This is definitely a good starting point for what should be monitored. The majority of this list can be automated relatively easily, which generally makes more sense than requiring an actual signature.