Summary
IT teams need to:
- work with Registration Authorities to make sure all series 4,5,6 (Gemplus, JCOP 41 and JCOP41) smartcards have been replaced by series 8 or above smartcards
- install Oberthur middleware on all devices
- update to the latest version of Identity Agent
It's important to complete all these steps as soon as possible. Failure to do so could result in authentication issues and service disruption.
Key dates in detail
End of June 2025
Oberthur middleware must be installed
Oberthur middleware must now be installed on all devices to maintain service access. Read about Oberthur middleware and how to install it.
If you are having issues with Oberthur installation you should raise it directly with the National Service Desk by emailing [email protected]. You should:
- use ‘OT Middleware Deployment – Prescription Signing’ as the subject of the email
- include a description of the issue
- if possible, include the output of the NHS England Diagnostic Tool
You can also raise the issue using the National Service Desk customer portal.
Identity Agent must be updated
All unsupported Identity Agent versions must be replaced. Find out how to update to the latest version of Identity Agent.
Updating Identity Agent will enable removal of TLS 1.0/1.1 ciphers. The National Cyber Security Centre (NCSC) and Microsoft advise that TLS 1.0 and TLS 1.1 should no longer be used. Organisations should upgrade to at least TLS 1.2 to maintain security.
July and August 2025
We intend to block authentication at planned intervals throughout these months for systems using unsupported Identity Agent versions.
This is to ensure that organisations update Identity Agent to enable the upgrade to at least TLS 1.2.
September 2025
Authentication will be blocked for unsupported Identity Agent versions using TLS 1.0/1.1. You must update to the latest version of Identity Agent to authenticate.
October 2025
The CIS1 Authentication service will drop to Silver Service Level Agreement (SLA).
Operational hours will remain 24 hours a day, 365 days a year, but support hours will be reduced to 8am to 6pm Monday to Friday and 99.5% availability (target maximum of 3.5 hours of downtime per month).
NHS CIS2 Authentication will continue to be run to Platinum SLA.
More information
Read more about the retirement of CIS1 Authentication.
