Authenticate using a Security Key

1. Go to the national clinical information system that you wish to access.

Some systems will automatically send you to the NHS CIS2 authentication page. Others may require you to select a login button.

(See the full list of organisations using NHS CIS2).

2. Select Security Key and then Continue.

3. Select the option 'External security key or built-in sensor'.

You will be prompted to choose which device has the passkey which you intend to use.  

4. Follow the on screen instructions that may involve:

• physically touching the sensor on the security key
• entering your PIN

5. When authentication is complete, you will either be taken to the system you wish to access straight away or alternatively, you may be given an option to select the Role you want to use.

You may be offered a screen to select the Role you want to use.

This is dependant on the application you are using and the number of roles that you have assigned to you.

If you have:

• only 1 role, that role is selected for you and and won't see the Role Selection page
• 2 - 5 roles, they will be listed for you to select from. Select the role you want to use.
• more than 5 roles, they will be listed for you to select from as well as a search box to filter the list

Once you have found the appropriate role, select the role you want to use.

User sees an 'Smartcard error message' on the log in with smartcard pop-up, advising the remove all cards

If the user sees an 'Smartcard error message' on the Log in with Smartcard pop-up, advising the removal of all cards, this may be because the user may have a smartcard inserted in their machine.

Some security keys look like a smartcard to the Identity Agent.

Advise the user to:

• remove any smartcards from their machine
• try authenticating again with the security key

User sees a message 'This security key doesn’t look familiar. Please try a different key'

The security key has not been registered for the user.

Please contact your RA representative to arrange for this to be done.

If you have forgotten your PIN or locked your key then the security key will need resetting and, subsequently, you will need to revisit the Registration Authority who will have to re-register the security key.

Please be aware that completing a reset of the key will remove all authenticators that are currently being used on the key.

When using Windows 10 you can complete the key reset following these steps:

1. Open Settings, and click/tap on the 'Accounts' icon (you can find settings by typing into the Windows search bar).
2. Click/tap on 'Sign-in options' on the left side, and click/tap on 'Security Key' under 'Manage how you sign in to your device' on the right side.
3. Insert your security key into the USB port as directed by the screenshot.
4. Touch either the button or gold disk on your security key.
5. Click/tap on the Reset button under the 'Reset Security Key'.
6. Click/tap on 'Proceed' to confirm.
7. Touch either the button or gold disk on your security key as instructed on screen. It is important that you lift your finger to touch the key a second time and also that it is completed within 10 seconds.

Once the key has been reset then you will have to revisit the RA for the key to be re-registered.

There is another option to reset a Yubikey which is to install the YubiKey Manager onto your machine.

Step 1: Go to the YubiKey Manager website and select the correct download for your machine.
Step 2: Open the YubiKey Manager application.
Step 3: Insert your Yubikey into your machine and follow the instructions on the screen.