Don't forget asset management!
Too many people don't even know what they have, let alone what is vulnerable. You need to have a discovery scanner of some kind to at least get a starting point. Too many machines are rogue or just unknown, so you need to be able to find them...THEN scan them.