Devices operating with the conventional standard SPI need pull-up resistors, which makes the bus somewhat "weak". For frequencies above the MHz order, must consider use an electrical standards based on differential pairs.You see anything from a few MHz to 50MHz or more depending on the parts in question
As all SPI lines are driven by totem-pole drivers you don't need pullups on any of the lines.Is pull-up resistor is quite necessary in the SPI lines. If CS is active low we can use a pull-up resistor for these. But is it required for remaining lines?