A check for System Integrity Protection (SIP) seems like a great addition for the appropriately named "System Integrity" section.
I had disabled SIP a while back to debug a system application. Given my workload and the need to go through recovery mode to re-enable it, I've been putting it off for weeks. It'd be great to have Mr. Pareto gently nag me about it.