The AVS rules provide authorization validation against the supplied billing address. It's recommended that you review the configuration options in the gateway and configure the AVS rules to validate against the numeric portion of the billing address including the 5 digit zip code.

The configuration of the CVV rules will depend on your particular needs. If you are selling items that are a subscription or continuity purchase items, then you'll need to turn off rules for declining the order if the CVV number is "missing" or "unavailable". You can and should leave the rule for declining one CVV mismatch enabled as UltraCart will ask for the CVV number during the customers' initial checkout unless you choose to turn that off (see the "Collect card verification number" checkbox seeing here).