Video, slides and key messages from the series 10 smartcard intro broadcast

Good afternoon everybody and welcome to this Identity and Access Management series 10 smartcard broadcast. My name is Richard McDermott. I'm part of the NHS England Identity and Access Management engagement team. 

We've got some colleagues with me today that will be talking through some of the requirements for software and hardware related to series 10 smartcards. Very briefly, the broadcast today will be recorded. It will be made available on our website as soon as possible. There's a significant amount of interest in this session and this session is in fact full, but please feel free to share the recording with colleagues that have been unable to register for this session today. 

As I said, the agenda today will be talking about Series 9 and 10 smartcard supply, talking about Smartcard Connect version 4.1 and the various requirements for IT and RA teams going forwards.

I'm going to pass over to my colleague, Phil Gill, who I'll let introduce himself as he runs through the early part of our slides. Phil.

Thanks, Richard. Good afternoon, everyone. So I'm Phil. I'm the product owner for Client and Credentials, which covers smartcards and associated software at NHS England and IAM. Yeah, so series 10 smartcards. The Series 9 cards are no longer being produced. So as a result, can't get any more. And we will be issuing series 10 smartcards probably from next month onwards. We certainly need to start doing that for everyone by the end of July because our series 9 stock will be exhausted then. So, there'll be no further series 9 held in stock.

We've got an image of a series 10 smartcard on the screen. So you'll see the serial number is preceded by 10. That's how you identify it's a series 10 smartcard. These are now active on the ordering portal. So If you request them, we will manage the supply of them through till we start going to full supply from later on in July. 

Next slide, please, Richard. Oh, thank you. You've done it already. So a couple of points to make. Series 10 smartcards work with our new version of Smartcard Connect that was released last week. That's version 4.1. And it's required to perform all smartcard management operations. So that includes issuing and printing a card,
unlocking it, self-service and Registration Authority and legacy local smartcard administrators and Registration Authority repair because part of repair is renewing certificates as well.

The legacy Identity Agent version 2.4.10 and the legacy Credential Management, which our latest version is 1.4.2.0, work with series 10 smartcards, but only for authentication. So each of your end users can continue to authenticate if they've got those components. But as we say there, only until the 28th of February 2027, because we're retiring CIS1 at that time. You can't use legacy IA for any other smartcard operations for a series 10.

Series 10 smartcards only work with our only assured printer now, which is the Magicard DOH 300 V2. If any of you have the very old turquoise or blue printers, series 10 smartcards do not work with them. It's to do with various processing speeds. There's nothing we can do about that. And we've got a link there to where you will find details of the printers.

Next slide, please, Richard. So Smartcard Connect version 4.1 is a software package that includes Credential Management, includes Smartcard Connect, and now it's also bundled with the NHS Smartcard Diagnostic Tool. When you install it, it will overwrite previous versions of Smartcard Connect. If you are putting it on a machine that has the legacy Identity Agent, you do need to uninstall the legacy Identity Agent. And another thing to mention, we are looking at developing a single installer that will install required software, middleware and drivers, that might be useful to some organisations. And once that comes to fruition, we'll put some more information out about it and make it available to IT teams. And again, we've got two links there as to where you can get further details.

Next slide, please, Richard. So try to do a summary table here in terms of Smartcard Connect and legacy Identity Agent with series 10 smartcards. Both packages will allow for authentication, but RA issue, RA repair, RA renew, self-service smartcard unlock, self-service smartcard passcode change and self-service renew will only work with Smartcard Connect 4.1. They will not work with the legacy Identity Agents.

And a couple of notes there at the bottom. Series 8 and series 9 smartcards also work with the legacy Identity Agent and this new version of Smartcard Connect. And the legacy Identity Agent and the latest version of Credential Management version 1.4.2.0 will not work after the 28th of February next year in line with CIS1 retirement.

Next slide, please, Richard. And now I think I'm handing to Owain.

Yeah, hi everyone. So following on from what Phil has just explained around series 10 and the crossovers with Smartcard Connect, we wanted to bring to everyone's attention the user behaviour changes that we're going to see with Smartcard Connect. And this applies to all versions of Smartcard Connect itself.

So the main one is that it will be different to how the Identity Agent works today. So when you put your smartcard into a card reader today, the Identity Agent pops up your passcode entry box. This won't happen with Smartcard Connect. What you'll need to do is go into an application, for example the National Care Record Service, and that will then trigger the passcode pop-up within Smartcard Connect. This is similar across all applications where you're doing smartcard access using Smartcard Connect.

In a similar fashion, removing your smartcard from the card reader will not log you out of the session. This is part of the CIS2 Auth functionality as well as specific to Smartcard Connect. You will need to manually log out of an application when you are finished in order to retain IG and information security.
You will also need to enter your passcode every time you open up a new application. So for example, if you are opening up the National Care Record Service or the e-Referral Service, each time you load one of those and go to enter your passcode, you will have to enter it each time. This is because of the way that CIS2 Auth works and how each of the individual applications have chosen to interact with CIS2 Auth. There's a setting that they're using which prompts each time you log in.

And for everyone's benefit, Smartcard Connect works over internet and HSCN, whereas the legacy Identity Agent only works on HSCN.

Further to what Phil said about series 10, Smartcard Connect is required to use self-service unlock and self-service smartcard renewals. This is a reiteration of what Phil has just gone through with the previous table. 

We also wanted to draw to everyone's attention that as things progress, they may not feel they need smartcards within your organisation or any of the additional software such as Smartcard Connect. So when we share these slides, you'll be able to find out more about our other authenticators by clicking on the link.

We did have a few questions ahead of time around potential challenges with third party suppliers.

So we only know about two issues at the moment. So the Access Group, and specifically here it's the Rio application. When using Drop Zone, it does not support Smartcard Connect or any other CIS2 Auth non-smartcard authenticator. As a result, it will only support series 10 when using the Legacy Identity Agent. So there's no crossover there between series 10 and DropZone and it not working. It is about the software that's in use, i.e. Smartcard Connect versus Identity Agent. I believe the Access Group this morning has released some updates about the DropZone functionality. We've not had chance to digest those updates just yet, so this may be slightly incorrect compared to that update.

When it comes to virtual smartcard providers, due to the way that virtual smartcards have a hard dependency on CIS1 Authentication and basically the underlying infrastructure, they are unlikely to work when Smartcard Connect is installed. We are having dialogue and we continue to have dialogue with the two vendors or the two known vendors of virtual smartcards at this point to ensure that we can facilitate a CIS2 Authentication aligned solution or solutions. That dialogue has changed a little with our move to support the 10-year plan. So we are working on it, but it is known that the virtual smartcards themselves are unlikely to work.

And fundamentally, these are the two that we know about. If you come across any other issues with series 10 or with Smartcard Connect not working with different systems, please use the link that we've got on screen and will be in the notes when we share them. This will make us aware and we can pick up with that supplier.

Thanks very much, Owain. So thanks to Phil and Owain there for running through some of the details around series 10 physical smartcards and Smartcard Connect version 4.1. 

As a roundup, we want to make sure everyone's aware of the key takeaways from the presentation that we've just shared there. So series 10 smartcards will be issued from July 2026 - exactly when in July, that, as Phil said, that depends on kind of the running out and expiring the series 9 stock. The legacy Identity Agent version 2.4.1.0 and Credential Management version 1.4.2 will only support authentication and this is until the 28th of February 2027. 

So again, as a reminder, all card management operations, whether they're via an RA or whether they're via self-service or self-service unlock, require Smartcard Connect version 4.1 in order to perform these. 

And as a final reiteration, Smartcard Connect and user behaviour change that we expect to require some changes in behaviour from some users. Removing your smartcard no longer logs you out of an application and a user is expected to log out of an application when they're finished. Inserting a smartcard no longer presents the passcode pop-up box as a number of people will be familiar with with the legacy Identity Agent. A user has to go to the application they're looking to authenticate into in order to see the passcode pop-up box and the expectation be on based on supplier implementation of CIS2 Authentication is that passcode input is required each time you open a new application. 

And finally from us today, as I highlighted, there are a number of systems and suppliers that work with series 10 smartcards and Smartcard Connect. But if you do have concerns or if there are any system suppliers that have some challenges with series 10 smartcards and Smartcard Connect. There's a web form there available to capture the key information so we can gather that at an Identity and Access Management team level and work with you and system suppliers to resolve those challenges.

Final slide we have, which will be available on the NHS England's Identity and Access Management website, is some helpful links around Smartcard Connect series 10s, non-smartcard authenticators, and our news headlines where we put kind of up-to-date changes based on latest news from within the IAM space.

Finally, thanks very much for everyone for joining us today. Appreciate the questions that we had in advance on request, and hopefully we've covered those off in the slide deck. We are available via the IAM platform's email address for questions ongoing. 

But yeah, thanks very much everyone for joining us today and that's everything from us.