What you wrote sounds good to me. I want to suggest to keep an eye on the network-security arround your app:

• Use a (non-software) firewall to allow only needed traffic to your server.
• Stop all unnecessary services on that box.
• If mysqld is one of those services you could allow only connections from 127.0.0.1.
• Use an intrusion-detection-system like snort.
• Make someone responsible to do all security patches but remember to try those patches on a second box before you get hit by some nasty side-effects.
• Continously keep an eye on the logs.
• Plan the actions for a worst-case scenario!