Technical architecture
What hardware, software and connectivity are needed to issue and manage NHS smartcards reliably?
Separate the three functions
| Function | What it establishes | What it does not establish |
|---|---|---|
| Authentication | The operator can sign in to an enabled service. | The target card can be issued or printed. |
| Card management | The authorised operation can update the target card. | The printed face is correct. |
| Physical personalisation | The card is processed by the printer and its reader. | The complete future application journey is supported. |
CIM is the management application. Smartcard Connect is packaged with Credential Management; the modern stack still includes Credential Management. Treating it as exclusively legacy software would omit a current dependency. SRC-005
Logical dependency view
flowchart TB
accTitle: Smartcard issuance dependencies
accDescr: Local readers and the printer connect to the workstation. The workstation needs online identity services and an authorised card management workflow.
devices["Readers and printer"] --> workstation["RA workstation"]
workstation --> identity["Online identity services"]
identity --> workflow["Authorised CIM workflow"]This is a dependency diagram. It does not specify packet order, token storage, internal national services or a single browser-to-middleware sequence. The physical device path and the network path both need acceptance evidence.
Deployment options
| Option | Design consideration | Required evidence |
|---|---|---|
| Managed workstation on an existing HSCN network | Inventory applications that still need the connection. | Modern and residual legacy paths tested separately. |
| Managed workstation using internet egress | Candidate baseline for a new installation. | Complete issue-and-print test through the actual gateway. |
| Dedicated managed RA workstation | Useful where shared desktops complicate hardware access. | Ownership, software maintenance and RA operating controls established. |
| Virtual desktop | Assess the exact supported stack and redirection path. | The virtual desktop checks, including concurrent sessions. |
These are local design options, not additional NHS support categories. Use the network boundary, workstation baseline and acceptance checklist to choose between them.