In the kinds of environments this is intended for, there is a good chance that nothing will get done until after the first break-in. Anyone that actually does all ten will be more secure than any place I've ever worked, including some government agencies that really had no excuse for their poor security. Some security related suggestions are annoying. I recently read that a system administrator should know every file on the systems he or she is responsible for. My current personal workstation full backup includes over 70,000 files and I have 7 other systems with 3 different operating systems.
Some products come with hundreds of files and a few with thousands.
Though product use may be documented it's rare for the included files to be documented. It's irritating to be told by those who are supposed to know more than you, that you should do things you know to be entirely impractical. There are two security suggestions that I see regularly. One is to join security related e-mail lists and apply all the security fixes applicable to your products as soon as they become available. Keeping up with a single major list such as NTBugTraq can become nearly a full time job in itself but there is another serious problem with applying security fixes as they become available.