As @Lucas said, a lawyer should be your first port of call, however from a high level I can give some guidance on areas to look at - these are a small subset:

 - How does the organisation test their own security?
 - Do they use approved testers, internal teams, or both?
 - Will you have a right to audit using your own staff or consultants?
 - How do they manage incidents, vulnerabilities and exceptions?
 - Will you have visibility of incidents, vulnerabilities and exceptions during the development lifecycle?
 - Do they use a framework such as [OpenSAMM][1]?
 - What responsibilities do they retain after delivery?
 - How rapidly can they respond to advisories, whether from you, a CERT or a vendor?
 - Do they have an escrow agreement in the event of financial collapse?
 - Who will own the code - could it end up being published without your approval?
 - How do they screen or check their employees prior to employment? 
 - Within what jurisdiction do they operate?

And so on...

Get a lawyer who knows this stuff!




  [1]: http://www.opensamm.org/