Does CVSS 4.0 replace policy or risk handling?

No. Policy determines, among other things, the risk appetite, system classes, deadlines, exceptions, persons responsible and conditions for risk acceptance. CVSS can consistently record technical severity, current threat and environmental factors, but does not make an administrative decision.

In risk handling, the organization combines that information with applicability, business impact, security, privacy, legal obligations and available measures. She then decides, for example, to restore, limit, avoid, transfer or accept with motivation. The score and vector provide evidence for that decision; they do not replace the policy, decision or stated rationale.