Someone asked me for resources on how to harden a Commerce Server deployment. The best starting point is:

• Deployment – see http://msdn.microsoft.com/en-us/library/dd464584.aspx
• Securing a Deployment – can be found at http://msdn.microsoft.com/en-us/library/dd442366.aspx

Hope this helps!