This is a good list of basic security measures you can include when you install SQL Server, very similar to my own.

SQL Server Security Checklist.

I don’t bother with changing the default port or disabling the SQL browser (which is disabled anyway if the server only has one instance) because it can get in the way of legitimate systems people without significantly improving security. But the rest are on my list (plus a few more I picked up at SQL Saturday, but where did I put those notes…).