Skip to main content

Single Sign-On readiness assessment

How we establish whether Single Sign-On can work in an organisation, and whether the conditions are right for a pilot.

Page contents

About the assessment

The Single Sign-On readiness assessment is how the service identifies NHS organisations that could partner with us on Single Sign-On.

It is not a desk exercise or an audit of your organisation. It is a structured, 2-part conversation about whether what we are building can help your staff, and whether the conditions exist for a successful pilot.

The assessment is deliberately shared work. We do not arrive with a solution and ask you to host it, and we do not ask you to design or run the assessment yourselves. Each organisation we assess also adds to our understanding of NHS applications and how they handle authentication, so what we learn with you makes the next assessment better informed.

What we assess

Real user pain
Real user pain

Is there genuine authentication friction for health and care workers, for which staff groups and roles, with which applications, and how severe is it?

Technical fit
Technical fit

Can the Single Sign-On patterns we've built serve the user needs of the applications in your estate, or do we need to explore new approaches?

Organisational readiness
Organisational readiness

Do you have the people, the technical capability, the capacity and the senior buy-in that a partnership of this scale requires?

These 3 dimensions run consistently through both phases. We assess them in parallel, because they constrain one another: pain without technical fit cannot be addressed, and technical fit without capacity cannot be delivered.

Pre-assessment

The first phase is a single session of around 2 to 3 hours. Its purpose is to establish whether there's a good fit between your organisation's needs and what the service can currently offer, before committing more time and resources.

We will pre-populate the pre-assessment as much as we can from information that already exists, such as Digital Maturity Assessment scores, Data Security and Protection Toolkit status and any previous engagement with the service. During the session, we'll ask your team to reflect on collated scores, describe previous research initiatives or explain how processes in your organisation work.

The session itself covers:

  • the user experience - whether your frontline staff experience authentication friction, such as too many logins, frequent password resets or timeouts during clinical work, and whether there is appetite to address it
  • the technical landscape - your authentication and access management setup, your application estate, and whether the technical conditions exist for a pilot
  • organisational readiness - whether you have the capacity, the right people and the willingness to work with us on a deeper assessment and a potential pilot

After the session, we discuss internally and come back to you within a week with 1 of 3 recommendations:

  • proceed to the deep dive phase
  • defer to a later date
  • agree that it's not the right fit

Deferring is a normal outcome rather than a failure, and we stay in touch with organisations that are interested but not currently ready.

Deep dive

The second phase is a structured 8-week assessment, run as 4 sprints of 2 weeks each. We work with your clinical, technical and operational staff to understand where login friction is highest, which applications are candidates for Single Sign-On, and whether the technical and organisational conditions are right for a pilot.

All research with your staff follows user-centred design practice for ethics, informed consent and data handling, in line with NHS research governance. What we would need from you, sprint by sprint:

Sprint 1: validating the problem
  • A meeting with a clinical manager to confirm where the problem sits and which staff groups to focus on. This is normally someone who has worked clinically and can describe activities impacted the most by absence of a single login.
  • Access to baseline data you already hold, such as helpdesk tickets, password reset volumes and system usage logs.
  • Your application asset register, and completion of our technical questionnaire.
Sprint 2: talking to staff and suppliers
  • Access to 3 or more frontline staff per role for 60-minute interviews.
  • Observation of clinical work where that is possible.
  • Introductions to the suppliers of candidate applications, so we can begin technical conversations.
Sprint 3: application deep dives
  • Continued access to technical contacts for per-application deep dives, covering around 10 applications.
  • Conversations directly with your application suppliers' technical teams where internal knowledge of a configuration is limited.
Sprint 4: safety, governance and the joint decision
  • Participation in a joint synthesis and decision session, involving your clinical, technical and delivery leads alongside ours.

Decision points and outcomes

You are not committed to all 4 sprints at the outset. Each sprint ends with a decision point. If we find something that means Single Sign-On will not work in your context, we stop and explain why, and the findings so far are yours regardless of the outcome.

At the end of the deep dive you receive:

  • confirmed user groups in your organisation, with evidence of the pain they face
  • candidate applications matched to Single Sign-On patterns, with a feasibility assessment for each
  • a clinical safety assessment
  • a recommendation on whether to proceed to a delivery partnership, defer, or stop

Organisations that proceed move on to work with the delivery team. Depending on how mature the relevant Single Sign-On patterns are and how complex your estate is, that may mean discovery, alpha, beta or a live rollout. We set out what that involves before you agree to it.

Last edited: 29 September 2026 10:41 am