That’s a good way of thinking about it - it’s fun to think through how everything digital security-related from privilege separation (engineering controls) to mitigations (PPE) fits in that framework.