Use short, simple sentences. A simple sentence is easier to understand than a complex or compound sentence. Avoid the use of dependent clauses, parallel clauses, compound sentences, and other complex sentence structures. This is because each of these complex sentence structures potentially denotes multiple controls within the guidance (and should be considered as a signal for such).
If the meaning of a complex sentence can be precisely stated in two or more simple sentences, use simple sentences. Most complex and compound sentences should be broken into 2 or more sentences.
The action directs the subject to act in a particular manner, describing the particular act permitted, required, limited or prohibited. The verb directs, limits or permits action or inaction. Often, the greatest problem for the drafter is selecting the proper verb form.
Sometimes the activity is a single verb, such as when “establish” is used alone. Sometimes two action words, such as “establish” and “maintain”, have to be used together; this happens when the control can be effective only if both actions are taken. Example:
Establish personal data information collection limitation boundaries. Establish and maintain clear zones around any secured facilities.
The subject identifies the person required or permitted to do something or prohibited from doing something. The description of the subject determines the person to whom the control will apply and should, therefore, be precise. Unless it is clear from the context, use as the subject of each sentence the person or entity to whom a power, right, or privilege is granted or upon whom a duty, obligation, or prohibition is imposed.
If there is a limitation on a control’s application, it should be expressed as either the “case” to which the action is confined or as a “condition” upon which it will operate. Limitations or exceptions to the coverage of the control or conditions placed on its application should be described in the first part of the measure -- i.e. at the beginning of the title, article, chapter, section, or non-code provision.
Use positive language whenever possible to express ideas. Compliance and governance documents, however, are frequently prohibitive or restrictive in nature. Use care in wording these sections.
Do not use “shall not”. Use “may not” to prohibit an action. “May not” is broader than “shall not”, because “may not” negates the authority to perform an action and prohibits the action itself. Correlative expressions to “shall not” and “may not” are “no person shall” and “no person may”. A void “no person may” and never use “no person shall”. Literally, “no person shall” means “no person has a duty to”. If a prohibition is intended, put the prohibition in the verb (rather than in the subject).
A person may not submit an application after…
No person may submit an application after…
The case sets out the facts that confine the controls scope or application. Normally, stating the case at the beginning of a sentence immediately notifies the reader of the rule's limited application. However, the target audience for controls needs to be able to quickly identify the actions of the controls. So, the sentence structure must allow a more specific control to be subjugated to a more general control, that is, tell them what to do and then throw in the condition that applies. Many of the case limitations will be based upon triggering events happening, as in the examples shown below.
Document erroneous messages
when spam is sent accidentally.
Update all associated documentation
when a change occurs.
Use “when” to introduce a case, not “in cases where”, “in the event”, or “where”.
Until fulfilled, a condition suspends the operation of a rule and can apply to a rule of general application or to one restricted to certain cases. Place the condition after the action.
Do not send commercial e-mail to a third party
if it does not contain a functioning return e-mail address that is clearly visible.
When adding a conditional limitation where a case also exists, the condition must be placed after both the action and the case.
Waive parental consent for collecting information from children
when responding to additional requests
if the contact does not go beyond the scope of the request.
Never use the future tense of a verb to state a condition.
When the legal action is stated affirmatively, introduce a condition with if” or “until.”.
Generally, an exception is used to exempt from the application of a law some matter that otherwise would be within its scope. Exceptions should not be drafted in the form of a case or condition, because this will lead to a complicated and unintelligible document. Do not use the phrase “provided that”. You can accomplish the same thing with greater clarity by using “if”, “except”, or a new sentence or clause.
Scan the system to verify modems are disabled or removed
except for ones that have been explicitly approved.
Example (Control): Establish and maintain an instant messaging standard for acceptable usage, if instant messaging is allowed. (versus using “will be” allowed)
However, when it is necessary to express a time relationship (such as when there is a condition precedent to the operation of the control), state the facts that are concurrent with the operation of the control as present facts and the facts precedent to its operation as past facts. Example (Citation):
Once the organization has been alerted to the event, the organization will…
When the future tense is appropriate, use the verb “will”. Example (Citation):
The organization will test its continuity plan every…