btw it is important to stress that:

1) slow hash function. 2) per user random salt. 3) everything you want

don't help if the password is "apple".

So also you need:

4a) force users to passwords with required length / non alphanumerical chars, ...

or

4b) relax the security requirements.