
• speed up access
• give your organisation more flexibility in how authentication works across shared or mobile devices

As an application provider, when you integrate your software with CIS2 Authentication, you’ll need to decide which assurance level is suitable for your application.

For more details, see our authenticator guidance for developers.