I've published my CIS2 onboarding notes

What's in it

Thirteen milestones from Supplier Assurance Assessment through to post-live compliance. Each one is marked with where I am on it — done, in-flight, or not yet reached — so you can weight the content accordingly.

The bits that are already worth reading, all learned inside the last two months:

• The NHS onboarding portal is two systems in a trench coat. onboarding.prod.api.platform.nhs.uk hosts two separate tracks on the same domain, and CIS2 Authentication is only reachable from the invitation-only DOS Assurance one. Land on the self-service side and you can spend days going in circles.
• The Supplier Assurance Assessment is reusable across tenants where scope hasn't materially changed. NHS Digital confirmed this to me in June 2026. Useful if you plan to onboard multiple tenants on a shared platform.
• Applications created from your personal Developer Portal home screen land under your personal account, not your Team, and can't be self-transferred. Delete and recreate from inside the Team page — quicker than raising a support ticket.
• DOS activation email links expire and don't resend automatically. Ask NHS Digital to reissue if you miss the window.

Where I am

DOS registered, Developer Portal Team and INT Application created, DOS invitation accepted, SAA (Id 1089) sitting in the queue waiting for me to answer it. Next action is appointing an independent Clinical Safety Officer (I'm acting as interim CSO myself) — critical path for the DCB0129 safety case and the DTAC C1.2.5 evidence.

What's next

The playbook gets updates milestone-by-milestone as I progress — starting with the SAA once I've filed it, then INT configuration once Connection Manager access is through. DCB0129 and DTAC tools follow, same working-document format.

If you spot something out of date or wrong, please tell me via the contact form.