Disk encryption should always be turned on, and I don't think your other tactics are going to provide a meaningful increase in security if that's done (although I still think they're all a good belt-and-suspenders approach).

Our company uses VMs for everything sensitive now, so hopefully no one needs this checklist!