Safer access has to work on the next shift

NCSC’s annual review, published on 3 November, describes passkeys as a more resilient alternative to passwords. Cryptographic credentials are linked to the genuine service, reducing familiar weaknesses such as phishing. The review covers September 2025 to August 2026 and recalls its earlier recommendation for individuals. It does not introduce a new requirement for every care provider to replace every login. ^[1]

The care-sector context arrived a day earlier. Digital Care Hub’s 2 November inclusion campaign asks whether digital expectations match the resources and support available to workers, and whether their experiences influence decisions. It places participation beyond simply possessing a smartphone. That is a useful starting point when stronger authentication is being discussed with a workforce. ^[2]

Choose one important service and follow its use through the day. Who needs to enter, on which equipment, and from where? Include the colleague covering an unfamiliar shift and the person coordinating visits away from the office. Their tasks give the technical discussion a purpose and expose assumptions a central settings report may miss.

Keep the desired improvement clear. The objective is appropriate access with an understandable route for help. A successful trial by the person configuring the system cannot establish that the same arrangement works for everyone expected to use it.

Multi-factor authentication asks for more than one kind of evidence of identity. NCSC’s organisational guidance leads with FIDO2 credentials, protected on a trusted device or security key, while recognising differences in security, accessibility and usability. The suitable choice depends on the service, the equipment available and what the provider can manage. An individually controlled key can be relevant even where a workstation is shared. ^[4]

For providers completing the Data Security and Protection Toolkit, Digital Care Hub’s current IT guidance sets out question 4.5.3: remote user accounts should have MFA enforced, with exceptions approved by the board or equivalent senior management. Read this within the relevant toolkit assessment. It is not evidence of a newly enacted, universal November MFA law. ^[3]

Ask staff to demonstrate an ordinary task using the proposed arrangement. Check where a device is kept, whether it is available to the intended user and how the handover between shifts works. Do not build the process around an untested assumption that every worker can supply a suitable personal phone.

Where a worker needs an alternative, involve them before the method is fixed. Ask the technical team to explain options in plain language and test them under realistic conditions. A difficulty should have a route to support, not become a reason for colleagues to exchange credentials or depend on someone else remaining signed in.

The purchasing conversation follows from that evidence. Equipment, configuration, induction and continuing support are part of the cost of a workable arrangement. Managers can then compare proposals against the service staff actually need, with any exception visible to the person authorised to accept it.

Digital Care Hub’s toolkit support asks providers to amend or remove access when someone changes roles or leaves, including access to shared mailboxes. It also addresses accountability for administrators, including those working for external support companies. Those questions concern continuing management, which cannot be completed merely by changing the login method. ^[3]

Agree how a staffing decision reaches the people able to change permissions. In a group, central administration and local managers may hold different parts of the answer. In a smaller provider, one manager may coordinate several systems. Either arrangement needs a clear handover, including separately commissioned software.

Temporary access deserves the same attention. Record who requests it, the work it supports and when it should end or be reviewed. Ask how a change of assignment is reflected without assuming that the end of a rota entry automatically closes every account.

Shared equipment also needs an account of individual responsibility. A tablet passed between workers should not leave managers unable to establish whose authorised access is being used. Ask the supplier how the arrangement supports that distinction. Keep care records and sensitive account details in their approved locations rather than copying them into a general management spreadsheet.

Try a lost-device or locked-account exercise with the people who would receive the call. Establish how the worker reaches support, how their identity is verified and who can authorise a reset or restriction. Include an evening or weekend scenario where that reflects the service. The route should remain available when the usual login is not.

DHSC’s supplier guidance, published on 29 September, asks providers to examine service hours, charges and the handling of serious issues outside normal hours. It also distinguishes response commitments from commitments to fix a problem. For access recovery, establish which organisation acts where an application supplier and an IT provider share responsibility. ^[5]

Care leaders and the relevant professionals must determine how care continues during interruption, using approved procedures. Technical support can establish the account position and recovery options; it should not make clinical judgements or create an informal substitute for the information needed to deliver care.

A specialist can help reconcile accounts with roles, configure suitable controls and test the support handover alongside existing providers. Commission a defined result: an explained coverage position, understood exceptions and evidence of how authorised access was restored. Give any remaining difficulty an owner and a further test.

The return on that work is practical. Staff know the route for help, managers understand the protected access they rely on and unresolved limitations have a decision attached. A tested recovery then becomes part of a dependable service, rather than a promise that someone will sort it out when the next shift starts.