Joe,
that depends primarily on whether the CCM is the Publisher or the Subscriber. I could point you to some services i have disabled in the past on my CCM based on the role they were playing in the cluster, but that won't help much against DOS attacks. for the most part, your best security would be to consider a Firewall that will allow only specific addresses/port numbers through. Cisco does a good job at documented all ports in use on most of their gear, so you won't have a problem finding the ranges of port to open on the FW. other than that, you may follow Microsoft's recommendations on security, but no one guaranties you won't run into some conflicts.
You may be able to secure the CCM application, but securing a Windows 2K box (which is the most important piece) is a whole new game.
E.
