If you're not primarily spending time doing audits on n-tier web and enterprise, I'm not sure how inclusive that is. At least for user devices os and interprocess defense along with chains of trust and mitigation via painless refresh is all pretty os centric. It's just not as rbac centric.