Why are subsystems within complex systems not treated as independent entities whereas the subsystems may exist as complete systems? Response:

Subsystems can sometimes be authorized separately, especially if they are major components or shared services, but this is not the primary reason for integrated treatment.

Subsystems within a complex system are rarely truly independent; they typically rely on or interact with other subsystems and the overall system infrastructure. This interdependence means that the security posture and operational status of one subsystem can significantly impact others and the system as a whole, necessitating a holistic approach to security and management.

While the system owner for the complex system is responsible, the reason for not treating them independently stems from their technical relationships, not just organizational responsibility.

The premise of the question is that they are not treated as independent, so stating they can be is incorrect in this context.