I'm not certain about SD cards, but in principle I think a pull-up would be sensible to ensure that random data isn't clocked into the chip while the main processor is booting and its pins in an uncertain state.
Personally I think I would pull-up CS high (so it is not selected) and SCK low (so it doesn't clock). With those two like that the values on the other pins are probably unimportant.