Securing MQ Initiated CICS Workload

Every time I listen to the news I hear about a new 'hack', what's worse is that every time my CIO listens to the news he hears the same thing.  So we've not secured MQ workload on CICS as well as we should have, we know this, and the auditors are blazing a trail to our offices.  How do we go about this?  What can be, and more importantly what needs to be secured?  What IDs are used for triggering and the bridge?  What about messages at rest?  We need a plan, and we need it yesterday.

Tracks: CICS Systems Programming, Middleware and Security and Compliance