DoS Sponsor: access, roles and responsibilities

A Directory of Services (DoS) Sponsor is responsible for managing user access across the systems used to onboard and administer DoS users.

As a DoS Sponsor, you approve user accounts in DoS Admin UI, support identity verification using Apply for Care ID (AfCID) and assign appropriate DoS Positions using Care Identity Management (CIM).

Before you can access CIM or AfCID, your RA needs to update your Care Identity (CI) by assigning the DOS sponsor position and an AAL3 authenticator.

What this role does in DoS Admin UI

• Approve new DoS UI user accounts 
• Add/remove legacy DoS permissions

What this role does in AfCID and CIM

In AFCID 

• Invites DoS users who do not have a CI to begin the process of proving their identity 

In CIM 

• Schedules onboarding and off-boarding of users
  • Assigns DoS-only Positions to DoS users' UUID
  • Revokes DoS-only Positions when the user's access ends
• Confirms DoS Position assignments are correct

Why NHS England is making this change

As part of NHS England's commitment to safe, secure digital systems, all national services are expected to use Multi-Factor Authentication (MFA). With MFA now live for DoS, Role-Based Access Control (RBAC) is the next step. Where MFA confirms who a user is, RBAC governs what they can access,  ensuring every user has the right level of access to DoS data, strengthening data governance and keeping DoS aligned with NHS security standards

What this means for current DoS User Administrators

DoS Sponsors are DoS User Administrators (holders of the Legacy DoS 'ApproveUser' permission) who manage user access within their own organisation. The role gives you local control, maintains full audit trails, and prepares your organisation for the future state where DoS user onboarding and lifecycle management moves entirely into AfCID and CIM, eventually retiring user management within the DoS application itself.

Prerequisites

Before accessing CIM or AfCID, ensure that you have: 

• completed the National Registration Authority and Smartcard Policy (RAP) training
• share your RAP completion certificate and your UUID details with your local RA Manager

And your local RA manager will have assigned:

• the DoS Sponsor Position to your CI
• an Authenticator Assurance Level 3 (AAL3) authenticator to your CI

Roles and responsibilities

• What is a Registration Authority?
  Descriptions of each RA role
• Registration Authority policy
  Governance requirements

Note: please pay specific attention to Appendix 3 of the policy page. If you have any questions, please contact your RA Manager.

As a DoS RA sponsor, you may be able to assign the following DoS Positions directly to users who have a UUID. The new CIM Positions replace the existing (legacy) DoS permissions.

The above Positions are managed by your RA Managers – find out about how these positions are set up.

AfCID is a secure online ID verification service for NHS users to submit and verify their documents online. Once a user's identity has been verified, a profile will be created for them in Care Identity Service (CIS).

Access AfCID [opens in new tab]

As a DoS Sponsor, you can: 

• enter user details to invite them to apply
• update CI applications you have submitted
• check the progress of CI applications

Once the applicant has successfully completed the required identity checks, the application will progress through the Registration Authority approval process. After the applicant's identity has been approved: 

• a UUID profile will be created
• the user's CI will also become available within CIM where DoS access and permissions are managed

For support using AfCID, view the Apply for Care ID guidance.

CIM allows NHS and healthcare staff to be registered for a ‘Care Identity'. A digital identity that can then be associated with health and care organisations they work for.

The system is used to assign and manage permissions that enable appropriate access to clinical systems and patient information. It is also used to assign authentication tokens that allow healthcare professionals to perform multi-factor authentication to these clinical and patient record systems.

Access CIM [opens in new tab]

As a DoS Sponsor, you can:

• assign DoS-only Positions to DoS users' CI 
• revoke DoS-only Positions when the user's access ends 
• confirm DoS Position assignments are correct

If you are unable to access CIM, contact your local Registration Authority team.  

For support using CIM, view the CIM guidance.