Getting onto the GOV.UK register of digital identity and attribute services is not an automatic process. It can take up to 20 working days for your service to appear on the register. That’s because there are important, human-led review processes that take place after your service is certified. Often those processes aren’t visible to providers who’ve applied to join the register, and that leads to one question:
“Why isn’t my service on the register yet?”
In this blog post, we’re going to explain how those processes work in practice, why we have them, and how long they take to complete.
Step 1: You get your service certified
Before you join the register, you need to get certified by a conformity assessment body (CAB). We have published a list of approved CABs that are able to help with that.
Your service will be evaluated – through audits and other testing methods – by your CAB against the rules in the UK digital identity and attributes trust framework and any relevant supplementary codes. This process commonly takes around one to two weeks – though it can be more or less depending on the specifics of your service.
After the evaluation is concluded, your CAB will have an internal process to decide whether or not to certify your service. If it decides “yes”, you will be issued with a certificate. You should ask your CAB for an estimate of how long this internal process might take for your service.
Step 2: We validate your certificate
After your CAB has decided to certify your service, it is required to provide a copy of the certificate to OfDIA. It also provides a Certification Feedback Report – a more detailed record of what is certified and a log of the evidence the CAB used to inform the decision.
OfDIA uses this information to validate that the certificate is valid under the certification procedures and to enable you to make an application. If anything looks out of place, OfDIA asks the CAB to double check the certificate and to correct any errors that might have slipped through. This process takes around 5 working days.
Step 3: You make an application
After your certificate has been validated, OfDIA sends an automated email inviting you to apply to have your organisation and service appear on the register.
Making an application is fast. You don’t need to input any information: everything is provided to us by your CAB directly when they give us your certificate. All you need to do is review the information that will be published if your application is successful.
It takes as little as 60 seconds to review the information and submit the application.
If any of your information is wrong, you usually need to contact your CAB, who will update your certificate and resubmit it to us (and we’ll need to review it in OfDIA again).
Step 4: We review your application
After you have made an application, we in OfDIA review it before you get onto the register. This review is designed to ensure a bad actor doesn’t slip through net and onto the register; jeopardising trust in the ecosystem as a whole. For that reason, two separate members of the OfDIA team are involved in every decision: one to do the initial review and the other to validate it.
The review is often very quick – a matter of hours – but we have an internal target of 15 working days within which to complete it.
Step 5: Your service is published on the register
If your application is successful, you will receive an email confirming this. Your service will then be published on the register automatically.
We move as fast as we can
We move as fast as we can once a CAB has issued a certificate for a service and OfDIA has received it, but please allow up to 20 working days before a service is published on the register.
If you have any questions about the process, please contact us or your CAB, who will be happy to provide any advice you need.
Leave a comment