Requirements Terminology – Defining MUST, SHOULD and MAY

One of the problems of working with the PRINCE2 practitioners is that the people tend to get highly focussed on definitions in the Scope of Works. A Scope of Works defines what the deliverables the customer is to received.

The problem with a Scope of Works is that it is usually prepared before the work is started and/or fully understood. maybe you have a Gap Analysis, a Consulting Reports or a Requirements Document to setup the initial engagement (every company has their own name of the same thing).

Childs Prince Drawing

For example, a Scope of Works for building a Data Centre Network would require an extraordinary level of understanding to fully comprehend all the systems, applications, data flows and their dependencies. A Scope of Works is, fundamentally, more of a general plan or overview of the works. That’s the problem. One group of people treat the Scope of Works like a legal contract while the data contained is actually a summary of technical intentions for the work to be performed.

Requirements Terminology

Therefore I find using precise terminology to be useful. After many years of reading IETF RFCs I’ve come to love RFC2119 – Key words for use in RFCs to Indicate Requirement Levels as guide to exact phrasing. I’ve developed the following set of text that goes into my documents.

MUST -This word, or the terms “REQUIRED” or “SHALL”, mean that the definition is an absolute requirement of the specification.
MUST NOT – This phrase, or the phrase “SHALL NOT”, means that the definition is an absolute prohibition of the specification.
SHOULD – This word, or the adjective “RECOMMENDED”, mean that there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.
SHOULD NOT – This phrase, or the phrase “NOT RECOMMENDED” mean that there may exist valid reasons in particular circumstances when the particular behavior is acceptable or even useful, but the full implications should be understood and the case carefully weighed before implementing any behavior described with this label.
MAY – This word, or the adjective “OPTIONAL,” mean that an item is truly discretionary.
FUTURE – This word means that objectives are provided as guidance or expectation and may or may not be accurate.
SEPARATION – This word means the prevention of reach-ability to designated resources.

This way, people who read the word “MUST” and want it to say “MIGHT” or “MAYBE” don’t get to misinterpret to their own way of thinking.

Warning

It’s worth noting that you also need to be quite precise and accurate in using these terms consistently throughout your documents. it takes some discipline to “mean what you mean”. Personally, I find that the use of these definitions makes me focus closely on the writing and leads me to be more accurate overall.


Image Credit

About Greg Ferro

Greg Ferro is a Network Engineer/Architect, mostly focussed on Data Centre, Security Infrastructure, and recently Virtualization. He has over 20 years in IT, in wide range of employers working as a freelance consultant including Finance, Service Providers and Online Companies. He is CCIE#6920 and has a few ideas about the world, but not enough to really count.

He is a host on the Packet Pushers Podcast, blogger at EtherealMind.com and on Twitter @etherealmind and Google Plus

  • Chris Kane

    Good idea. For all the times that a client has leveraged my generalities against me, I hadn’t thought of using this RFC as a reference. This may allow me to further delay the engagement of a lawyer.

    Thanks,
    -chris

  • Alex

    One organisation I previousily worked for made RFC2119 the standard “Appendix A” in the organisation’s template for design documents.

    Can’t agree more that this is an essential reference for almost any document.

    Cheers
    Alex

  • jscottw

    I’m sorry I don’t understand the definition of ‘Separation’. Please explain. Thank you.