Absolutely spot on....apart from DEC state the requirement
It should read.....DEC should state the requirment.....More often than not (in fact pretty much always) the end user states the requirment and he is the bloke what writes it....Ive done plenty of SOR's to know that.