Excellent list of things that need to be done! Only thing I would add is new-school security awareness training for all employees from the mail-room up to the board room.