update Section 4.3 through 4.4

**Capabilities:** Access to a resource is linked to a token which can be passed between processes.

### 4.3.4 Resource management

### 4.3.5 Resource management

Operating systems often allocate system resources among different processes and threads, including processor time, memory, storage, file descriptors, and process table entries. Operating systems may implement limits on the number or proportion of specific resourcs that an application or thread may use, and may group these limits by user, process, process group, or other mechanism.

Operating systems may control resource management in different ways, including but not limited to imposing per-process limitations on processor time, memory allocation, storage usage, number of file descriptors, or number of process table entries. 

### 4.3.5 Scheduling

Operating systems may implement limits on the number or proportion of specific resourcs that an application or thread may use, and may group these limits by user, process, process group, or other mechanism.

Operating systems may provide voluntary or involuntary switching between different threads. Some common models include:

### 4.3.6 Scheduling

Operating systems may provide voluntary or involuntary switching between different processes, and may rely on hardware capabilities to improve or limit parallel process execution and isolation.

Some common models include:

**Cooperative scheduling:** Each thread runs until it voluntarily yields control of the processor to another thread. No thread is interrupted unless it explicitly yields the CPU.

**Preemptive scheduling:** Threads can be involuntarily suspended by the scheduler and replaced with other threads, and they may also voluntarily yield the CPU.

The operating system can choose which thread to schedule based on factors such as:

Operating system may perform secuduling based on many factors, such as but not limited to:

* Time spent executing during a previous time period

* Time since the thread was first marked runnable

* Resource limits

* Performance considerations

### 4.3.6 Vulnerability Handling

### 4.3.7 Vulnerability Handling

#### 4.3.7.1 General Vulnerability Handling

#### 4.3.6.1 General Vulnerability Handling

Operating Systems often provide the essential functionality of securely updating the underlying hardware and the installed software products which rely on the operating system.

Operating Systems provide essential functionality for securely updating hardware and software products which integrate the operating system. Therefore, the manufacturer of the Operating System shall document and maintain a policy for handling vulnerabilities in accordance with << NORMATIVE REFERENCE TO PT3 HERE>>.

Given this essential role of the operating system in maintaining the security of products which rely on operating systems, it is important that vulnerabilities in operating systems are remediated expediently and in coordination with manufacturers of products that rely upon them.

**_Editor's Note_: _This Section Needs To Be Moved To Section 5_**

For operating systems that rely on third-party open source software components, the manufacturer's vulnerability handling process shall include:

1. recording of all third-party open source components by name, version, source location, and hash-based identifier;

This should be accomplished by implementing additional vulnerability handling steps according to common industry standards such as << INFORMATIVE REFERENCE TO FIRST GUIDANCE HERE >>, and by relying on accepted standards for precise software identification, such as << INFORMATIVE REFERENCE TO PURL and SWHID HERE >>.

#### 4.3.6.2 Enabling Vulnerability Handling in Integrated Products

#### 4.3.7.2 Enabling Vulnerability Handling in Integrated Products

**_Editor's Note_: _This Section Needs To Be Moved To Section 5_**

When Operating Systems are integrated into subsequent products in a supply chain, vulnerabilities in the operating system may have a particularly high impact on the security characteristics of the final product. Therefore, manufacturers of Operating Systems intended for integration in subsequent products have a responsibility to enable the vulnerability handling processes of manufacturers which depend upon them.