These are very good questions to start with. In addition, Make sure you cover the following bases: 1. Security - viruses are just one thing, ask them about pen testing done, system stability, fallback options, rollback plans for deployments/changes, make them reassure you that they are rock solid. 2. integration - cover it extensively - how do they integrate (apis? connectors? own build middleware? what do they offer? if they do not offer, who do they partner with? ) 3. skills - what's included in their out of the box development and service package - who (role) will help all the way through, how many man hours are they offering for support - increase this if needed. 4. roadmap - what else are they working on 5. scalability and strategy - does it align with yours. Just the few most important points that come to mind. I am happy to support further if required. I have personally evaluated over 200 RFPs in my career.