contract antispam

Hi all :

I am in charge of a Exchange Server 2003 that is in the DMZ. I need to contract an Antivirus SMTP and Antispam. I need to create a document with hardware specifications …. What is the best practice to do this.. Any advices!