Disk encryption should always be turned on, and I don't think your other tactics are going to provide a meaningful increase in security if that's done (although I still think they're all a good belt-and-suspenders approach).
Our company uses VMs for everything sensitive now, so hopefully no one needs this checklist!
Our company uses VMs for everything sensitive now, so hopefully no one needs this checklist!