IP address logging can be problematic, my company considers it to be PII to have the full IP (but not if you remove the last 3 digits). I wouldn't include that as a minimum. I also think it's weird to include SSO without including some form of opt-in 2FA. TOTP isn't all that difficult to implement if you are already storing passwords. Note also that I said opt-in so if 2FA is inconvenient, that is fine.

I also don't feel like all of the requirements should be the minimum. Good examples of minimum requirements are the redirect to TLS requirement. External pen testing is one of the requirements that feels like a nice to have rather than a minimum bar. Minimum standards should be stuff that if you don't do it, technically savvy people would be very concerned if someone uses your product. Stuff like lack of TLS, plain text passwords, lack of input sanitization, using an ancient web server, etc.