Each user story requires an acceptance criteria e.g 

As a getskills website user
I should be able to sign up as a student   
So that I can later log  in   and attend  classes

The above user story can have the following acceptance criteria
1. User can sign up with valid email ID
2. User gets a valid notification on sign up
3. User gets a confirmation message during the sign up
4. User should see the sign up confirmation message within a few seconds

Above example covers the functional, security and performance aspects of a user story .The most important thing is that business stakeholders should understand all aspects of a user story. Sometimes you will to have to work with nontechnical product owners and will experience that they are just focused on the functionality, by explaining the impact of security and performance you can help them in defining acceptance criteria



Although not recommended , but acceptance criteria can be written as  single liners too and later expanded into more detailed criteria

User can login successfully
Exception handling for the login feature has been implemented
The performance of the Login feature is acceptable

The best way to write acceptance test is by using Gherkin language (Given, When and Then format)
A good acceptance tests can be defined as following

Given I login into Getskills portal as an administrator
Then I can see the options to create a new course
When I create a new course 
And I enter the pricing details of new course 
Then the course can be saved successfully
And the course can be published to all GetSkills students