As @Lucas said, a lawyer should be your first port of call, however from a high level I can give some guidance on areas to look at - these are a small subset:
- How does the organisation test their own security?
- Do they use approved testers, internal teams, or both?
- Will you have a right to audit using your own staff or consultants?
- How do they manage incidents, vulnerabilities and exceptions?
- Will you have visibility of incidents, vulnerabilities and exceptions during the development lifecycle?
- Do they use a framework such as OpenSAMM?
- What responsibilities do they retain after delivery?
- How rapidly can they respond to advisories, whether from you, a CERT or a vendor?
- Do they have an escrow agreement in the event of financial collapse?
- Who will own the code - could it end up being published without your approval?
- How do they screen or check their employees prior to employment?
- Within what jurisdiction do they operate?
And so on...
Get a lawyer who knows this stuff!