I have always had issues with "best practices" as most of those "best practices" were written to specific networks, businesses, and not my own. ALL businesses differ and historically, we see that best practices have done nothing to slow down compromise. I'm not against best practices, I think people should not rely on them as any holy grail.
You named the top tier best practices, so I will point out what people tend to miss with regards to best practices.
FIREWALLS: Right. Now how many people implement things like bidirectional rules, or logging all. It is one thing to "block" say China from coming IN the door, but if you throw up a "state" rule, there is nothing stopping the machine from initiating an OUTBOUND connection to China. Rules and policies with regards to firewalls need to be placed on both sides of the fence.
Think about this for a minute, you have a laptop for an exec who goes on a business trip. What are his goals during that trip. Perhaps to make a presentation, where he may need to connect to and from corporate to make a presentation, or a pitch? One rule, to and from, block all others. Not that you need to get to that extreme, but firewalls are so often misconfigured, they're useless.
Antivirus: Does little for target attacks since many signatures for advanced threats are not even created. A more effective tool would be some form of notification when the exec is traveling. E.g.: "Your machine is initiating a connection to (PERFORM A WHOIS LOOKUP HE CAN UNDERSTAND) and trying to access THIS DATA"
Updating all software does not defend against (I dislike this term): 0day attacks.
Encrypting the laptop (say with Truecrypt) won't work if your exec DEMANDS his password be simple.