16. Annex D: Drafting Tests for Future DACS Controls

A proposed DACS control shall satisfy all of the following tests before inclusion in the normative body:

• The control has a clear decision-scope applicability condition.
• The requirement uses mandatory language and can be tested as Pass or Fail.
• The Pass condition is observable and evidence-based.
• The Fail condition is explicit.
• Required evidence is listed.
• Subjective language is replaced with thresholds, criteria, rule references, authority, or Gate readiness states.
• The control does not require a specific vendor, platform, tool, data model, or implementation pattern unless that implementation is itself the declared scope.
• The control separates discovery, review, Quarantined evidence, constrained use, and stated use.

The control addresses a DACS decision-scope control gap directly or states how adjacent standards, frameworks, tools, or records may supply evidence without becoming automatic substitutes for DACS conformance.