Great list. Reason rules, so of course one would research/test any proposed updates, and timely is subjective as others have noted. Automated restore to test backups is something I focus on first with new clients. I may not end up doing it (at request of client), but I at least want to make sure I have covered it with them.