DISA Security Technical Implementation Guides (STIGs) REQ-2: REQ-2 Requirement wording: must, the product's name, and 'must be configured to'

The STIG-specific requirement focuses the SRG requirement on the product: it uses must rather than should; for Applicable-Configurable requirements it replaces the SRG's generic terminology (application, operating system) with the specific name of the technology; and it uses the wording 'must be configured to' rather than 'must be capable of' or 'must have the capability to', so that a requirement states a configured state, not a product feature (the [technology] must be configured to prevent browsers from saving user credentials).