Comment by rjbrock

In addition to these 3, make sure you enable FileVault. This will encrypt all of your data at rest