I don't know of any official requirements. But RFCs 2182 and 2870
offer good guidance. (Some of 2870 is root zone-specific, but most of
it would apply to a ccTLD server.)
--Steve Bellovin, http://www.research.att.com/~smb (me)
http://www.wilyhacker.com ("Firewalls" book)