RA Manager: DoS Positions - NHS England Digital

Overview

This page explains the actions Registration Authority Managers (RAMs) need to take to support the rollout of Directory of Services (DoS) role-based access control (RBAC) permissions. It provides the DoS-specific position, role and standard operations required to create the new DoS positions and configure the DoS Sponsor position in CIS2.

Existing guidance for Care Identity Management (CIM), Apply for Care ID (AfCID) and Registration Authority processes should continue to be used for all RA operations.

Why this is changing

As part of NHS England's commitment to safe, secure digital systems, all national services are expected to use Multi-Factor Authentication (MFA). With MFA now live for DoS, Role-Based Access Control (RBAC) is the next step.

Where MFA confirms who a user is, RBAC governs what they can access, ensuring every user has the right level of access to DoS data, strengthening data governance and keeping DoS aligned with NHS security standards.

This guidance covers the actions Registration Authority (RA) Managers need to complete during the rollout.

What is a DoS Sponsor

A DoS Sponsor is the new name for a combined role that exists at the intersection of two systems: the DoS Admin UI and CIM. This Position is restricted to assigning DoS-specific Positions only, enforced through Assignable Positions.

What they do in DoS Admin UI	What they do in CIM (as RA Sponsor)
Approve new DoS UI user accounts Add/remove legacy DOS permissions	Assign DoS-only Positions to new users Revoke DoS-only Positions when access ends Confirm DoS Position assignments are correct

What they do in DoS Admin UI

What they do in CIM (as RA Sponsor)

Approve new DoS UI user accounts
Add/remove legacy DOS permissions

Assign DoS-only Positions to new users
Revoke DoS-only Positions when access ends
Confirm DoS Position assignments are correct

Find out how to become a DoS Sponsor, which responsibilities the role includes, and how to access the tools required to support user onboarding

Why DoS User Administrators are becoming RA Sponsors

Governance

It preserves the local RA accountability model.

Scalability

With the DoS adopting CIS2 and RBAC, making DoS User Administrators RA Sponsors reduces additional workload on the local RA community by bringing in capacity from users who already understand DoS roles and permissions, and delegates DOS user management to a user base that is already familiar with the DoS business and user needs.

Strategic alignment

It prepares your organisation for the future state where all DoS user onboarding and lifecycle management moves entirely into CIM, eventually retiring the current DoS user management within the DoS Application.

New DOS RBAC activity codes

The DoS team has mapped the legacy DoS permissions to new CIS2 and RBAC Activity codes (B-Codes). This list will be updated with additional Activity codes as DoS retires the current DoS permission model:

Activity code	Activity name	What this allows a user to do in DoS
B2000	DoS Service Creator	Create new services in DoS
B2001	DoS Service Profile Editor	Edit service demographics, clinical information, endpoints and attributes
B2002	DoS Service Profile Approver & Publisher	Approve and publish service profile changes
B2003	DoS Service Profile Assurance	Compare services, run test scenarios and view reports
B2004	DoS Temporary Availability Updater	Update service capacity and availability
B2005	DoS Multiple Service Updater	Update NHS DoS multiple services at once

Set up new DoS Positions

As part of the MFA rollout, organisations were advised to create a position called 'UEC Directory of Services'. Before creating the new DoS positions, check whether this position already exists in your organisation:

If it exists, rename it to 'Directory of Services (DoS)'
If it does not exist, create a new position under your organisation's ODS code using the RBAC attributes below

Position name	Role	Activity code – name
Directory of Services (DoS)	R8008 Admin/Clinical Support Access Role	B0166 – Directory of Services (DoS)

Create the following new DoS Positions, all of which should use the role R8008 Admin/Clinical Support Access Role, as above:

Position name	Description	Activity code
DoS Service Creator	Create new services in NHS DoS. Replaces the legacy DoS permission: addService.	B2000
DoS Service Profile Editor	Edit NHS DoS live services. Replaces legacy permissions including controlService, editDemographics, editServiceAdmin, editClinical, editEndpoints and related permissions.	B2001
DoS Service Profile Approver & Publisher	Approve and publish NHS DoS service profile changes. Replaces legacy approval permissions.	B2002
DoS Service Profile Assurance	Compare NHS DoS services, run test scenarios and view reports. Replaces legacy assurance and reporting permissions.	B2003
DoS Temporary Availability Updater	Update NHS DoS capacity and availability for services. Replaces the legacy permission: editCapacity.	B2004
DoS Multiple Service Updater	Update NHS DoS multiple services at once. Merges and updates the legacy DoS permissions: bulkUpdate and bulkRemove	B2005

Set up the DoS Sponsor Position with DoS-only assignable positions

Read the CIM user guide: Manage assignable positions – NHS England Digital.

Create the following Position:

Position Name: DoS Sponsor:
- Role: R8015 – Systems Support Access Role
- Activities: B1300 Approve RA Requests
- Assignable Positions (see above):
  - Directory of Services (DoS)
  - DoS Service Creator
  - DoS Service Profile Approver and Publisher
  - DoS Service Profile Assurance
  - DoS Service Profile Editor
  - DoS Temporary Availability Updater
  - DoS Multiple Service Updater