When the specification has clearly defined MUST,SHOULD,MAY requirements (RFCs for e.g.) these requirements are taken verbatim.
In case of other specifications, we develop CTS with strict adherence to spec and hence all requirements are taken as MUST unless specified as an Optional choice OR when action is not specified (for e.g. A spec may say that Field reserved MUST be sent as all zeros. But misses to mention what to do if received a packet with non-zero Reserved field – ignore or discard? In this case we create a Negative test with a MAY).
Sometimes the requirements as MUST may prove strict to the customer and they may choose to ‘safely’ be non-compliant(may be functionally correct). In such a case customers can chose to ignore the strict requirement.